Graph features that exist at decision time
JetGraph is not a bag of Cypher plus a cache. Velocity, novelty, cardinality, and risk propagation are stored and updated with the graph.
O(1) velocity
Velocity windows (1 minute, 5 minutes, 1 hour, 24 hours) are pre-computed as ring counters. GetVelocityCount is a DashMap lookup — it does not scan edges at query time. That is the difference between “aggregate in the risk service” and “read a counter the engine already maintains.”
Related: fraud detection docs and risk scoring.
Relationship novelty
Before you insert an event, you can ask whether a src–dst pair already exists for an edge type (card→merchant, user→device, host→IP). First-time relationships are first-class fraud and identity signals. The compact edge store is built around unique pairs, so the check stays on the hot path.
Automatic risk propagation
Flag a node with a direct risk score and reason. Connected entities receive neighbor exposure (max_neighbor_risk_score, flagged_neighbor_count) without a separate batch job. Unflag decrements exposure. Details: Why JetGraph.
HyperLogLog cardinality
GetNeighborCount estimates distinct neighbors (how many unique users hit this merchant, how many hosts touched this IP) in ~0.06 ms typical published latency — without walking the full adjacency list.
Streaming ingestion
BatchMutate is a bidirectional gRPC stream. Unary CreateEdge is simpler and slower (~10k ops/sec published vs ~35k streaming). Use streaming on the production write path; use unary for tools and low-rate control planes.
openCypher subset
Write MATCH, CREATE, and CALL procedures for decision-path queries. This is not full Neo4j Cypher. Authoritative language coverage: Cypher Manual. Guided querying: Cypher queries.
Bolt for compatible drivers
Bolt on port 7687 lets Neo4j-compatible drivers connect. Use them for the supported subset. JetGraph is not a drop-in replacement for every Neo4j driver call, procedure, or clustered topology. See Bolt documentation and JetGraph vs Neo4j.
gRPC and HTTP APIs
gRPC (port 50051) exposes Graph, Feature, Schema, and streaming mutate services — the fastest path from Rust. HTTP (port 8080) exposes /cypher, health, and admin/tooling endpoints. Modeling guide: data modeling.
Rust implementation
The engine is written in Rust (Tokio runtime, DashMap sharding). No garbage collector on the query path. Strings are dictionary-encoded; booleans are bit-packed. Architecture: in-memory graph engine.
Docker and snapshots
Single-node Docker deployment. Snapshots persist the in-memory graph; recovery loads the latest snapshot rather than replaying a long WAL of user queries. Optional warm standby ships snapshots/deltas for failover — not distributed query execution. See persistence and clustering.