The Graph Layer Behind NASA’s Breakthroughs

7,459 words · about 30 min to read · YouTube’s automatic captions

0:00 I've seen many organizations today taking their nicely structured data from an document database formulation or graph database turn it into text documents chunk it up and chug it into vector which is insane. If you have already well structured data why would you turn it into stupid text and turn it into vector embeddings which are completely okay. Tell us a little bit about Neo forj.

Graph databases persist relationships at insertion time

0:18 It's a very interesting technology that really shows graph databases and what graph databases. Yeah. So you connect information right so you connect people events processes products so you can do traditional use cases like supply chain software analytics cyber security and other things unlike in relation other databases that compute connections between information at query time and in graph database we persist it at insertion time. So we basically materialize these relationships as fifth class citizens in the database and then when it comes to querying we just follow pointers in the database. Interesting actually because it actually carries intent, doesn't it? The relationships show if you care about a relationship between two nodes. That's an intent that that is something that is important to the business. You care about the business.

1:03 Hello and welcome to another episode of the AI native dev. And joining me today, a great old friend from many many years. We're talking we were talking about 15 years or so. Michael Hunger, developer advocate, head of developer advocacy at uh actually I moved to product now of product innovation. Wow. So I'm doing all the cool new stuff, the shiny things. I can basically see how how you integrate like all the modern developments especially geni today but also like cloud integrations and so on into the graph database right how that's awesome use basically what I've been doing even in de for a long time with new labs and so on but now like officially in in the product or and driving a lot of these innovation topics.

1:49 Oh that's great. That's great. Well, that that goes to show we didn't meet today, right? And and and yeah, I'm still here at AI AI Focus here in in in Stockholm and and yeah, I bumped into I bumped into Michael both in the corridor and also in the keynote. Um you've been at Neo Forj for like I say 15 years or so as well. Um tell us a little bit about Neo forj because this is it's it's it's it's a very interesting kind of like technology that really shows graph databases and what graph databases. So graph databases many people basically know relation databases where you have rows and columns and tables but in a graph database you have nodes and relationships or entities and relationships basically what you would draw on a whiteboard right so you have c circles and arrows between them and then you can put arbitrary information on the entities but also on relationship which is actually quite important and you connect information right so you connect people events processes products whatever right so you can do traditional use cases like supply chain software analytics cyber security and other

2:50 things. Um, and what's actually especially interesting that unlike in relation to other databases that compute connections between information at query time and in graph database we persist it at insertion time. So we basically materialize these relationships as first class citizens in in the database and then when it comes to querying we just follow pointers in the data which makes it much much faster for these complex queries as such right. So, NEJ has been around for a long time. It's been open source database for a long time. It has Swedish roots as well. So, it come from Mamm Sweden actually. Okay.

3:21 Um and uh so and now we've of course expanded globally. But I joined when we were 10 people like wow seven streets a Brit and American and me really sounds like the start of a joke that doesn't suit they went into a bar and and and they kick over some tables right and all of and all of us and all of a sudden they form relationships and graph databases were born there we go um so yeah I expect no one laughed at that in on the on the audience just then but but we but we laughed so that's that's the important thing so so yeah graph databases have been around a long time people who care about the relationships between nodes, the relationships between data which is very very hard to essentially almost like you're forcing it in relation in a relational data.

4:03 It's quite a pain. Have you tried this ever? I mean you know object relational database mis impedance mismatch right? So that's like even there's even a term for it whenever you try to take a rich domain model and shoehorn it into relation it's always painful right so and busy in a graph it's more natural and it's also what's interesting you don't lose the business people because in a relation database if I show a business person like 250 tables they say okay what do you want to tell me but if you show them basically connected information on the screen how all the things go together then say oh I see and you missed this relationship here by the way something like that so you take also the the the the people from the business side along which makes them for much richer development experience as well.

4:42 It's interesting. It's interesting actually because it actually carries intent, doesn't it? The relationships show if you care about a relationship between two nodes, that's an intent that that is something that is important to the business. Okay, you care about the business and because you can put attributes on relationships as well. You can actually score this intent. You can even put weights and and and scores and things like that on that as well or like time frames, right? So if you have certain relationships that only exist in a certain time frame then you can basically put this information on on it as well which you then can use for recommendation for for detection and other things as well. Yeah. The the not just the attributes on the entities are important but also how are they connected and when and how strongly are they also connected. Magenta is actually even further into graph algorithms and stuff like that. They go into page rank and clustering and like all the other things to see how close nodes are and things.

5:26 Exactly. Or how important one node is in in the network. For instance, if you have something like a fraudster and they have a really high centrality, that means they had a lot of already influence in this in this. But if they have really low scores uh uh centrality scores, then they have not started their fraud business yet. So you can catch them before the fact basically. Yeah. Yeah. Oh, cool. So there's and of course graph databases have been around for a while. for a while. They're not they're not like, you know, I mean, I still love it and I'm still excited about it, but you know, we've been around for a while and people have been using Neforj for a long time.

6:00 Yeah. In just in their normal applications where where the relationships between data is important, graph databases are a great way to implement that and then use that within your application. However, now AI has come along. Everything has changes. And now I mentioned you got you got two sessions. But one was about how um graph databases can help you particularly in and around the rag space and actually pulling context in whereby if you you know get some kind of a prompt you can actually take you can actually understand relationships between between what you know what you're hitting in in your in your in your rag database equivalent. Um and as a result you can actually pull various bits of context that are actually uh adjacently important.

6:43 Exactly. right and the surroundings are important, right? Not just the exact like thing that you get back from your vector search or something like that, but actually what's surrounding it? How does it connect to the context of the user who's actually asking the question, how does it connect to the business uh processes and other things, right? So, so you get much richer answer uh back from the database which you then pass to the LLM for the final. Amazing. So, I'd love to talk about that and then you then you go on later this afternoon to talk about MCP. my other favorite my other one of my other favorite topics and specifically about how devs and dev tools can be used with MCP to effectively make developers more productive. So I really want to focus on that as well. But let's talk about let's talk about how you can use graph databases in in Iraq. I guess to start off with when we use when we we kind of like you know use more traditional kind of like not traditional we're only a few years in right but you know non graphics based rag basic rag um

Vector search lacks context and explainability

1 Highlight · Why vector search falls short in RAG applications

7:34 what I think most people know how kind of like you know people use rag today what are the what are the downfalls there what are the what are the pitfalls that actually say do you know what this isn't this isn't good enough we need we need to be better here yeah actually it's kind of interesting so I was at AI engineering uh conference yesterday last week in San Francisco San Francisco and they actually put up an rag assistant uh using vector search of their conference and right and I tried to find my talk putting in my name it didn't find anything okay I was talking to bunch of people for Microsoft about MCP and they had a talk as well and said basically show me all the talks for Microsoft and NCP and it didn't show anything right so it didn't show me two other talks but not the one that I I came for so what I want to say is basically vector search of content where you only have fragments of of content has a bunch of downfalls. One is it's a black box, right? So you basically vector search but you don't know why and how you actually get these responses. The other thing is also it doesn't take context into account right so it doesn't take in account like like MCP is actually a topic and this topic is connected to

8:35 other talks right so even if it didn't find the talk in the first vector search it could actually via the context of MCT pull the other talks in for instance right so and then uh from that perspective that's something where if you only limit yourself to the text fragments you're losing out on a lot of information that's actually in your data right so most people have actually more than documents they have like already structured data they have semuctured data and lots of other data sources And what was interesting actually one of the examples you gave in the keynote was so I think it was about similar to like a company that has maybe it was putting in um it had an issue or something like that and and it was a ticket that was raised other things like well what other tickets have been raised on this same topic. What other tickets has the company raised? And you can al you can all all of a sudden based on a request start getting a huge amount of context not just about the text string but about about the individual the company the the the relationship the customer look at the customer for instance from from the input you don't just look at the question string but you also look at the

9:36 customer who's asking it and you actually look at what have the what has the customer actually deployed and what is enabled and then and so on and then you tie it back to the to support case and say okay have they already asked previously similar support cases perhaps it's in subsequent follow up error or something like that maybe they've tried other fixes and actually you won't go through that so you understand the full story it's basically like you could almost say like a customer 360 they see the full story unfolding and then uh basically the customer support agent and the LLM can basically take this rich information and craft a much more personalized and more relevant answer for this and the other thing that's really important is when you just get these text fragments back from a ve vector index it's basically black box right so you get it back but you can't explain why and how it came back. But in a graph you can actually point to oh we fetch this information and this is why we fetch it because exactly this relationship exists and because the score on these relationships is higher than X and and so on. So you can also if someone is interested in the kind of why you can basically show them where did it come from why was it what

10:36 why was it retrieved and and and so on. So basically also have this explanability which in some industries is also important for auditing or for regulatory purposes or just because I want to know it didn't answer my question well then I want to know what

10:48 was actually missing and it might actually be that in your source data one relationship was missing that usually connects some stuff but in your data import it was uh you know didn't come in. Yeah. And this was interesting actually because in in in your session you did you did kind of like show if you was to look into you know normal rag you'd essentially just see a whole bunch of floating point kind of like numbers negative numbers vectors make sense of them I can't no it's it's basically a binary file it might as well be a binary file whereas from the rag point of view you'll actually see what do you see do you actually see the nodes and the relationships and things like that exactly you can show them if your application or your assistant uh or agent supports this then you can basically say oh I want to drill down and I want to see the details you click on a link and then shows you basically the visualization of what information was pulled in and how is it related basically so from an eval point of view then who would who who would would there be a role a person who would look at a general request and then say right okay I can see I know what context should be

11:50 here but it's not how do I then actually make changes to this exactly so for instance when you had uh an a system then you get get a useful feedback uh or you basically either active or or indirect feedback then you see okay these answers should actually be coming from the system why are they not coming from the system and then you can basically drill down and say basically what is happening here why are the users not happy then you can actually see oh there was actually a whole part of the information that we have in the system was actually missing because it was disconnected or it was not uh found in the index but if there was a relationship here we could actually fetch it through this as well right and then And then uh if you set real eval pipelines up then you would basically say as part of my eval scoring then you can compare for the lower scoring ones kind of what what's missing in in the structure and you can also have this interactive for the end user where you basically say okay the end user can actually drill down and say see what is actually behind this answer right so and then you can go further and and basically investigate more for instance or basically follow ask

12:50 follow-up questions that follow the the context yeah interesting how would you how would you populate that then because like obviously with with you know a regular you know pine cone or something I just kind of like throw stuff at it and just think okay that'll hopefully that'll hopefully do

Combining structured data with LLM extraction

13:03 exactly that's there's a mix of stuff right so for for once many people already have structured data right and and that's actually something that I my my toenails almost roll up so I've seen many organizations today taking their nicely structured data from an document database or relational or graph database turn it into text documents chunk it up and chunk just chug it into vector index which is insane. If you have already well structured data, why would you turn it into stupid text and turn it into vector embeddings which are completely opaque?

13:32 So one is the the structured data that you already have which might be your you know your customers your projects your employees your processes whatever and then also the unstructured data that you get from from PDF documents from research reports from customer tickets and and so on. So you basically use the structured data and the unstructured data together and for the unstructured data actually LLMs are also super helpful. In the old days we did a lot of NLP Stanford NLTK and like all the other stuff but now actually LLMs are so good at at extraction and language skills that you can provide them a schema and instructions and the text and it will actually extract entities and relationships and attributes from even from unstructured data.

14:11 Yeah, even from and that's actually pretty cool. I was going to say how accurate is that though? Will it try and create as usual? As usual it's not perfect, right? So you get perhaps an 80% sometimes 90% rate but it's still better than having a human go through it manually and then you can also do multipass and there's lots of ways of how to improve this as well. I suppose I suppose a failure there would be it's adding context that isn't relevant so it's actually not as big a problem.

14:37 Exactly. But that's something because you have the schema already you can just validate against the existing schema and drop the stuff that you're not interested in. So from that perspective you also have means to improve it. And then there's like things like entity solution and other things. There's also graph algorithms that you can run then at the end on on top of stuff and say okay these five simments are actually the same sim and we merge it together at one and things like that. Interesting. Let's switch gears a little bit. Let's talk about MCP the hot topic right MCP.

15:05 So interestingly so so first of all why did you pick MCP from a dev point of view as in a dev tooling point of view

Developer MCP servers bridge IDEs and cloud infrastructure

15:13 versus an app point of view? It's a really interesting one because I was um so I started out with MCP actually early December. So Anthropic published their blog post and the the framework or the the spec in late November like last week of November and I built the first MCP server for NEFJ in early December like

2 Highlight · Wrapping infrastructure APIs with developer MCP servers

15:31 first or second week of December and so initially it was like data right so just looking at data but then I thought about oh actually you know this data also has metadata it also has a schema. So as a deaf I can use the schema to for instance generate graphical type definitions or Java classes or Python pyantic classes. And then it got me thinking okay if I have this and I can use MCP to wrap it around APIs could I also wrap um basically infrastructure APIs with an MCP server right and then I saw that some other folks like Cloudflare and others have done this as well. So you can spin up cloud fire workers with MCP. And so I basically built another MCP server that wraps the Nej cloud uh APIs basically where you can provision databases and scale up and scale down databases and stuff like that behind the MCP server.

16:17 and then they turn an out. It's actually really nice if you if you're in your IDE and just say, "Hi, I'm in cursor. Give me my instance. Scale up this instance to something. Oh, I need a quick test instance." And basically as part of your chat behind the scenes, it can go off and do stuff. And then you saw more and more of these kind of def MCP servers popping up like for instance the GitHub server where you can then say oh actually I need uh some uh I want to use this library and I don't have the doc so f fetch the lmtxt from this GitHub repo and and it will go this using the MCP tool right so as a dev and I mean you've used your share of CLI tools from the cloud provider and from all kinds of other infrastructure providers there's a lot to learn and remember right so like all the API with all the um individual commands and all the other stuff and no one wants to remember this kind of stuff because that's not really valuable knowledge, right? So the same is you don't want to go into some crappy AWS UI and click together some services or something like that, right? Why shouldn't I be able to do this in the context of my code where

17:17 actually there's a much richer in understanding of what do I want to deploy? Why and where do I want to deploy it? What are like you know um what's my uh infrastructure setup in terms of like test staging? How many uh test runners do I need to do load testing on this which is all in the in the environment configuration of my project anyway? If I connect this to the MC to the def MCP servers that wrap the infrastructure APIs then I can basically actually make much better decisions than if I go in

17:44 isolation to these APIs or or CLIs and need to reproduce through the human mind all the you're more likely to miss something if you go in and do it manually. Exactly. Right. And then you can just tell it and say hey like for instance with cloud code or so I just connect MCP servers and say basically just in my interaction oh and I need to spin up a test database for this or can you write an integration test or for instance I had recently one where I basically said okay we need to build this application but I want you to test run all the queries that we built in this application against the real test database. So while it was generating the code, it at the same time took the queries that were part of the server basically or the service and test ran it against the test database. So that validated that the queries were all corrected and generated. So it's also kind of a self uh selfcorrection self evaluation part that you give the LLM the code generating LLM as well. Not just llinter and compiler like you have for code but you can also do this on the infrastructure level for your databases for your cloud API.

18:40 So where do you do it? Do you do you mostly do it in the infrastructure layers or to to help you create and presumably this is dev time only? So these are dev time and and perhaps deployment and and devops and and management time as well. Um yeah so those are mostly deaf time ones. Yeah we also have like the whole data MCP for agents and so on which is kind of yet another topic as such right. But I found this really interesting because you know bringing all these things together basically for a deaf is almost like an you have this uh really like a toolbox basically right so where right or in the in the past all these infrastructure uh services were kind of in silos in isolation right so they didn't really work together and even in a service like AWS or so you still see that they're kind of siloed and everything is kind of its own universe in a way right so and but in your uh in your assistant basically all the things come together as an as an as tools basically and then the assistant actually creates this almost like federation layer across them

19:42 if you think about it right so and then and it takes the context of your code and your project into account plus the instructions and the conversations that you have and so it has a much richer interactions and it can cross things right for instance it could take information from let's say um your your CI/CD run and generate new integration tests from it or it can basically take information from your from your cloud database and use this to spin up a new container somewhere in an environment to to do something, right?

20:10 So, it basically can also cross systems basically without you having to copy over stuff from as long as because it's a gentic and it's kind of like making and the context in your on your in your um IDE basically, right? So, it's not that you have to move this somewhere, but it's like in super rich context that's in as part of your and without it, it's that frustration of I'm going to have an interaction with an LLM. It it says something but it can't do it itself. It tells me the steps that I need to do.

20:37 Exactly. And then please go ahead and copy paste and then you become the the junior dev who copies and past stuff to to a form in I don't know in cloud run or in in in EC2 or something and then there's an error. So I have to copy paste the error. Exactly. Why should I do it itself? Right. And then and then you can also start to you know initially it might be manually interactive in the conversation but then you can also tell cloud code whatever we just did there turn it into a script or CI/CD pipeline or something like that right so and then then it basically migrates something that you manually jointly developed into basically running code into auto let's talk about security um actually my previous job was sneak I've lived security for six years and continue to do so of But but as my as my role, I've lived security for six years and now I do it as a as because I want to because I enjoy it. Um let's talk about security with MCP service.

21:30 Actually, you mentioned the GitHub MCP

MCP exposes security risks through data injection

21:32 server. Uh just recently there was an very interesting I think who was it weeks ago, last week there was like an interesting Yeah. Did you see that injection attack? Yeah, that's right. That's right. It needed a bit of a setup in the sense Well, it didn't need that much of a setup. Not not much actually. No, a user has a user has an MCP uh server available, a GitHub MCP server available to the official one. Yeah, the official one. Um they have uh a private and a public repo. They ask something of the public repo. You know, maybe take a look at my issues and fix as many issues as you can or or or you know, solve as many issues as you can.

22:07 Something that actually is is not it's a it's a use case. It's a common use case of a GitHub MTP server. But if a malicious user adds an issue um uh to the public repo asking you know something malicious I want grab as much information private information about whatever it can be as it can be as blatant as it wants to be. Um then that MCP server will go actually yeah I do have access to this user's other private repos. I'll grab that and as a result of trying to fix or solve it actually creates a pull request back on that public repo um with that p with that private information from the private repo and starts and starts edited the read me before the private repact. Yes. Yes. That's what that was the example was it adds the readme and and it's it's information leak from a private repo. How do we and it's really the authorization uh circumventing that authorization that a user does that user have authorization to access that data the user has authorization for both

3 Highlight · The core security flaw of mixed data and instructions

23:06 right so and basically delegate this authorization to the MCP server so the MCP server acts in the users state but the MCP server itself is not problematic because it just basically is API access right so we have API access today the problematic thing is just that the LLM can't discern learn from what is data to process and instructions. So the data and control plane emerge.

23:32 Exactly. And that's one of the big challenges that we need to solve in AI systems anyway. Yes. So not just in MCP and and and and coding assistance but it's a general problem that currently data and instructions are not separate. Yeah. So I hope that the model providers uh will start tagging actually different things. So that basically instructions that are coming from the user and are validated and verified are tagged as instructions and the other things are tacked as processing data.

24:00 Yeah. And then the LLM will treat or that's actually the ideal would treat the instructions as instructions and the rest just as processing. There's a number of approaches that different people have proposed where you can do this today already where you have basically almost like an hierarchy of um LLMs that process stuff. So where you basically say okay the lowest level processing LLMs they see the data and they get an instruction but what they return is not plain text to the upper level LMS which could be interpreted as instructions again but they just basically generate tokens or file names or something like that where basically they just hand pointers and then the the the content of this is actually not um processed in the LLM but just for instance shown on the UI. So it's basically something that goes as on a side channel not through the LM but on a side channel and then the UI would just show it like you would do in a normal UI. So that's one way of how you can

25:01 circumvent things like that or where you say okay the lower level LLM does just data processing but it's not allowed uh to basically ex exit its scope basically where you scope the LLM that it can only do something for instance in the public pro project and can't access this other information. So it's about like a mix of

25:20 so the the the root problem is data and instructions are on the same level which is kind of you had the separation of this in computer since architecture basically right so so that's one challenge and the other one is kind of how are things scoped and who has access to what right so you need some kind of like sandboxing almost for those right so and that's really not just related to MCP even if you use if you was you would use um let's say API calls would do the exactly the same Right. So, it's more like an LLM problem than an MCP problem. It just makes it much much easier with MCP because MCP now opens up all these services and like Lego blocks you can combine them. And I mean, the first rule would of course only use trusted MCP servers.

26:02 This was what this was one of the things I was going to say cuz it kind of like reminds me a little bit of almost like open source components, right? You still need to do your due diligence. You need to recognize who they're coming from. Uh and it's like otherwise we're just going to start adding potentially dangerous things into into that can actually not just dangerous things they they can perform actions right and they can describe so it's software supply chain again it is it's exactly look at snook also entail right so software supply chain attacks and things like that and I think this whole area is

Mitigating security risks through sandboxing and custom servers

26:34 still growing up right and that's why I would also say you should also basically limit and sandbox where use this kind of stuff, right? So, for instance, in really mission critical areas, I would try to avoid using all the bleeding engine things, but only use like things where you as human actually copy and paste stuff from A to B. Yeah. Which is safer than basically running it as automation. And I would more do it more in the exploration phase where you basically try out new things and and so on on harmless projects where you work where everything is an open source project. So for instance, what I do when I uh I use these kind of GitHub integrations, I only give it access to my open source repos. I don't I never give it access to my private repos because I I don't want to accidentally leak something or sometime sometimes I just create another user GitHub user that has only access to the public repos uh if it does not work with the uh tokens, right? So and and and that's where for implementation you want to basically be in a space that's really like a open sandbox right

27:35 and I think that's the core you're what you're doing is you're you're rely you're putting the security the authorization in the hands of a deterministic uh model something that has strong authorization and authentication built in you're not providing the data to the LLM and make and allowing the LM to make that decision as to what is and what isn't. reasonable to put out or you separate the or you separate the processing right so the processing happens in kind of sandbox environments and then the results of that are taken basic really just as data and would basically imagine you would say okay let's process these issues it would not go through the LLM but it would just basically do an create issue call with the content that was generated but the content would never be looked at by the LLM but it would be just passed into the API call as as something so it would never be able to use this as an instruction basically right so and that's where the the sandboxing of these individual parts comes in but it's an interesting space and I think the security you know people say where's the

28:35 S in MCP right oh is that the new that's the new version of the S in IoT stands for security and I mean it's also really I I I love that people try to find these kind of loopholes and injection attacks and so on because that helps making stuff better but that's also a little bit of an arms race right so so it's also fun to watch in Anyway, and and but with all the new technologies, you have these things and and we need to uh sort out the kinks of new.

29:02 Sounds good. Let's give some practical advice to developers out there in terms of which MCP servers they should be considering. Um what's what's what's on your list of things that you use maybe at Neo Forj or that you've seen people use that you think, oh wow, that looks that looks pretty cool. That actually really helped. Uh so for me, uh the extended thinking MCP server for entropic is actually quite useful. Yeah. Then Anthropic added an MCP server that is like in memory MCP server which is actually quite cool. Um which basically can take information from you store it in actually interestingly they picked a knowledge graph as an representation. So we built a Neo version of that which actually can start accumulating information from conversations into an structured data structure and which you could even share across a team. So imagine you as a team are working on something and uh you know for instance you're working on on project specs or so right? So then the information from the conversation could be extracted and added to this joint uh you know knowledge base in a way. So that's something really interesting.

30:01 The other ones that have been using is mostly the the stock ones like Cloudflare and and and and GitHub and Slack a little bit. Notion as well. Actually I learned last week about Pipe which is like an integrator for MCP servers. They have like 2,700 or so MCP servers. Of course, they have many other registries and I saw last week as well that um MRA AI the agent JavaScript tool they have actually an MCP registry registry. I mean really it's insane. Um but uh Pep Pep I found interesting because they basically allow you as application builder to quickly integrate a bunch of MCP servers that they actually validate and partially also self-host as well. So you have like a curated version of like you have like the the the notions, the slacks, the sales forces and and and so on as MCP servers and and that's something that might be actually quite quite nice if you build a integration and stuff. But what I actually would recommend build your own, right? So, you know, take your own

31:02 whatever you're working on, your own APIs or your own infrastructure and just get a much better understanding of how MCP works by building your own MCP server like adding a bunch of tools and prompts and and resources. So, you have a much better firsthand understanding what's actually happening behind the scenes because I think that's one of the dangers. If everything is like a black box and magic then either you don't trust it at all because it's black box or you blindly trust it and and neither side is is is a good place to be right. Yeah, I always said in the past if you make conscious decision informed decisions by having learned before you make the decision then it's much better decisions right so and actually building MCP servers is not hard today you can use first MCP or so and it takes I don't know an hour or two to do one you can either wipe code it if you want to but it's it's you know it's 200 lines of code or so and and that's actually something that gives you much better understanding of MCPS yeah and I think also there's a ton of validation style things as well that we can kind of like add in. I know sneak for example an MCP server. You can just

32:03 kind of say any any security issues in my code. It'll go off run sneak code I think and it will it will provide you information based on that. Um another interesting one that I've I've I've looked at is uh context 7 which I've heard a ton of people talk about whereby it actually gives you a more accurate code generation. So um if if you're if you're I don't know if I'm coding against a certain version of something rather than just try and get huge amounts of information and try and try and you know base uh the the code suggestions to me on every version that I could be using it recognizes oh okay I need to go to this version of the docs or this version of the API and I'll only provide you suggestions from those so it can kind of make that more accurate in terms of the suggestions. There's a ton of them out there.

32:45 I heard about ref. My a friend of mine recommended ref to me. Okay, ref is also an MCP server or and service that provides LLM optimized

Gateway proxies and grassroots adoption of MCP standards

32:53 documentation for different uh tools and libraries basically. So it basically like an LLM txt for each of these kind of frameworks like they have a few hundred frameworks that they support. That's also an interesting one as such. What could be actually really interesting from the security angle is if you think about proxy MCP servers, right? So one MCP server that proxies another one and actually does filtering of the content that goes through. That could be really interesting. So you basically add a layer of security on the ingoing data where you can basically validate certain things within third party service like exactly. So that will be an interesting one and I think we will see more and more that companies will establish these MCP kind of gateways almost where they have like these are the allowed MCP servers in our organization. We add these kind of security authorization controls and also like filter and validation. what can we let go out into the world of the MCP tools and what not kind of feel it feels like almost like what um what Lira are doing from a from

33:54 a you know prompt point of view and and and having guards on the input and output to to and from an LLM but to MCPs or something like that it kind of feels a lot like uh in the spirits of when GraphQL came out in 2016. So because there's now also like the spec the working groups like everyone is jumping on it. There's lots of energy and lots of enthusiasm as well and it's also open source. So I feel very much reminded of back then when we were at Facebook and the graph working group and working with them and so that was actually an good time and I feel like same energy and also kind of same same approach like a grassroots yeah movement more right so yes there's a proposal from from anthropic but then it grows through all the people contributing right and then the big players were actually more or less forced to come on board by the developer ground smell which is amazing right so when how often do you have this that like Google, you know, Microsoft, OpenAI and the others are actually forced by developer adoption to, you know, join initiative. So that so it's like FOMO for the big ones where

34:55 it's usually the other way around. So it's actually quite quite cool. Yeah. Awesome. Michael, I got you know, I got to run. I got I got I got a presentation to give five minutes, right? I got I got I got to run. Michael, absolute pleasure. Absolute pleasure to see you here again and um and we should do this again. But thank you very much. And yeah, if you're interested in in graph databases particularly for for I think you know the the rag style sounds super interesting and I think very very happy to reach out happy to chat and and let me know if if you need any more. So and otherwise we go and see if I I go see you I'll go sit down in the front row and see how see how it goes. Yeah. All right. Thanks very much and thanks all for listening. Tune in to the next episode.

35:35 Take care.