Features
Everything a decision database needs.
InvariantDB stores what was true, when, and what the system knew when it acted. The catalog below is every shipped primitive that makes that thesis real — from bitemporal Cypher and cryptographic provenance to compliant forgetting and agent memory. Every row is implemented, tested, and deployed.
01 · Storage
Storage + durability
| Feature | Surface |
|---|---|
| Append-only, immutable versioned history | Engine-level; see design principles |
Bitemporal versioning on every property (VALID + RECORDED) | Cypher AT VALID / AT RECORDED / OVER VALID BETWEEN |
| Hash-chained audit log on every commit | /graphs/{name}/audit/verify + db.verifyAclChain |
| WORM mode (irrevocable write-block) | /graphs/{name}/worm + /worm/engage |
| Schema versioning + history | /graphs/{name}/schema/history |
| Crash-safe, deterministic recovery | Engine-level; automatic on restart |
| Background full-graph consolidation | compact_async |
| Per-property history walk | db.propertyHistory(nodeId, 'prop') |
| Online backup + restore round-trip | /graphs/{name}/backup + /graphs/{name}/restore |
02 · Language
Cypher language
Implements openCypher with bitemporal extensions. Highlights:
| Feature | Example |
|---|---|
MATCH / WHERE / RETURN / WITH | standard |
CREATE / MERGE / DELETE / DETACH DELETE | standard |
SET / SET += (map-merge) | SET n += {a: 1, b: 2} |
AT VALID / AT RECORDED / AS OF | MATCH (n) AT VALID '2024-06-01' RETURN n |
OVER VALID BETWEEN, OVER RECORDED BETWEEN | history walks across a window |
OPTIONAL MATCH with multi-stage carryover | nested across WITH boundaries |
UNWIND ... CREATE bulk-seed + range() | UNWIND range(1, 1000) AS i CREATE (:Node {n: i}) |
| WITH-stage aggregation | WITH x, count(*) AS c WHERE c > 5 |
count(DISTINCT x) / collect(DISTINCT x) | dedup-aware aggregates |
| Pattern comprehensions | [(a)-[:KNOWS]->(b) | b.name] |
Quantifiers ANY / ALL / NONE / SINGLE | WHERE ALL(x IN xs WHERE x > 0) |
reduce(acc=init, x IN list | expr) | functional fold |
shortestPath / allShortestPaths | path algorithms in-query |
COUNT { MATCH ... } count-subquery | Cypher-5 |
Named paths p = (a)-[r]->(b) | length(p), nodes(p), relationships(p) |
=~ regex, STARTS WITH, CONTAINS | text matching |
Inline cosine() / euclidean() / dotProduct() | vector similarity in WHERE/RETURN |
$name param substitution | anywhere a literal goes, including LIMIT $page |
EXPLAIN / EXPLAIN ANALYZE | dry-run + with-timing |
CREATE INDEX (current + historical backfill) | property indexes |
UNIQUE constraint | parser + write-path storage check |
03 · Search
Search
| Feature | Surface |
|---|---|
| Fulltext (BM25 via tantivy) | gds.fulltextSearch(label, query, k) |
| Vector (HNSW via instant-distance) | gds.vectorSearch(label, prop, q, k) |
First-class Vector property type | Schema |
cosine(), euclidean(), dotProduct() | Inline in WHERE / RETURN |
Planner pushdown for WHERE cosine(...) | Automatic HNSW selection |
| Vector + graph fusion | gds.semanticMatchExpand(...) |
| Embedding model versioning + drift | db.embeddingModelDrift() |
| Pre-build + cache the searcher | db.buildVectorIndex(label, prop, metric) |
04 · Graph algorithms
Graph algorithms
| Algorithm | Surface |
|---|---|
| shortestPath | gds.shortestPath(source, target, edgeType?) |
| pageRank | gds.pageRank(maxIters?, damping?) |
| connectedComponents | gds.connectedComponents() |
| degreeCentrality | gds.degreeCentrality(direction?) |
05 · Agent memory
Agent memory (AI-first primitives)
Full guide: AI memory.
| Primitive | Procedure(s) |
|---|---|
| Episodic memory log | db.recordEpisode, db.replayEpisodes |
| Working-memory consolidation | db.consolidateSession, db.sessionSummaries |
| Inference provenance + belief revision | db.recordBelief, db.reviseBelief, db.beliefLineage |
| Salience decay + reinforcement | db.applySalienceDecay, db.reinforceSalience |
| Vector + graph fusion | gds.semanticMatchExpand |
| Conversation sub-tenancy | Capability tokens with session claim |
| Embedding drift detection | db.embeddingModelDrift |
| Property provenance walks | db.propertyProvenance, db.derivedFrom |
06 · Compliance
Compliance moat
Full guide: Compliance. Vertical mappings: Regulated industries.
| Primitive | Surface |
|---|---|
| Crypto-shredding (subject-keyed AES-GCM) | db.destroySubjectKey, db.proveErasure |
| Field-level ACL + audit chain | Schema-driven; db.aclEvents, db.verifyAclChain |
| Purpose binding (GDPR Article 5(1)(b)) | Principal.purpose |
| Per-subject DSAR export (Article 20) | db.subjectExport(subject) |
| Per-property provenance | db.propertyProvenance + db.derivedFrom |
| Differential privacy on aggregates | API-key privacyMode + Laplace-noised count/sum/avg with persistent ε budget |
| Capability tokens | /capabilities/issue (signed, scoped, time-limited) |
| Compliance bundle export | /graphs/{name}/compliance/export |
| Tamper-evident audit chain | db.verifyAclChain, db.dpVerifyChain, history witness |
07 · Server
Server / API
| Feature | Surface |
|---|---|
| HTTP + JSON Cypher endpoint | POST /cypher |
| Schema CRUD | GET/PUT /graphs/{name}/schema |
| Multi-graph registry | GET /graphs, POST /graphs, DELETE /graphs/{name} |
| Per-tenant rate limiting | API key rateLimits: {query, mutate} |
| Per-query timeout | Configurable at deploy time |
| Slow query log + counter | Configurable threshold; Prometheus surface |
| Cooperative yielding (long queries) | Configurable throttle threshold |
| Cursor / streaming reads | POST /graphs/{name}/cursor |
/explain endpoint | Plan + cost estimate |
/healthz / /metrics (Prometheus) | Liveness + observability |
| OpenAPI spec | GET /openapi.yaml + GET /docs (Swagger UI) |
| OpenTelemetry tracing | OTLP/gRPC; standard OTLP env vars |
08 · Auth
Auth
| Mode | Surface |
|---|---|
| Operator-static bearer tokens | Authorization: Bearer <env-token> (constant-time compared) |
| Runtime-issued API keys | gq_<random> prefix; SHA-256 stored, secret shown once |
| JWT (Cognito-style) | Configurable issuer + JWKS URL |
| HMAC | Per-request signed header |
| Capability tokens | Signed, scoped, time-limited bearer |
| Field-level ACL + roles | Schema-declared; principal carries role list |
| Purpose binding | Principal.purpose from JWT / capability |
| Tenant isolation | Per-graph tenant check |
| Differential-privacy mode | privacyMode on API key — aggregate-only restriction |
09 · SDK
Python (
Node (
SDK
Python (pip install invariantdb)
db.cypher(...),db.cypher_streaming(...)db.graphs.ensure(name),db.graphs.list()db.indexes.ensure(label, prop)db.search.fulltext(...),db.search.vector(...),db.search.prebuild(...)db.cursor.stream(query, batch_size)- Capability + Cognito token providers
Node (npm install https://sdk.invariantdb.com/node/invariantdb-0.7.0.tgz)
Same surface, idiomatic to TypeScript.
10 · MCP
MCP — Model Context Protocol
Live endpoint: https://invariantdb.com/e/mcp (HTTP POST, JSON-RPC 2.0; auth via Authorization: Bearer gq_...). Drop-in for Claude Desktop, Cursor, Continue, or any MCP-compatible agent client. 14 tools: read, search, agent-memory, compliance, translation. See the quickstart for the 30-second Claude Desktop config snippet.
11 · Replication
Replication / distribution
| Feature | Status |
|---|---|
| Quorum-replicated consensus | Shipped — strongly-consistent single-leader cluster |
| Read replicas | Shipped — horizontal reader scale-out |
| HA + DR drill (multi-node failover + restore) | In flight |
| Data residency constraints in replication | In flight |
12 · Operability
Operability
| Feature | Surface |
|---|---|
Prometheus /metrics | 30+ counters (queries, mutations, ACL events, DP counters, integrity ops) |
| CloudWatch dashboard JSON | Shipped with production onboarding |
| Job lifecycle persistence | Long-running imports survive restart |
| Per-graph flush control | /flush, /flush_async |
| Per-graph warm-up | /graphs/{name}/warmup |
| Per-graph backup + restore | /graphs/{name}/backup, /restore |
| Engine info / capabilities | /healthz |
13 · Boundaries
Things we don't claim
- We are not SOC 2 / HIPAA / FedRAMP certified yet. SOC 2 Type 2 is on the roadmap and gated to our first paid contract in a regulated industry.
- We don't replace your DPA / BAA / SAR controls program. The database makes the data-layer defensible; certification audits your organization as a whole.
- Data residency constraints in replication are design-complete but not yet shipped. Single-region single-cluster satisfies most FedRAMP-moderate boundaries today.
- min/max under differential privacy isn't implemented yet (deferred to a later phase).
count/sum/avgare shipped. - We're not openCypher 100% compliant. Covered surface in docs.
Start with one decision
Build systems that can explain themselves later.
Connect an agent, maintain an agentic twin, or replay a historical state. The underlying record stays inspectable from day one.