How We Built MAELIN: Graph-Native Incident Response and Counterfactual Simulation with FalkorDB & MCP

A developer built MAELIN, an autonomous incident-response engine that uses FalkorDB as its sole shared state store across three specialist agents, for the WeMakeDevs × FalkorDB Graph Hacks hackathon. The system maps multi-hop exploit paths with read-only graph queries, computes choke-point cuts via max-flow, and replays candidate containment plans on disposable graph clones before touching production, aiming to avoid self-inflicted outages from naive service quarantine.

Submission for the WeMakeDevs × FalkorDB Graph Hacks Hackathon Tracks: Live Cockpit : https://maelin-graph-hacks-demo.onrender.com https://maelin-graph-hacks-demo.onrender.com GitHub Repository : https://github.com/vivekyarra/Graph https://github.com/vivekyarra/Graph Full Cypher Catalog : https://github.com/vivekyarra/Graph/blob/main/docs/CYPHER.md https://github.com/vivekyarra/Graph/blob/main/docs/CYPHER.md Walkthrough Video : https://youtu.be/QCSNoWuLCNc https://youtu.be/QCSNoWuLCNc 1. Executive Summary & The Core Thesis When a critical security alert fires—such as an active exploit path targeting a privileged IAM role—automated response systems usually do the most intuitive thing: quarantine the compromised service immediately. In modern interconnected microservice architectures, this naive reflex is catastrophic. Taking down auth-service severs database pools, halts checkout transactions, breaks billing reconciliation, and locks out legitimate customers cite: 1, 2 . An automated agent attempting to prevent a data breach ends up causing a self-inflicted $160,000/hour enterprise outage cite: 2 . Next week, when a similar alert triggers, another automated workflow or engineer makes the exact same mistake cite: 2 . Why? Because standard tools have no topology awareness, no persistent memory of past incidents, and no way to test containment plans safely cite: 2 .We built MAELIN to solve this fundamental dilemma cite: 2 .Our design philosophy is straightforward: Simulate before you remediate. cite: 1, 2 MAELIN is an autonomous incident response engine whose sole shared brain is FalkorDB cite: 2 . It proves containment mathematically using native graph algorithms, tests interventions on disposable graph clones without touching live production, remembers past postmortems across sessions using vector search, and grounds every single recommendation in verified graph evidence cite: 2 . Security Alert ──► Bounded Multi-Hop Traversal ──► Choke-Point Cut Math ──► Counterfactual Clone Replay ──► Verified Surgical Fix cite: 2 2. System Architecture: Multi-Graph Isolation, Three Agents, Zero In-Memory State Most multi-agent frameworks pass state in Python dictionaries, hidden memory buffers, or unstructured chat logs cite: 2 . If an agent crashes or hallucinates, the reasoning chain is broken and unverifiable cite: 2 . In MAELIN, agents maintain zero shared in-memory state cite: 2 . Their only shared communication channel is FalkorDB cite: 2 . Multigraph Tenant Isolation Using FalkorDB's multigraph architecture, each tenant operates across isolated graphs inside a single database instance: maelin topology : Stores live service dependencies, attack pivot edges, and organizational ownership records. maelin memory : Stores episodic incidents, semantic attack patterns, procedural playbooks, and multi-agent handoff ledgers cite: 5, 6 . maelin sim : Disposable sandbox clones created on demand via topo.copy for counterfactual simulation cite: 4, 5 . The Specialist Agent Pipeline 1.Recon & Graph Mapper Agent : Executes protocol-level read-only queries GRAPH.RO QUERY to discover all multi-hop exploit paths from external ingress points to privileged IAMRole and database targets cite: 2 . It calculates betweenness centrality and evaluates the choke-point cut cite: 2 . 2.Episodic Memory Coordinator : Queries the tenant's memory graph using cosine vector search over incident embeddings db.idx.vector.queryNodes and retrieves proven operational playbooks cite: 2 . 3.Explainable Remediation Agent : Synthesizes the threat paths, customer blast radius, and memory evidence cite: 2 . It runs candidate plans against an ephemeral database clone, validates minimal-cut optimality via Menger's theorem algo.maxFlow , and outputs a verified surgical plan cite: 2, 3 . Each agent records its completed phase into an immutable :Session - :HAS HANDOFF - :Handoff graph transaction cite: 3 : MATCH s:Session {id: $session id} CREATE h:Handoff { id: $handoff id, from agent: $from agent, to agent: $to agent, phase: $phase, evidence ids: $evidence ids, created at: timestamp } CREATE s - :HAS HANDOFF - h RETURN h.id AS handoff id If FalkorDB is unavailable, the entire API fails closed HTTP 503 ; there are zero in-memory or SQLite fallbacks cite: 3 . 3. Deep-Dive : How FalkorDB & MCP Power the Agentic Core 3.1 Model Context Protocol FastMCP Tool Layer Instead of allowing LLMs to execute raw, unvalidated queries, MAELIN exposes its FalkorDB reasoning engine through strictly typed FastMCP tools: 3.2 Bounded Variable-Length Traversal with Exact Provenance Track 01 Standard graph queries often return arbitrary node lists or fail to bound path search depths cite: 3 . MAELIN executes strictly bounded variable-length Cypher traversals CAN PIVOT 1..7 and DEPENDS ON 1..7 , returning explicit nodes p and relationships p in a single round-trip cite: 3 : php MATCH p = ing:Asset {kind: 'ingress'} - :CAN PIVOT 1..7 - target:Asset {kind: 'identity'} WHERE target.role = 'privileged' RETURN n IN nodes p | {id: n.id, role: n.role, kind: n.kind} AS path nodes, r IN relationships p | type r AS path edges ORDER BY length p ASC LIMIT 10 cite: 3 By returning complete path provenance, every node and edge displayed in the cockpit or cited in an agent report is an exact, verifiable fact directly from the GraphBLAS engine cite: 3 . 3.3 Native Choke-Point Cut Math Track 01 To determine which asset represents the single greatest point of exploit leverage, MAELIN pairs native betweenness centrality with path-cut mathematical aggregation cite: 3 : CALL algo.betweenness 'Asset' , 'CAN PIVOT' YIELD node, score RETURN node.id AS service, score ORDER BY score DESC LIMIT 5 Concurrently, MAELIN calculates the exact blast-radius reduction achieved by severing connections through a given vulnerable service cite: 4 : php MATCH p = ing:Asset {kind: 'ingress'} - :CAN PIVOT 1..6 - svc:Asset - :CAN PIVOT 1..2 - iam:Asset {kind: 'identity'} WHERE svc.id = $chokepoint service WITH count DISTINCT p AS paths through service MATCH total = ing:Asset {kind: 'ingress'} - :CAN PIVOT 1..7 - iam:Asset {kind: 'identity'} WITH paths through service, count DISTINCT total AS total paths RETURN paths through service, total paths, toFloat paths through service / toFloat total paths 100.0 AS pct blast radius eliminated cite: 4 The Remediation Agent directly incorporates this calculation into its findings cite: 4 : "Isolating auth-service severs 1 of 1 100.0% active exploit paths to admin-role while preserving 100% of customer checkout and billing dependencies." cite: 4 3.4 Menger's Theorem Min-Cut via algo.maxFlow How can an operator be certain that the agent's recommended cut is minimal and optimal? cite: 4 MAELIN computes the edge connectivity between the threat ingress and the target identity using FalkorDB's native maximum flow algorithm cite: 4 : CALL algo.maxFlow 'Asset', 'CAN PIVOT', $source id, $target id YIELD maxFlow RETURN maxFlow By Menger's Theorem, the maximum number of edge-disjoint paths between source and target equals the minimum number of edges whose removal disconnects them cite: 4 . MAELIN checks the candidate plan's cut size against this theoretical lower bound cite: 4 . If a plan requires 2 cuts and algo.maxFlow returns 2, MAELIN issues a cryptographic certificate that the intervention is mathematically optimal cite: 4 . 3.5 Counterfactual Simulation on Ephemeral Clones Graph.copy The central breakthrough in MAELIN is the ability to simulate before executing cite: 4 . Instead of guessing whether an action will work or applying changes to live operational data, MAELIN dynamically clones the live topology graph in FalkorDB cite: 5 : 1. Spawn a dedicated, isolated sandbox graph sim name = f"maelin {tenant} sim {uuid.uuid4 .hex :8 }" clone = topo.copy sim name try: 2. Execute surgical Cypher deletions exclusively on the clone for action in candidate plan.actions: clone.query action.cypher mutation 3. Re-traverse threat paths on the modified clone remaining routes = clone.query """ MATCH p = ing:Asset {kind: 'ingress'} - :CAN PIVOT 1..7 - target:Asset {role: 'privileged'} RETURN count p AS remaining """ .result set 4. Verify customer dependency preservation on the clone disrupted flows = clone.query """ MATCH f:Asset {kind: 'business flow'} - :DEPENDS ON 1..7 - s:Asset WHERE s.id IN $cut services RETURN count DISTINCT f AS disrupted """, {"cut services": candidate plan.cut service ids} .result set 5. Assert containment: 2 routes reduced to 0, customer disruption = $0/hr assert remaining routes 0 0 == 0 assert disrupted flows 0 0 == 0 finally: 6. Guaranteed deterministic cleanup: sandbox deleted, live graph unmutated clone.delete cite: 5 This guarantees zero risk to live operations while providing empirical proof that containment will succeed cite: 5 . 3.6 Multi-Layered Memory with Cosine Vector Search Track 02 MAELIN maintains a separate persistent memory catalog maelin memory with three distinct layers cite: 5 : When a new incident occurs, MAELIN embeds the incident context and performs a cosine vector similarity search directly inside FalkorDB cite: 6 : CALL db.idx.vector.queryNodes 'Episode', 'embedding', 5, $query vector YIELD node, score MATCH node - :RESOLVED BY - pb:Playbook RETURN node.incident id AS incident id, node.summary AS summary, pb.command AS verified command, score ORDER BY score DESC cite: 6 Transparent Causal Policy Ablation When an operator logs that an intervention caused unforeseen downtime, MAELIN records the episode cite: 6 . During subsequent investigations, the Pareto optimization engine recalculates expected utility cite: 6 . The cockpit UI renders an explicit Causal Policy Ablation Banner, contrasting what the agent would have done without memory versus what it recommends with memory cite: 6 : 3.7 Protocol-Level Safety & Anti-Hallucination Evidence IDs 3.8 Company Brain: Organizational Knowledge Graph Track 03 MAELIN extends the technical topology into an enterprise knowledge graph connecting cite: 7 : Users can ask plain-language questions like "Who owns customer-db and what runbooks apply?" in the BRAIN tab cite: 7 . MAELIN executes a hybrid full-text Cypher query db.idx.fulltext.queryNodes combined with ownership traversal and returns cited answers linked directly to the on-call engineer and approved runbook cite: 7 : CALL db.idx.fulltext.queryNodes 'Document', $search query YIELD node AS doc, score MATCH doc - :GOVERNS - asset:Asset {id: $asset id} <- :OWNS - team:Team <- :MEMBER OF - person:Person OPTIONAL MATCH asset - :HAS RUNBOOK - pb:Playbook RETURN asset.id AS service, team.name AS owning team, person.name AS on call responder, doc.title AS governance doc, doc.kind AS doc kind, pb.command AS runbook command, score ORDER BY score DESC LIMIT 5 4. The Lumen Edge Cockpit & Developer Experience We designed MAELIN's interface around the Lumen Edge design language—a single-screen incident cockpit featuring sub-chromatic engineered glass, deep graphite surfaces 0b0c10 , soft radial gradients, and an interactive 3D graph visualization canvas cite: 7, 8 . Key UI Features 5. Verification & Testing Rigor We subjected MAELIN to rigorous automated testing across 16 test modules cite: 8 : Offline test suite 109 passed, 13 skipped live integration, 0 failures python -m pytest -q Full test suite with live FalkorDB integration FALKOR INTEGRATION=1 python -m pytest -q cite: 8 Test Suite Highlights - Property-Based Randomized DAG Oracle test stress.py : Runs 5,000 synthetic random DAG topologies, comparing Cypher traversal results against an independent mathematical oracle cite: 8 . 6. What We Learned Building on FalkorDB 7. Try It Live & Get Involved Built by Team Pied-Piper for the WeMakeDevs × FalkorDB Graph Hacks Hackathon. cite: 9