Decepticon is an autonomous AI-powered red team agent platform for offensive security engagements. It orchestrates multiple LLM-based agents (recon, exploit, AD, cloud, etc.) via LangGraph to execute complex, realistic attack chains against targets, with strict Rules of Engagement (RoE) enforcement, sandboxed execution, and human-in-the-loop approval. The system provides a web dashboard (Next.js), CLI (Ink), and MCP server for control and monitoring, and includes a plugin system for extensibility. It also features comprehensive benchmark frameworks for evaluating agent performance on security challenges. The architecture is a multi-service Docker Compose deployment with Python backend services, a Go launcher, Neo4j knowledge graph, and high isolation between management and sandbox networks. This is primarily a software application (automated red team orchestrator) with strong data/research elements such as knowledge graph persistence, benchmarking pipelines, and telemetry collection. The codebase demonstrates high craftsmanship with protocol-based plugin contracts, a well-structured middleware stack, and thorough testing, though the polyglot nature and dual client maintenance add complexity.
Graphiti is a Python library and server framework for building temporal knowledge graphs that serve as persistent memory for AI agents. It ingests unstructured text episodes (messages, transcripts, JSON), uses LLMs to extract entities and relationships with bi-temporal validity windows, deduplicates against existing graph data, and provides hybrid search (semantic + BM25 + graph traversal) with configurable reranking. The codebase is structured around a clean driver abstraction (Neo4j, FalkorDB, Kuzu, Neptune) with per-provider operations classes, a prompt library supporting versioning and overrides, and a multi-provider LLM/embedder/cross-encoder client system. It is primarily an application library, though it includes evaluation infrastructure and research-grade deduplication algorithms (MinHash/LSH).
Linkook is a Python CLI tool for OSINT-driven discovery of linked social media accounts and associated emails across multiple platforms. It takes a single username as input, scans a configurable set of websites (defined in a provider.json file), and recursively extracts linked accounts, usernames, and emails from discovered profiles. The tool supports breach checking via HudsonRock's database or Have I Been Pwned, and can export results to a Neo4j-compatible JSON format for graph visualization. The architecture is modular: a Provider class handles URL templates and regex extraction, a SiteScanner performs HTTP requests and keyword-based existence checks, and a ScannerManager manages concurrent scanning via a thread pool with a queue. The code is well-structured, includes unit tests, and demonstrates solid engineering practices with clean separation of concerns, error handling, and logging.
GQLAlchemy is a Python library and Object Graph Mapper (OGM) for the Memgraph graph database, with secondary support for Neo4j. It provides a fluent Cypher query builder, declarative node/relationship models (Pydantic v2-based), and full lifecycle management of graph database instances (Docker/binary), streams (Kafka, Pulsar), triggers, and high-availability routing. The library also includes a rich set of transformations for bidirectional conversion between Memgraph/Neo4j and popular graph machine learning frameworks (NetworkX, DGL, PyG, TF-GNN), as well as tabular data import (CSV, Parquet, ORC, Feather) from local filesystem, S3, and Azure Blob Storage. While primarily a software library for building graph applications, it has strong data research capabilities through its graph ML translators and ETL importers, making it a hybrid tool suited for both production graph apps and data science pipelines. The codebase is well-tested (unit and integration tests), has comprehensive CI/CD, and follows a modular architecture with abstract base classes for extensibility. However, some modules are large (e.g., monolithic query builders), and optional dependencies (PyTorch, DGL, TF-GNN, PyArrow) increase maintenance surface, with a medium level of technical drift due to some deprecated Pydantic v1 patterns and skipped tests.
This repository is a full-stack application for building knowledge graphs from unstructured data using Large Language Models (LLMs). The backend, built with FastAPI and LangChain, ingests documents from multiple sources (local files, web pages, YouTube, Wikipedia, S3, GCS), chunks them, and uses an LLM to extract entities and relationships, which are stored in a Neo4j graph database. The frontend, a React/TypeScript application, provides a user interface for uploading files, configuring extraction (schema, LLM model, chunking), visualizing the resulting graph, and interacting with the data through a retrieval-augmented generation (RAG) chatbot with multiple retrieval modes (vector, graph, fulltext, hybrid). The system includes post-processing features like community detection, deduplication, and orphan node cleanup, as well as token usage tracking and evaluation metrics (RAGAS). While primarily an application with a web UI, it also contains experimental notebooks (GraphRAG, chunk size evaluation) that serve a data research purpose, making it a hybrid codebase with a dominant application character.
This repository is a comprehensive Chinese-language educational tutorial and codebase for Retrieval-Augmented Generation (RAG) systems, created by Datawhale. It systematically covers the full RAG stack from fundamentals (data loading, chunking, embeddings) to advanced techniques (hybrid search, query construction, Text2SQL, reranking, agentic RAG, and Graph RAG). The code is organized by chapter, with runnable Python scripts demonstrating each concept using popular frameworks like LangChain, LlamaIndex, and LangGraph, alongside vector databases (Milvus, FAISS) and graph databases (Neo4j). While primarily an educational resource, the repository contains several well-crafted, reusable components such as a minimal Text2SQL agent framework, a clean LangGraph-based agentic RAG pattern, and a custom ColBERT reranker. The practical application is a Chinese recipe Q&A system ('尝尝咸淡'), which serves as a consistent domain for demonstrating various RAG techniques. The codebase is hybrid in nature, blending structured educational content with functional demo applications. The repository is actively maintained with a large community following. However, users should be aware of technical drift risks including vendored model code, hardcoded API dependencies, and the presence of AI-generated code sections. The core value lies in its structured curriculum and reusable RAG patterns rather than as a production-ready system.
This repository is neo4rs, a production-grade asynchronous Rust driver for the Neo4j graph database. It implements the Bolt binary protocol (versions 4.x with partial 5.x support) and provides a complete client library for querying, transaction management, connection pooling, cluster routing, and serialization of Neo4j's rich data types (nodes, relationships, paths, temporal and spatial values). The architecture is modular: a connection layer handles TCP/TLS handshakes and chunked message framing; a PackStream serializer/deserializer converts between Rust types and the Bolt wire format; a routing module manages cluster membership and load balancing; and a high-level API (Graph, Session, Txn, RowStream) offers async query execution with automatic retry on transient errors. The codebase includes two parallel Bolt protocol implementations—a legacy one and a newer feature-gated version—which introduces maintenance overhead. Despite this, the project is actively maintained with extensive integration tests against multiple Neo4j versions and a robust CI pipeline. The library is suitable for any Rust application that needs to interact with Neo4j, offering both a high-level ergonomic API and low-level control over the protocol.
Automation Gateway is a reactive, configuration-driven bridge for industrial protocols (OPC UA, MQTT, PLC4X) that routes real-time process data to multiple time-series databases (InfluxDB, IoTDB, OpenSearch, Cassandra, PostgreSQL, etc.) and exposes it via GraphQL, MQTT, and OPC UA servers. The system runs as a single JVM or GraalVM native binary, orchestrated through YAML configuration files that define driver instances, logger sinks, and server endpoints. Its core architecture is built on Vert.x event bus for internal pub/sub messaging, with abstract base classes (DriverBase, LoggerBase) enabling consistent extension for new protocols or data stores. The gateway does not persist data itself; it acts as a real-time router with configurable buffering and queue reliability (memory-mapped disk queue). Key entry points include `App.kt` for the main application and `GraphQLServer.kt` for the administrative API, which supports JWT authentication, health checks, and dynamic component management. External dependencies include Eclipse Milo (OPC UA), HiveMQ MQTT client, PLC4X, Apache IoTDB Thrift, InfluxDB HTTP client, and various database drivers. The codebase is mature (v1.38) with active development, but carries some technical drift in the form of deprecated features still present in source code and a large set of reflection configurations for GraalVM native-image that require careful maintenance.
This repository implements a full-stack AI-powered food recommendation application called '今天吃什么' (What to eat today). The system combines a Next.js frontend with a Python Flask backend that uses a GraphRAG (Retrieval-Augmented Generation) architecture leveraging Neo4j for graph-based recipe relationships and Milvus for vector similarity search. Users interact via a chat interface to receive personalized recipe recommendations with step-by-step cooking instructions. The application includes a comprehensive recipe knowledge base in markdown format, Docker-based deployment orchestration, and a modular RAG pipeline with intelligent query routing and session management.
Aaia is a security analysis tool for AWS IAM and Organizations that visualizes identity and access relationships in a Neo4j graph database. It collects AWS data via CLI commands, stores it as JSON, and loads it into Neo4j for graph-based querying and auditing. The architecture consists of a modular Python application with separate components for data collection, loading into Neo4j, and custom auditing modules. Key entry points include the main Aaia.py script, the Aaia_aws_collector.sh shell script for data gathering, and specialized action/module handlers. The data flow moves from AWS CLI → JSON files → Neo4j graph → analysis results via Cypher queries or custom modules. The tool depends on Neo4j (v3.5.17 compatible), AWS CLI, and several Python packages for policy processing and Neo4j interaction.
Amundsen is an archived data discovery and metadata management platform. The codebase is structured as a multi-service monorepo: a Flask+React frontend, a Flask metadata service backed by graph databases, a Flask Elasticsearch search service, a shared common models library, and the databuilder ETL framework. In production it ingests metadata from databases, warehouses, dashboards, and feature stores through pluggable extractor/transformer/loader/publisher pipelines, publishes it to Neo4j/Neptune/Atlas/MySQL and Elasticsearch, and exposes search, table/dashboard/feature details, lineage, tags, badges, owners, quality checks, and previews through REST APIs and a React/Redux UI. The databuilder component is a genuinely library-quality ETL framework with clean interfaces, serialization abstractions for multiple backends, and a large collection of source-specific connectors. The metadata and search services are conventional Flask REST APIs, while the frontend is a large React application organized around Redux ducks and Redux-Saga async flows. Because of its data-ingestion components, the repository has a hybrid character, but the dominant character is an application platform rather than a data-research project. The project has been archived and shows significant technical drift: it pins Elasticsearch 7.13, Neo4j 4.4, and Node 12 (EOL), contains deprecated preview and search-publisher paths, has duplicated logic across services, and receives no active dependency or security updates. It remains useful as a reference architecture and as a source of extractable engineering patterns, but it is not a safe choice for new production deployments without a fork and substantial modernization.