Raz0r DB — the cell-secure graph database

What raz0rdb is

Think Neo4j's labelled property graph and openCypher, with Accumulo-style cell visibility fused into the storage engine, plus a governor that watches for exfiltration and an audit log you can prove wasn't tampered with. It speaks Bolt (Neo4j-compatible), gRPC, and a native MCP endpoint for AI agents. Storage is MVCC over an embedded key–value store with a write-ahead log; the whole thing ships as a single container.

The security model — cell visibility

Every stored value (a property, a label, an edge) carries a visibility expression: a boolean formula over security labels, e.g. (TS & CRYPTO) | S. A principal holds a set of labels (their clearance); a cell is visible to them iff the expression evaluates true against that set.

• S — visible to anyone holding label S.
• TS & CRYPTO — needs both labels.
• (TS & CRYPTO) | ADMIN — either the compartment, or an admin override.
• An empty expression means public (visible to all) — the Accumulo ColumnVisibility model.

Connecting & authenticating

Pick the surface that fits your client:

Bolt

Drive it with any Neo4j driver — raz0rdb answers the Bolt handshake and openCypher.

gRPC

The typed service for application back-ends and the console.

MCP

A native Model Context Protocol endpoint so AI agents get graph tools with the security enforced inside the engine — an agent never sees a cell above its clearance.

Identity is authenticated, not asserted: present a signed HMAC bearer token; the engine derives your principal (and therefore your clearance labels) from the verified credential. The days of a self-declared principal in a request body are gone.

Querying with openCypher

Read queries use the openCypher you already know — pattern match, filter, pipeline through WITH, project or aggregate in RETURN, then order/paginate. Writes use CREATE / SET / DELETE, transactional and durable. Every read is clearance-filtered as it executes, and a cost-based optimiser reorders the pattern to anchor on the most selective node.

Time-travel reads are first class: AS OF <version> pins a query to a historical MVCC snapshot.

Plans — EXPLAIN & PROFILE

Prefix a read with EXPLAIN to see the chosen plan (anchor, index-vs-scan, expansion order, estimated rows) without executing, or PROFILE to run it and annotate the actual rows and store hits.

Graph analytics — cell-secure

raz0rdb ships a suite of graph-data-science primitives — neighbourhood overlap, common neighbours, Adamic–Adar, preferential attachment, and link prediction — all computed filter-then-compute: an edge or node you can't see contributes nothing to a score. Analytics run relative to your clearance, so two analysts get answers consistent with what each is allowed to know.

The access governor — anti-exfiltration

Authorised access can still be abuse — a cleared insider bulk-reading everything. The governor scores every read against the principal's own learned baseline on four signals — probe (fraction of touched cells that were denied — recon), volume, breadth (fan-out), and a token-bucket rate — and escalates Allow → Throttle → Trip. The baseline only learns while calm, so an attack can't train itself normal. No model runs in the read path; it's online adaptive scoring.

The provable audit

Every access is recorded in an append-only, hash-chained audit log — an RFC-6962-style Merkle transparency log with inclusion and consistency proofs. Crucially, checkpoints are Ed25519-signed by an external witness whose key the database does not hold, and the verifier takes the expected root as an operator-pinned input. An operator who edits the log cannot forge a matching proof: tampering is detectable, not merely discouraged.

Clearance labels & identity

Principals are bound to a cryptographic identity; the labels they hold come from the registry, not from anything they say. Write cells with the visibility expression the data warrants; grant principals the labels their role warrants. The intersection is what they see — enforced on every cell, every read.

Durability — MVCC + WAL

Writes go through a write-ahead log fsync'd before acknowledgement, then into an MVCC store, so a crash recovers to a consistent point and a torn tail is discarded rather than trusted. MVCC snapshots power AS OF time-travel and give readers a stable view without blocking writers.

Running raz0rdb

raz0rdb builds and ships as a single container. Bring it up with Docker; point your Bolt/gRPC/MCP client at it. Key hardening knobs for a classified deployment:

• abs_volume_cap — the per-principal absolute read budget (0 = unlimited).
• Encryption — turn value encryption on for classified data at rest.
• Bind write/audit/MCP surfaces to your management (e.g. WireGuard) interface.

Security posture — what's enforced

What the engine guarantees today: cryptographic authN (no self-asserted identity); in-engine cell security across query, EXPLAIN/PROFILE, aggregates and analytics; fail-closed on corrupt cells; the anti-exfiltration governor with an absolute budget; and a witness-signed, externally-verifiable audit.

Deployment responsibilities: enable encryption for classified data at rest, set an absolute volume budget, and network-isolate the management surfaces. Treat query results that re-enter an AI model as untrusted, and pin the audit witness key out of band.