neo4j-security-skill

Name: neo4j-security-skill
Author: neo4j-contrib

326installs33forks

How to install neo4j-security-skill?

neo4j-contrib/neo4j-skills/neo4j-security-skill

$npx -y skills add neo4j-contrib/neo4j-skills --skill neo4j-security-skill

Installs into the current project.

Summary

Programmatic security management in Neo4j — RBAC/ABAC, user lifecycle (CREATE/ALTER/DROP USER),

Files · 1

View on GitHub

SKILL.md

1	## When to Use
2	- Creating, altering, suspending, or dropping users
3	- Creating roles, granting/revoking role membership
4	- Granting/denying/revoking graph, database, or DBMS privileges
5	- Inspecting current privileges (`SHOW PRIVILEGES`)
6	- Implementing property-level access control (read/write per property)
7	- Setting up ABAC rules against OIDC claims
8	- Referencing LDAP/SSO auth provider configuration
9
10	## When NOT to Use
11	- Writing Cypher queries against application data → `neo4j-cypher-skill`
12	- Cluster ops, backups, server config → `neo4j-cli-tools-skill`
13	- Driver connection setup → `neo4j-driver-*-skill`
14
15	---
16
17	## MCP Write Gate — MANDATORY
18
19	Before executing ANY of the following, show the planned command and wait for explicit confirmation:
20	- `CREATE USER` / `ALTER USER` / `DROP USER`
21	- `CREATE ROLE` / `DROP ROLE`
22	- `GRANT` / `DENY` / `REVOKE` (any privilege)
23	- `CREATE AUTH RULE` / `DROP AUTH RULE`
24
25	Never auto-execute privilege changes. Show exact Cypher, annotate impact, get "yes".
26
27	---
28
29	## Execution Context
30
31	All security Cypher runs against the system database:
32	```cypher
33	// Neo4j auto-routes CREATE/ALTER/SHOW USER\|ROLE\|PRIVILEGE to system
34	// If using cypher-shell: cypher-shell -d system
35	// If using driver: use database="system"
36	```
37
38	---
39
40	## 1. User Management
41
42	### Create user
43	```cypher
44	CREATE USER alice SET PASSWORD 'secret' CHANGE NOT REQUIRED;
45	// CHANGE REQUIRED (default): forces password change on first login
46	// CHANGE NOT REQUIRED: password valid immediately
47	// SET STATUS ACTIVE (default) \| SUSPENDED
48	```
49
50	### Parameterised password (preferred in scripts)
51	```cypher
52	CREATE USER $username SET PASSWORD $password CHANGE NOT REQUIRED;
53	```
54
55	### Alter user
56	```cypher
57	ALTER USER alice SET PASSWORD $newPw CHANGE NOT REQUIRED;
58	ALTER USER alice SET STATUS SUSPENDED; // lock account
59	ALTER USER alice SET STATUS ACTIVE; // unlock
60	ALTER USER alice SET HOME DATABASE mydb; // default db on connect
61	ALTER USER alice IF EXISTS SET PASSWORD $pw; // safe if missing
62	```
63
64	### Show users
65	```cypher
66	SHOW USERS YIELD username, roles, passwordChangeRequired, suspended, homeDatabase
67	WHERE suspended = false
68	RETURN username, roles ORDER BY username;
69	```
70
71	### Drop user
72	```cypher
73	DROP USER alice IF EXISTS;
74	```
75
76	---
77
78	## 2. Role Management
79
80	### Create / drop role
81	```cypher
82	CREATE ROLE analyst;
83	CREATE ROLE analyst IF NOT EXISTS;
84	DROP ROLE analyst IF EXISTS;
85	```
86
87	### Assign / remove roles
88	```cypher
89	GRANT ROLE analyst TO alice;
90	GRANT ROLE analyst, writer TO alice, bob; // bulk
91	REVOKE ROLE analyst FROM alice;
92	```
93
94	### Inspect roles
95	```cypher
96	SHOW ROLES YIELD role, member ORDER BY role;
97	SHOW ROLE analyst PRIVILEGES AS COMMANDS; // returns runnable GRANT commands
98	SHOW POPULATED ROLES YIELD role; // only roles with members
99	```
100
101	---
102
103	## 3. Privilege Decision Table
104
105	\| Goal \| Command \|
106	\|---\|---\|
107	\| Allow db connection \| `GRANT ACCESS ON DATABASE mydb TO analyst` \|
108	\| Read all graph data \| `GRANT MATCH {} ON GRAPH mydb ELEMENTS TO analyst` \|
109	\| Read specific label \| `GRANT MATCH {*} ON GRAPH mydb NODES Person TO analyst` \|
110	\| Read specific rel type \| `GRANT MATCH {*} ON GRAPH mydb RELATIONSHIPS KNOWS TO analyst` \|
111	\| Read one property \| `GRANT READ {email} ON GRAPH mydb NODES Person TO analyst` \|
112	\| Traverse but hide properties \| `GRANT TRAVERSE ON GRAPH mydb NODES Person TO analyst` \|
113	\| Write (create/set) \| `GRANT WRITE ON GRAPH mydb TO writer` \|
114	\| Create nodes only \| `GRANT CREATE ON GRAPH mydb NODES Person TO writer` \|
115	\| Delete nodes only \| `GRANT DELETE ON GRAPH mydb NODES Person TO writer` \|
116	\| Execute procedure \| `GRANT EXECUTE PROCEDURE apoc.* TO analyst` \|
117	\| Execute function \| `GRANT EXECUTE USER DEFINED FUNCTION apoc.* TO analyst` \|
118	\| All on one db \| `GRANT ALL ON DATABASE mydb TO dba` \|
119	\| Full DBMS admin \| `GRANT ALL ON DBMS TO dba` \|
120	\| Manage users \| `GRANT USER MANAGEMENT ON DBMS TO secadmin` \|
121	\| Manage roles \| `GRANT ROLE MANAGEMENT ON DBMS TO secadmin` \|
122	\| Schema changes \| `GRANT CREATE ELEMENT TYPES ON DATABASE mydb TO schemaadmin` \|
123
124	### DENY overrides GRANT
125	```cypher
126	// Analyst can read Person but NOT the ssn property
127	GRANT MATCH {*} ON GRAPH mydb NODES Person TO analyst;
128	DENY READ {ssn} ON GRAPH mydb NODES Person TO analyst;
129	```

People who liked this also viewed

6 picks

Type

azure-storageAzure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake. Answers questions about storage access tiers (hot, cool, cold, archive), when to use each tier,SkillsJul 2026471k1.3k
supabase-postgres-best-practicesPostgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or database configurations.SkillsJul 2026302k2.4k
supabaseUse when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, SkillsJul 2026179k2.4k
convex-quickstartCreates or adds Convex to an app. Use for new Convex projects, npm create convex@latest, frontend setup, env vars, or the first npx convex dev run.SkillsJul 202690k39
convex-performance-auditAudits Convex performance for reads, subscriptions, write contention, and function limits. Use for slow features, insights findings, OCC conflicts, or read amplification.SkillsJul 202689k39
convex-setup-authSets up Convex auth, identity mapping, and access control. Use for login, auth providers, users tables, protected functions, or roles in a Convex app.SkillsJul 202689k39

neo4j-security-skill

326installs33forks

View on GitHub

How to install neo4j-security-skill?

neo4j-contrib/neo4j-skills/neo4j-security-skill

$npx -y skills add neo4j-contrib/neo4j-skills --skill neo4j-security-skill

Installs into the current project.

Summary

Programmatic security management in Neo4j — RBAC/ABAC, user lifecycle (CREATE/ALTER/DROP USER),

Files · 1

View on GitHub

SKILL.md

1	## When to Use
2	- Creating, altering, suspending, or dropping users
3	- Creating roles, granting/revoking role membership
4	- Granting/denying/revoking graph, database, or DBMS privileges
5	- Inspecting current privileges (`SHOW PRIVILEGES`)
6	- Implementing property-level access control (read/write per property)
7	- Setting up ABAC rules against OIDC claims
8	- Referencing LDAP/SSO auth provider configuration
9
10	## When NOT to Use
11	- Writing Cypher queries against application data → `neo4j-cypher-skill`
12	- Cluster ops, backups, server config → `neo4j-cli-tools-skill`
13	- Driver connection setup → `neo4j-driver-*-skill`
14
15	---
16
17	## MCP Write Gate — MANDATORY
18
19	Before executing ANY of the following, show the planned command and wait for explicit confirmation:
20	- `CREATE USER` / `ALTER USER` / `DROP USER`
21	- `CREATE ROLE` / `DROP ROLE`
22	- `GRANT` / `DENY` / `REVOKE` (any privilege)
23	- `CREATE AUTH RULE` / `DROP AUTH RULE`
24
25	Never auto-execute privilege changes. Show exact Cypher, annotate impact, get "yes".
26
27	---
28
29	## Execution Context
30
31	All security Cypher runs against the system database:
32	```cypher
33	// Neo4j auto-routes CREATE/ALTER/SHOW USER\|ROLE\|PRIVILEGE to system
34	// If using cypher-shell: cypher-shell -d system
35	// If using driver: use database="system"
36	```
37
38	---
39
40	## 1. User Management
41
42	### Create user
43	```cypher
44	CREATE USER alice SET PASSWORD 'secret' CHANGE NOT REQUIRED;
45	// CHANGE REQUIRED (default): forces password change on first login
46	// CHANGE NOT REQUIRED: password valid immediately
47	// SET STATUS ACTIVE (default) \| SUSPENDED
48	```
49
50	### Parameterised password (preferred in scripts)
51	```cypher
52	CREATE USER $username SET PASSWORD $password CHANGE NOT REQUIRED;
53	```
54
55	### Alter user
56	```cypher
57	ALTER USER alice SET PASSWORD $newPw CHANGE NOT REQUIRED;
58	ALTER USER alice SET STATUS SUSPENDED; // lock account
59	ALTER USER alice SET STATUS ACTIVE; // unlock
60	ALTER USER alice SET HOME DATABASE mydb; // default db on connect
61	ALTER USER alice IF EXISTS SET PASSWORD $pw; // safe if missing
62	```
63
64	### Show users
65	```cypher
66	SHOW USERS YIELD username, roles, passwordChangeRequired, suspended, homeDatabase
67	WHERE suspended = false
68	RETURN username, roles ORDER BY username;
69	```
70
71	### Drop user
72	```cypher
73	DROP USER alice IF EXISTS;
74	```
75
76	---
77
78	## 2. Role Management
79
80	### Create / drop role
81	```cypher
82	CREATE ROLE analyst;
83	CREATE ROLE analyst IF NOT EXISTS;
84	DROP ROLE analyst IF EXISTS;
85	```
86
87	### Assign / remove roles
88	```cypher
89	GRANT ROLE analyst TO alice;
90	GRANT ROLE analyst, writer TO alice, bob; // bulk
91	REVOKE ROLE analyst FROM alice;
92	```
93
94	### Inspect roles
95	```cypher
96	SHOW ROLES YIELD role, member ORDER BY role;
97	SHOW ROLE analyst PRIVILEGES AS COMMANDS; // returns runnable GRANT commands
98	SHOW POPULATED ROLES YIELD role; // only roles with members
99	```
100
101	---
102
103	## 3. Privilege Decision Table
104
105	\| Goal \| Command \|
106	\|---\|---\|
107	\| Allow db connection \| `GRANT ACCESS ON DATABASE mydb TO analyst` \|
108	\| Read all graph data \| `GRANT MATCH {} ON GRAPH mydb ELEMENTS TO analyst` \|
109	\| Read specific label \| `GRANT MATCH {*} ON GRAPH mydb NODES Person TO analyst` \|
110	\| Read specific rel type \| `GRANT MATCH {*} ON GRAPH mydb RELATIONSHIPS KNOWS TO analyst` \|
111	\| Read one property \| `GRANT READ {email} ON GRAPH mydb NODES Person TO analyst` \|
112	\| Traverse but hide properties \| `GRANT TRAVERSE ON GRAPH mydb NODES Person TO analyst` \|
113	\| Write (create/set) \| `GRANT WRITE ON GRAPH mydb TO writer` \|
114	\| Create nodes only \| `GRANT CREATE ON GRAPH mydb NODES Person TO writer` \|
115	\| Delete nodes only \| `GRANT DELETE ON GRAPH mydb NODES Person TO writer` \|
116	\| Execute procedure \| `GRANT EXECUTE PROCEDURE apoc.* TO analyst` \|
117	\| Execute function \| `GRANT EXECUTE USER DEFINED FUNCTION apoc.* TO analyst` \|
118	\| All on one db \| `GRANT ALL ON DATABASE mydb TO dba` \|
119	\| Full DBMS admin \| `GRANT ALL ON DBMS TO dba` \|
120	\| Manage users \| `GRANT USER MANAGEMENT ON DBMS TO secadmin` \|
121	\| Manage roles \| `GRANT ROLE MANAGEMENT ON DBMS TO secadmin` \|
122	\| Schema changes \| `GRANT CREATE ELEMENT TYPES ON DATABASE mydb TO schemaadmin` \|
123
124	### DENY overrides GRANT
125	```cypher
126	// Analyst can read Person but NOT the ssn property
127	GRANT MATCH {*} ON GRAPH mydb NODES Person TO analyst;
128	DENY READ {ssn} ON GRAPH mydb NODES Person TO analyst;
129	```

People who liked this also viewed

6 picks

Type