graph_sage_train · Neo4j Gds MCP: Risk & Policy

WHAT IT DOES

What graph_sage_train does on Neo4j Gds

AI agents use graph_sage_train to create or update resources in Neo4j Gds — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Neo4j Gds environment.

WHY IT NEEDS A POLICY

Why graph_sage_train needs a policy

This tool trains a machine learning model and persists it to the GDS model catalog. It creates/writes a new artifact (the trained model) to the catalog, which is a reversible write operation (the model can be deleted later). It does not execute arbitrary code, delete data, or involve financial transactions.

From the tool's definition 'Trains a GraphSAGE model and stores it in the GDS model catalog under modelName'

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

graph_sage_train Rate-limited

graph_sage_train stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "graph_sage_train": {
      "limits": [
        {
          "counter": "graph_sage_train_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Neo4j Gds, so you can run agents against it safely.

FAQ

Questions about graph_sage_train

What does the graph_sage_train tool do? +

Trains a GraphSAGE model and stores it in the GDS model catalog under modelName. It is categorised as a Write tool in the Neo4j Gds MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on graph_sage_train? +

Register the Neo4j Gds MCP server in PolicyLayer and add a rule for graph_sage_train: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Neo4j Gds. Nothing to install.

What risk level is graph_sage_train? +

graph_sage_train is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit graph_sage_train? +

Yes. Add a rate_limit block to the graph_sage_train rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block graph_sage_train completely? +

Set action: deny in the PolicyLayer policy for graph_sage_train. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides graph_sage_train? +

graph_sage_train is provided by the Neo4j Gds MCP server (neo4j-contrib/gds-agent). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.