Submission for the WeMakeDevs × FalkorDB Graph Hacks Hackathon
Tracks:
Live Cockpit: https://maelin-graph-hacks-demo.onrender.com
GitHub Repository: https://github.com/vivekyarra/Graph
Full Cypher Catalog: https://github.com/vivekyarra/Graph/blob/main/docs/CYPHER.md
Walkthrough Video: https://youtu.be/QCSNoWuLCNc
1. Executive Summary & The Core Thesis
When a critical security alert fires—such as an active exploit path targeting a privileged IAM role—automated response systems usually do the most intuitive thing: quarantine the compromised service immediately. In modern interconnected microservice architectures, this naive reflex is catastrophic. Taking down auth-service severs database pools, halts checkout transactions, breaks billing reconciliation, and locks out legitimate customers[cite: 1, 2]. An automated agent attempting to prevent a data breach ends up causing a self-inflicted $160,000/hour enterprise outage[cite: 2]. Next week, when a similar alert triggers, another automated workflow or engineer makes the exact same mistake[cite: 2]. Why? Because standard tools have no topology awareness, no persistent memory of past incidents, and no way to test containment plans safely[cite: 2].We built MAELIN to solve this fundamental dilemma[cite: 2].Our design philosophy is straightforward: Simulate before you remediate.[cite: 1, 2]MAELIN is an autonomous incident response engine whose sole shared brain is FalkorDB[cite: 2]. It proves containment mathematically using native graph algorithms, tests interventions on disposable graph clones without touching live production, remembers past postmortems across sessions using vector search, and grounds every single recommendation in verified graph evidence[cite: 2].
[Security Alert] ──► [Bounded Multi-Hop Traversal] ──► [Choke-Point Cut Math] ──► [Counterfactual Clone Replay] ──► [Verified Surgical Fix][cite: 2]
2. System Architecture: Multi-Graph Isolation, Three Agents, Zero In-Memory State
Most multi-agent frameworks pass state in Python dictionaries, hidden memory buffers, or unstructured chat logs[cite: 2]. If an agent crashes or hallucinates, the reasoning chain is broken and unverifiable[cite: 2].
In MAELIN, agents maintain zero shared in-memory state[cite: 2]. Their only shared communication channel is FalkorDB[cite: 2].
Multigraph Tenant Isolation
Using FalkorDB's multigraph architecture, each tenant operates across isolated graphs inside a single database instance:
maelin__topology: Stores live service dependencies, attack pivot edges, and organizational ownership records.
maelin__memory: Stores episodic incidents, semantic attack patterns, procedural playbooks, and multi-agent handoff ledgers[cite: 5, 6].
maelin_sim: Disposable sandbox clones created on demand via topo.copy() for counterfactual simulation[cite: 4, 5].
The Specialist Agent Pipeline
1.Recon & Graph Mapper Agent: Executes protocol-level read-only queries (GRAPH.RO_QUERY) to discover all multi-hop exploit paths from external ingress points to privileged IAMRole and database targets[cite: 2]. It calculates betweenness centrality and evaluates the choke-point cut[cite: 2].
2.Episodic Memory Coordinator: Queries the tenant's memory graph using cosine vector search over incident embeddings (db.idx.vector.queryNodes) and retrieves proven operational playbooks[cite: 2].
3.Explainable Remediation Agent: Synthesizes the threat paths, customer blast radius, and memory evidence[cite: 2]. It runs candidate plans against an ephemeral database clone, validates minimal-cut optimality via Menger's theorem (algo.maxFlow), and outputs a verified surgical plan[cite: 2, 3].
Each agent records its completed phase into an immutable (:Session)-[:HAS_HANDOFF]->(:Handoff) graph transaction[cite: 3]:
MATCH (s:Session {id: $session_id})
CREATE (h:Handoff {
id: $handoff_id,
from_agent: $from_agent,
to_agent: $to_agent,
phase: $phase,
evidence_ids: $evidence_ids,
created_at: timestamp()
})
CREATE (s)-[:HAS_HANDOFF]->(h)
RETURN h.id AS handoff_id
If FalkorDB is unavailable, the entire API fails closed (HTTP 503); there are zero in-memory or SQLite fallbacks[cite: 3].
3. Deep-Dive: How FalkorDB & MCP Power the Agentic Core
3.1 Model Context Protocol (FastMCP) Tool Layer
Instead of allowing LLMs to execute raw, unvalidated queries, MAELIN exposes its FalkorDB reasoning engine through strictly typed FastMCP tools:
3.2 Bounded Variable-Length Traversal with Exact Provenance (Track 01)
Standard graph queries often return arbitrary node lists or fail to bound path search depths[cite: 3]. MAELIN executes strictly bounded variable-length Cypher traversals (CAN_PIVOT1..7 and DEPENDS_ON1..7), returning explicit nodes(p) and relationships(p) in a single round-trip[cite: 3]:
MATCH p = (ing:Asset {kind: 'ingress'})-[:CAN_PIVOT*1..7]->(target:Asset {kind: 'identity'})
WHERE target.role = 'privileged'
RETURN [n IN nodes(p) | {id: n.id, role: n.role, kind: n.kind}] AS path_nodes,
[r IN relationships(p) | type(r)] AS path_edges
ORDER BY length(p) ASC
LIMIT 10
[cite: 3]
By returning complete path provenance, every node and edge displayed in the cockpit or cited in an agent report is an exact, verifiable fact directly from the GraphBLAS engine[cite: 3].
3.3 Native Choke-Point Cut Math (Track 01)
To determine which asset represents the single greatest point of exploit leverage, MAELIN pairs native betweenness centrality with path-cut mathematical aggregation[cite: 3]:
CALL algo.betweenness(['Asset'], ['CAN_PIVOT'])
YIELD node, score
RETURN node.id AS service, score
ORDER BY score DESC
LIMIT 5
Concurrently, MAELIN calculates the exact blast-radius reduction achieved by severing connections through a given vulnerable service[cite: 4]:
MATCH p = (ing:Asset {kind: 'ingress'})-[:CAN_PIVOT*1..6]->(svc:Asset)-[:CAN_PIVOT*1..2]->(iam:Asset {kind: 'identity'})
WHERE svc.id = $chokepoint_service
WITH count(DISTINCT p) AS paths_through_service
MATCH total = (ing:Asset {kind: 'ingress'})-[:CAN_PIVOT*1..7]->(iam:Asset {kind: 'identity'})
WITH paths_through_service, count(DISTINCT total) AS total_paths
RETURN paths_through_service,
total_paths,
(toFloat(paths_through_service) / toFloat(total_paths)) * 100.0 AS pct_blast_radius_eliminated
[cite: 4]
The Remediation Agent directly incorporates this calculation into its findings[cite: 4]:
"Isolating auth-service severs 1 of 1 (100.0%) active exploit paths to admin-role while preserving 100% of customer checkout and billing dependencies."[cite: 4]
3.4 Menger's Theorem Min-Cut via algo.maxFlow
How can an operator be certain that the agent's recommended cut is minimal and optimal?[cite: 4] MAELIN computes the edge connectivity between the threat ingress and the target identity using FalkorDB's native maximum flow algorithm[cite: 4]:
CALL algo.maxFlow('Asset', 'CAN_PIVOT', $source_id, $target_id)
YIELD maxFlow
RETURN maxFlow
By Menger's Theorem, the maximum number of edge-disjoint paths between source and target equals the minimum number of edges whose removal disconnects them[cite: 4]. MAELIN checks the candidate plan's cut size against this theoretical lower bound[cite: 4]. If a plan requires 2 cuts and algo.maxFlow returns 2, MAELIN issues a cryptographic certificate that the intervention is mathematically optimal[cite: 4].
3.5 Counterfactual Simulation on Ephemeral Clones (Graph.copy())
The central breakthrough in MAELIN is the ability to simulate before executing[cite: 4].
Instead of guessing whether an action will work or applying changes to live operational data, MAELIN dynamically clones the live topology graph in FalkorDB[cite: 5]:
sim_name = f"maelin_{tenant}_sim_{uuid.uuid4().hex[:8]}"
clone = topo.copy(sim_name)
try:
for action in candidate_plan.actions:
clone.query(action.cypher_mutation)
remaining_routes = clone.query("""
MATCH p = (ing:Asset {kind: 'ingress'})-[:CAN_PIVOT*1..7]->(target:Asset {role: 'privileged'})
RETURN count(p) AS remaining
""").result_set
disrupted_flows = clone.query("""
MATCH (f:Asset {kind: 'business_flow'})-[:DEPENDS_ON*1..7]->(s:Asset)
WHERE s.id IN $cut_services
RETURN count(DISTINCT f) AS disrupted
""", {"cut_services": candidate_plan.cut_service_ids}).result_set
assert remaining_routes[0][0] == 0
assert disrupted_flows[0][0] == 0
finally:
clone.delete()
[cite: 5]
This guarantees zero risk to live operations while providing empirical proof that containment will succeed[cite: 5].
3.6 Multi-Layered Memory with Cosine Vector Search (Track 02)
MAELIN maintains a separate persistent memory catalog (maelin__memory) with three distinct layers[cite: 5]:
When a new incident occurs, MAELIN embeds the incident context and performs a cosine vector similarity search directly inside FalkorDB[cite: 6]:
CALL db.idx.vector.queryNodes('Episode', 'embedding', 5, $query_vector)
YIELD node, score
MATCH (node)-[:RESOLVED_BY]->(pb:Playbook)
RETURN node.incident_id AS incident_id,
node.summary AS summary,
pb.command AS verified_command,
score
ORDER BY score DESC
[cite: 6]
Transparent Causal Policy Ablation
When an operator logs that an intervention caused unforeseen downtime, MAELIN records the episode[cite: 6]. During subsequent investigations, the Pareto optimization engine recalculates expected utility[cite: 6].
The cockpit UI renders an explicit Causal Policy Ablation Banner, contrasting what the agent would have done without memory versus what it recommends with memory[cite: 6]:
3.7 Protocol-Level Safety & Anti-Hallucination Evidence IDs
3.8 Company Brain: Organizational Knowledge Graph (Track 03)
MAELIN extends the technical topology into an enterprise knowledge graph connecting[cite: 7]:
Users can ask plain-language questions like "Who owns customer-db and what runbooks apply?" in the BRAIN tab[cite: 7]. MAELIN executes a hybrid full-text Cypher query (db.idx.fulltext.queryNodes) combined with ownership traversal and returns cited answers linked directly to the on-call engineer and approved runbook[cite: 7]:
CALL db.idx.fulltext.queryNodes('Document', $search_query)
YIELD node AS doc, score
MATCH (doc)-[:GOVERNS]->(asset:Asset {id: $asset_id})<-[:OWNS]-(team:Team)<-[:MEMBER_OF]-(person:Person)
OPTIONAL MATCH (asset)-[:HAS_RUNBOOK]->(pb:Playbook)
RETURN asset.id AS service,
team.name AS owning_team,
person.name AS on_call_responder,
doc.title AS governance_doc,
doc.kind AS doc_kind,
pb.command AS runbook_command,
score
ORDER BY score DESC
LIMIT 5
4. The Lumen Edge Cockpit & Developer Experience
We designed MAELIN's interface around the Lumen Edge design language—a single-screen incident cockpit featuring sub-chromatic engineered glass, deep graphite surfaces (#0b0c10), soft radial gradients, and an interactive 3D graph visualization canvas[cite: 7, 8].
Key UI Features
5. Verification & Testing Rigor
We subjected MAELIN to rigorous automated testing across 16 test modules[cite: 8]:
python -m pytest -q
FALKOR_INTEGRATION=1 python -m pytest -q
[cite: 8]
Test Suite Highlights
-** Property-Based Randomized DAG Oracle (test_stress.py)**: Runs 5,000 synthetic random DAG topologies, comparing Cypher traversal results against an independent mathematical oracle[cite: 8].
6. What We Learned Building on FalkorDB
7. Try It Live & Get Involved
Built by Team Pied-Piper for the WeMakeDevs × FalkorDB Graph Hacks Hackathon.[cite: 9]