This recipe works reasonably well when a user asks: "What is our company's refund policy?"

However, it completely collapses the moment an autonomous agent is tasked with real-world, relational questions:

• "Which bank accounts are linked to this flagged transaction through shared devices or proxy networks?"

• "If an attacker compromised this developer's API key, what production databases are within their blast radius?"

• "Who made the architectural decision on this legacy microservice, and what downstream services break if it goes down?"

These are not vector similarity problems—they are topological problems. The answers depend on how entities—people, machines, credentials, IP addresses, transactions, and permissions—connect across 3, 4, or 6 degrees of separation.

When agents lack a native relational model, they fall into the flat-context trap: they hallucinate connections, miss circular patterns entirely, and operate as black boxes that cannot explain their actions.

To solve this, we built Hopwise for the Graph Hacks Hackathon by WeMakeDevs and FalkorDB. Hopwise is an autonomous investigation agent that leverages FalkorDB as its live context and decision engine.

Why FalkorDB?

When designing an agent that must navigate relationships dynamically, traditional storage engines hit clear walls:

1. Relational SQL Databases fail on multi-hop depth: Joining 5 or 6 tables recursively results in Cartesian blowups, slow query performance, and brittle query generation for an LLM.

2. Vector Stores lose topological structure: Nearest-neighbor search retrieves semantically similar text, but cannot understand directional dependencies or cyclical loops (e.g., A paid B, B paid C, C paid A).

3. Traditional Graph Databases have high latency: Traditional graph engines struggle to maintain the single-digit millisecond response times required when an agent executes iterative query-and-reason loops in real time.

FalkorDB changes this dynamic. Because it operates on index-free adjacency and leverages sparse matrix linear algebra (GraphBLAS), multi-hop Cypher traversals execute in sub-millisecond to single-digit millisecond timeframes. This makes it fast enough to sit directly inside an agent's inner loop—reading, traversing, and validating graph state on every step.

Architecture: How Hopwise Works

[User Objective / Incident Trigger]
                │
                ▼
      ┌──────────────────┐
      │  Agent Planner   │
      └────────┬─────────┘
               │  Selects Tool / Cypher Strategy
               ▼
      ┌──────────────────┐     OpenCypher     ┌────────────────────┐
      │   Tool Router    │ ─────────────────▶ │ FalkorDB Graph DB  │
      └────────┬─────────┘                    │ (Nodes & Edges)    │
               │                              └─────────┬──────────┘
               │ Returns Graph Evidence                 │
               ▼                                        ▼
      ┌──────────────────┐                    ┌────────────────────┐
      │ Evidence Parser  │                    │ Graph Algorithms   │
      │ & Visual Tracer  │                    │ • Shortest Path    │
      └────────┬─────────┘                    │ • Centrality       │
               │                              │ • Components       │
               ▼                              └────────────────────┘
  [Force-Directed Canvas] ◀── Path Highlighting
               │
               ▼
      ┌──────────────────┐
      │ Action Executor  │ ──▶ [Quarantine Cluster / Revoke IAM]
      └────────┬─────────┘
               │
               ▼
      [Immutable Audit Log]

1. The Autonomous Agent Loop

Rather than outputting conversational text, the agent initiates an investigation plan with explicit goals. On each iteration:

It formulates an OpenCypher query or calls a Graph Algorithm tool (such as betweenness centrality or shortest path).

It executes the query against FalkorDB.

It parses the resulting subgraph (nodes, edges, properties, execution metrics).

It synthesizes relational evidence and determines whether the investigation goal has been satisfied.

1. Live Path Highlighting on an Interactive Canvas

Agents shouldn't operate behind closed doors. In Hopwise, we integrated a force-directed network canvas. As the agent navigates from node to node, the exact multi-hop traversal path animates and lights up on screen, providing immediate visual feedback on the agent's line of reasoning.

1. Non-Blackbox Autonomous Actions & Audit Log

In production environments, an agent cannot be trusted to execute destructive mitigations without verified proof. When Hopwise triggers an action (e.g., freezing a bank account or revoking a compromised IAM credential), it binds the action directly to an immutable audit log citing the exact Cypher query, latency, node IDs touched, and relational evidence.

Three Real-World Demonstration Scenarios

We pre-loaded Hopwise with three complex real-world scenarios to demonstrate the breadth of FalkorDB's context layer:

Scenario 1: Financial Fraud & Synthetic Identity Ring

The Challenge: A fraud ring uses synthetic identities (SSNs with mismatched issuance dates) and disguises laundering through circular transactions and offshore shell corporations.

The Graph Model: (:Person)-[:USES]->(:Device)-[:CONNECTED_FROM]->(:IP), (:Person)-[:OWNS]->(:Account), and (:Account)-[:TRANSFER]->(:Account).

The FalkorDB Query:

MATCH (p1:Person)-[:USES]->(d:Device)<-[:USES]-(p2:Person) WHERE p1 <> p2 MATCH (d)-[:CONNECTED_FROM]->(ip:IP {tor: true}) RETURN p1.name, p2.name, d.name, ip.name

The Outcome: The agent detects that seemingly unrelated users share the exact same hardware fingerprint and connect through a known Tor exit node, transfers money to an offshore BVI shell, and immediately quarantines the entire account cluster.

Scenario 2: Cloud Infrastructure Security Breach & Blast Radius

The Challenge: A developer's IAM access key leaks in a public GitHub gist. The security team needs to know immediately what databases and services could be compromised.

The Graph Model: (:Credential)-[:AUTHENTICATES_AS]->(:IAMRole)-[:CAN_ASSUME]->(:IAMRole)-[:HAS_ACCESS_TO]->(:Database).

The FalkorDB Query:

MATCH path = (c:Credential {status: "leaked"})-[:AUTHENTICATES_AS|CAN_ASSUME*1..4]->(target) RETURN path

The Outcome: The agent traces a privilege escalation path across two assumed roles, identifies that the credential can reach the production billing database via VPC peering, revokes the credential, and pages the on-call security engineer.

Scenario 3: Company Brain & Decision Traceability

The Challenge: An incident strikes a critical payment gateway service. The incident commander needs to know who authored the service, what design decisions were documented, and who has active on-call escalation authority.

The Graph Model: (:Engineer)-[:AUTHORED]->(:RFC)-[:GOVERNS]->(:Microservice)-[:DEPENDS_ON]->(:System).

The Outcome: The agent executes a shortest-path traversal to trace the architecture back to the original design document and links the on-call engineer in seconds.

What We Learned Building with FalkorDB

Graph Queries are the Ideal Tool Calling Interface for LLMs: Teaching an LLM to generate Cypher is significantly cleaner than teaching it to chain dozens of REST APIs. Cypher syntax is declarative, human-readable, and naturally matches the way humans conceptualize relationships ((subject)-[predicate]->(object)).

Graph Algorithms Supercharge LLM Reasoning: LLMs are notoriously weak at topological calculations like calculating the shortest path across 1,000 nodes or identifying betweenness centrality. By exposing graph algorithms as callable tools, the agent offloads computational graph math to FalkorDB and focuses its reasoning on interpreting the findings.

Multi-tenancy and Isolation are Crucial: FalkorDB's multi-graph architecture allows spinning up isolated graph instances within a single deployment. In an agent context, this means every user, investigation session, or customer tenant can have their own isolated graph without infrastructure overhead.

Conclusion & Links

AI agents are only as capable as the context they reason over. Moving from flat vectors to rich, connected knowledge graphs with FalkorDB transforms agents from probabilistic guessers into transparent, auditable investigators.

Live Demo: https://hopewise.ritik.biz

Project: https://github.com/Ritik-The-Dev/graphwise-agent-atlas

Built for: Graph Hacks (WeMakeDevs & FalkorDB)