1. Introduction
This guide walks you through setting up Memgraph with Claude Desktop on your laptop to analyze relationships between mule accounts in banking systems. By the end of this tutorial, you’ll have a working setup where Claude can query and visualize banking transaction patterns to identify potential mule account networks.
Why Graph Databases for Fraud Detection?
Traditional relational databases store data in tables with rows and columns, which works well for structured, hierarchical data. However, fraud detection requires understanding relationships between entities—and this is where graph databases excel.
In fraud investigation, the connections matter more than the entities themselves:
- Follow the money: Tracing funds through multiple accounts requires traversing relationships, not joining tables
- Multi-hop queries: Finding patterns like “accounts connected within 3 transactions” is natural in graphs but complex in SQL
- Pattern matching: Detecting suspicious structures (like a controller account distributing to multiple mules) is intuitive with graph queries
- Real-time analysis: Graph databases can quickly identify new connections as transactions occur
Mule account schemes specifically benefit from graph analysis because they form distinct network patterns:
- A central controller account receives large deposits
- Funds are rapidly distributed to multiple recruited “mule” accounts
- Mules quickly withdraw cash or transfer funds, completing the laundering cycle
- These patterns create a recognizable “hub-and-spoke” topology in a graph
In a traditional relational database, finding these patterns requires multiple complex JOINs and recursive queries. In a graph database, you simply ask: “show me accounts connected to this one” or “find all paths between these two accounts.”
Why This Stack?
We’ve chosen a powerful combination of technologies that work seamlessly together:
Memgraph (Graph Database)
- Native graph database built for speed and real-time analytics
- Uses Cypher query language (intuitive, SQL-like syntax for graphs)
- In-memory architecture provides millisecond query responses
- Perfect for fraud detection where you need to explore relationships quickly
- Lightweight and runs easily in Docker on your laptop
- Open-source with excellent tooling (Memgraph Lab for visualization)
Claude Desktop (AI Interface)
- Natural language interface eliminates the need to learn Cypher query syntax
- Ask questions in plain English: “Which accounts received money from ACC006?”
- Claude translates your questions into optimized graph queries automatically
- Provides explanations and insights alongside query results
- Dramatically lowers the barrier to entry for graph analysis
MCP (Model Context Protocol)
- Connects Claude directly to Memgraph
- Enables Claude to execute queries and retrieve real-time data
- Secure, local connection—your data never leaves your machine
- Extensible architecture allows adding other tools and databases
Why Not PostgreSQL?
While PostgreSQL is excellent for transactional data storage, graph relationships in SQL require:
- Complex recursive CTEs (Common Table Expressions) for multi-hop queries
- Multiple JOINs that become exponentially slower as relationships deepen
- Manual construction of relationship paths
- Limited visualization capabilities for network structures
Memgraph’s native graph model represents accounts and transactions as nodes and edges, making relationship queries natural and performant. For fraud detection where you need to quickly explore “who’s connected to whom,” graph databases are the right tool.
What You’ll Build
By following this guide, you’ll create:
The ability to ask natural language questions and get instant graph insights
A local Memgraph database with 57 accounts and 512 transactions
A realistic mule account network hidden among legitimate transactions
An AI-powered analysis interface through Claude Desktop
2. Prerequisites
Before starting, ensure you have:
- macOS laptop
- Homebrew package manager (we’ll install if needed)
- Claude Desktop app installed
- Basic terminal knowledge
3. Automated Setup
Below is a massive script. I did have it as single scripts, but it has merged into a large hazardous blob of bash. This script is badged under the “it works on my laptop” disclaimer!
cat > ~/setup_memgraph_complete.sh << 'EOF'
#!/bin/bash
# Complete automated setup for Memgraph + Claude Desktop
echo "========================================"
echo "Memgraph + Claude Desktop Setup"
echo "========================================"
echo ""
# Step 1: Install Rancher Desktop
echo "Step 1/7: Installing Rancher Desktop..."
# Check if Docker daemon is already running
DOCKER_RUNNING=false
if command -v docker &> /dev/null && docker info &> /dev/null 2>&1; then
echo "Container runtime is already running!"
DOCKER_RUNNING=true
fi
if [ "$DOCKER_RUNNING" = false ]; then
# Check if Homebrew is installed
if ! command -v brew &> /dev/null; then
echo "Installing Homebrew first..."
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
# Add Homebrew to PATH for Apple Silicon Macs
if [[ $(uname -m) == 'arm64' ]]; then
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
fi
fi
# Check if Rancher Desktop is installed
RANCHER_INSTALLED=false
if brew list --cask rancher 2>/dev/null | grep -q rancher; then
RANCHER_INSTALLED=true
echo "Rancher Desktop is installed via Homebrew."
fi
# If not installed, install it
if [ "$RANCHER_INSTALLED" = false ]; then
echo "Installing Rancher Desktop..."
brew install --cask rancher
sleep 3
fi
echo "Starting Rancher Desktop..."
# Launch Rancher Desktop
if [ -d "/Applications/Rancher Desktop.app" ]; then
echo "Launching Rancher Desktop from /Applications..."
open "/Applications/Rancher Desktop.app"
sleep 5
else
echo ""
echo "Please launch Rancher Desktop manually:"
echo " 1. Press Cmd+Space"
echo " 2. Type 'Rancher Desktop'"
echo " 3. Press Enter"
echo ""
echo "Waiting for you to launch Rancher Desktop..."
echo "Press Enter once you've started Rancher Desktop"
read
fi
# Add Rancher Desktop to PATH
export PATH="$HOME/.rd/bin:$PATH"
echo "Waiting for container runtime to start (this may take 30-60 seconds)..."
# Wait for docker command to become available
for i in {1..60}; do
if command -v docker &> /dev/null && docker info &> /dev/null 2>&1; then
echo ""
echo "Container runtime is running!"
break
fi
echo -n "."
sleep 3
done
if ! command -v docker &> /dev/null || ! docker info &> /dev/null 2>&1; then
echo ""
echo "Rancher Desktop is taking longer than expected. Please:"
echo "1. Wait for Rancher Desktop to fully initialize"
echo "2. Accept any permissions requests"
echo "3. Once you see 'Kubernetes is running' in Rancher Desktop, press Enter"
read
# Try to add Rancher Desktop to PATH
export PATH="$HOME/.rd/bin:$PATH"
# Check one more time
if ! command -v docker &> /dev/null || ! docker info &> /dev/null 2>&1; then
echo "Container runtime still not responding."
echo "Please ensure Rancher Desktop is fully started and try again."
exit 1
fi
fi
fi
# Ensure docker is in PATH for the rest of the script
export PATH="$HOME/.rd/bin:$PATH"
echo ""
echo "Step 2/7: Installing Memgraph container..."
# Stop and remove existing container if it exists
if docker ps -a 2>/dev/null | grep -q memgraph; then
echo "Removing existing Memgraph container..."
docker stop memgraph 2>/dev/null || true
docker rm memgraph 2>/dev/null || true
fi
docker pull memgraph/memgraph-platform || { echo "Failed to pull Memgraph image"; exit 1; }
docker run -d -p 7687:7687 -p 7444:7444 -p 3000:3000 \
--name memgraph \
-v memgraph_data:/var/lib/memgraph \
memgraph/memgraph-platform || { echo "Failed to start Memgraph container"; exit 1; }
echo "Waiting for Memgraph to be ready..."
sleep 10
echo ""
echo "Step 3/7: Installing Python and Memgraph MCP server..."
# Install Python if not present
if ! command -v python3 &> /dev/null; then
echo "Installing Python..."
brew install python3
fi
# Install uv package manager
if ! command -v uv &> /dev/null; then
echo "Installing uv package manager..."
curl -LsSf https://astral.sh/uv/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
fi
echo "Memgraph MCP will be configured to run via uv..."
echo ""
echo "Step 4/7: Configuring Claude Desktop..."
CONFIG_DIR="$HOME/Library/Application Support/Claude"
CONFIG_FILE="$CONFIG_DIR/claude_desktop_config.json"
mkdir -p "$CONFIG_DIR"
if [ -f "$CONFIG_FILE" ] && [ -s "$CONFIG_FILE" ]; then
echo "Backing up existing Claude configuration..."
cp "$CONFIG_FILE" "$CONFIG_FILE.backup.$(date +%s)"
fi
# Get the full path to uv
UV_PATH=$(which uv 2>/dev/null || echo "$HOME/.local/bin/uv")
# Merge memgraph config with existing config
if [ -f "$CONFIG_FILE" ] && [ -s "$CONFIG_FILE" ]; then
echo "Merging memgraph config with existing MCP servers..."
# Use Python to merge JSON (more reliable than jq which may not be installed)
python3 << PYTHON_MERGE
import json
import sys
config_file = "$CONFIG_FILE"
uv_path = "${UV_PATH}"
try:
# Read existing config
with open(config_file, 'r') as f:
config = json.load(f)
# Ensure mcpServers exists
if 'mcpServers' not in config:
config['mcpServers'] = {}
# Add/update memgraph server
config['mcpServers']['memgraph'] = {
"command": uv_path,
"args": [
"run",
"--with",
"mcp-memgraph",
"--python",
"3.13",
"mcp-memgraph"
],
"env": {
"MEMGRAPH_HOST": "localhost",
"MEMGRAPH_PORT": "7687"
}
}
# Write merged config
with open(config_file, 'w') as f:
json.dump(config, f, indent=2)
print("Successfully merged memgraph config")
sys.exit(0)
except Exception as e:
print(f"Error merging config: {e}", file=sys.stderr)
sys.exit(1)
PYTHON_MERGE
if [ $? -ne 0 ]; then
echo "Failed to merge config, creating new one..."
cat > "$CONFIG_FILE" << JSON
{
"mcpServers": {
"memgraph": {
"command": "${UV_PATH}",
"args": [
"run",
"--with",
"mcp-memgraph",
"--python",
"3.13",
"mcp-memgraph"
],
"env": {
"MEMGRAPH_HOST": "localhost",
"MEMGRAPH_PORT": "7687"
}
}
}
}
JSON
fi
else
echo "Creating new Claude Desktop configuration..."
cat > "$CONFIG_FILE" << JSON
{
"mcpServers": {
"memgraph": {
"command": "${UV_PATH}",
"args": [
"run",
"--with",
"mcp-memgraph",
"--python",
"3.13",
"mcp-memgraph"
],
"env": {
"MEMGRAPH_HOST": "localhost",
"MEMGRAPH_PORT": "7687"
}
}
}
}
JSON
fi
echo "Claude Desktop configured!"
echo ""
echo "Step 5/7: Setting up mgconsole..."
echo "mgconsole will be used via Docker (included in memgraph/memgraph-platform)"
echo ""
echo "Step 6/7: Setting up database schema..."
sleep 5 # Give Memgraph extra time to be ready
echo "Clearing existing data..."
echo "MATCH (n) DETACH DELETE n;" | docker exec -i memgraph mgconsole --host 127.0.0.1 --port 7687
echo "Creating indexes..."
cat <<'CYPHER' | docker exec -i memgraph mgconsole --host 127.0.0.1 --port 7687
CREATE INDEX ON :Account(account_id);
CREATE INDEX ON :Account(account_type);
CREATE INDEX ON :Person(person_id);
CYPHER
echo ""
echo "Step 7/7: Populating test data..."
echo "Loading core mule account data..."
cat <<'CYPHER' | docker exec -i memgraph mgconsole --host 127.0.0.1 --port 7687
CREATE (p1:Person {person_id: 'P001', name: 'John Smith', age: 45, risk_score: 'low'})
CREATE (a1:Account {account_id: 'ACC001', account_type: 'checking', balance: 15000, opened_date: '2020-01-15', status: 'active'})
CREATE (p1)-[:OWNS {since: '2020-01-15'}]->(a1)
CREATE (p2:Person {person_id: 'P002', name: 'Sarah Johnson', age: 38, risk_score: 'low'})
CREATE (a2:Account {account_id: 'ACC002', account_type: 'savings', balance: 25000, opened_date: '2019-06-10', status: 'active'})
CREATE (p2)-[:OWNS {since: '2019-06-10'}]->(a2)
CREATE (p3:Person {person_id: 'P003', name: 'Michael Brown', age: 22, risk_score: 'high'})
CREATE (a3:Account {account_id: 'ACC003', account_type: 'checking', balance: 500, opened_date: '2024-08-01', status: 'active'})
CREATE (p3)-[:OWNS {since: '2024-08-01'}]->(a3)
CREATE (p4:Person {person_id: 'P004', name: 'Lisa Chen', age: 19, risk_score: 'high'})
CREATE (a4:Account {account_id: 'ACC004', account_type: 'checking', balance: 300, opened_date: '2024-08-05', status: 'active'})
CREATE (p4)-[:OWNS {since: '2024-08-05'}]->(a4)
CREATE (p5:Person {person_id: 'P005', name: 'David Martinez', age: 21, risk_score: 'high'})
CREATE (a5:Account {account_id: 'ACC005', account_type: 'checking', balance: 450, opened_date: '2024-08-03', status: 'active'})
CREATE (p5)-[:OWNS {since: '2024-08-03'}]->(a5)
CREATE (p6:Person {person_id: 'P006', name: 'Robert Wilson', age: 35, risk_score: 'critical'})
CREATE (a6:Account {account_id: 'ACC006', account_type: 'business', balance: 2000, opened_date: '2024-07-15', status: 'active'})
CREATE (p6)-[:OWNS {since: '2024-07-15'}]->(a6)
CREATE (p7:Person {person_id: 'P007', name: 'Unknown Entity', risk_score: 'critical'})
CREATE (a7:Account {account_id: 'ACC007', account_type: 'business', balance: 150000, opened_date: '2024-06-01', status: 'active'})
CREATE (p7)-[:OWNS {since: '2024-06-01'}]->(a7)
CREATE (a7)-[:TRANSACTION {transaction_id: 'TXN001', amount: 50000, timestamp: '2024-09-01T10:15:00', type: 'wire_transfer', flagged: true}]->(a6)
CREATE (a6)-[:TRANSACTION {transaction_id: 'TXN002', amount: 9500, timestamp: '2024-09-01T14:30:00', type: 'transfer', flagged: true}]->(a3)
CREATE (a6)-[:TRANSACTION {transaction_id: 'TXN003', amount: 9500, timestamp: '2024-09-01T14:32:00', type: 'transfer', flagged: true}]->(a4)
CREATE (a6)-[:TRANSACTION {transaction_id: 'TXN004', amount: 9500, timestamp: '2024-09-01T14:35:00', type: 'transfer', flagged: true}]->(a5)
CREATE (a3)-[:TRANSACTION {transaction_id: 'TXN005', amount: 9000, timestamp: '2024-09-02T09:00:00', type: 'cash_withdrawal', flagged: true}]->(a6)
CREATE (a4)-[:TRANSACTION {transaction_id: 'TXN006', amount: 9000, timestamp: '2024-09-02T09:15:00', type: 'cash_withdrawal', flagged: true}]->(a6)
CREATE (a5)-[:TRANSACTION {transaction_id: 'TXN007', amount: 9000, timestamp: '2024-09-02T09:30:00', type: 'cash_withdrawal', flagged: true}]->(a6)
CREATE (a7)-[:TRANSACTION {transaction_id: 'TXN008', amount: 45000, timestamp: '2024-09-15T11:20:00', type: 'wire_transfer', flagged: true}]->(a6)
CREATE (a6)-[:TRANSACTION {transaction_id: 'TXN009', amount: 9800, timestamp: '2024-09-15T15:00:00', type: 'transfer', flagged: true}]->(a3)
CREATE (a6)-[:TRANSACTION {transaction_id: 'TXN010', amount: 9800, timestamp: '2024-09-15T15:05:00', type: 'transfer', flagged: true}]->(a4)
CREATE (a1)-[:TRANSACTION {transaction_id: 'TXN011', amount: 150, timestamp: '2024-09-10T12:00:00', type: 'debit_card', flagged: false}]->(a2)
CREATE (a2)-[:TRANSACTION {transaction_id: 'TXN012', amount: 1000, timestamp: '2024-09-12T10:00:00', type: 'transfer', flagged: false}]->(a1);
CYPHER
echo "Loading noise data (50 accounts, 500 transactions)..."
cat <<'CYPHER' | docker exec -i memgraph mgconsole --host 127.0.0.1 --port 7687
UNWIND range(1, 50) AS i
WITH i,
['Alice', 'Bob', 'Carol', 'David', 'Emma', 'Frank', 'Grace', 'Henry', 'Iris', 'Jack',
'Karen', 'Leo', 'Mary', 'Nathan', 'Olivia', 'Peter', 'Quinn', 'Rachel', 'Steve', 'Tina',
'Uma', 'Victor', 'Wendy', 'Xavier', 'Yara', 'Zack', 'Amy', 'Ben', 'Chloe', 'Daniel',
'Eva', 'Fred', 'Gina', 'Hugo', 'Ivy', 'James', 'Kate', 'Luke', 'Mia', 'Noah',
'Opal', 'Paul', 'Rosa', 'Sam', 'Tara', 'Umar', 'Vera', 'Will', 'Xena', 'Yuki'] AS firstNames,
['Anderson', 'Baker', 'Clark', 'Davis', 'Evans', 'Foster', 'Garcia', 'Harris', 'Irwin', 'Jones',
'King', 'Lopez', 'Miller', 'Nelson', 'Owens', 'Parker', 'Quinn', 'Reed', 'Scott', 'Taylor',
'Underwood', 'Vargas', 'White', 'Young', 'Zhao', 'Adams', 'Brooks', 'Collins', 'Duncan', 'Ellis'] AS lastNames,
['checking', 'savings', 'checking', 'savings', 'checking'] AS accountTypes,
['low', 'low', 'low', 'medium', 'low'] AS riskScores,
['2018-03-15', '2018-07-22', '2019-01-10', '2019-05-18', '2019-09-30', '2020-02-14', '2020-06-25', '2020-11-08', '2021-04-17', '2021-08-29', '2022-01-20', '2022-05-12', '2022-10-03', '2023-02-28', '2023-07-15'] AS dates
WITH i,
firstNames[toInteger(rand() * size(firstNames))] + ' ' + lastNames[toInteger(rand() * size(lastNames))] AS fullName,
accountTypes[toInteger(rand() * size(accountTypes))] AS accType,
riskScores[toInteger(rand() * size(riskScores))] AS risk,
toInteger(rand() * 40 + 25) AS age,
toInteger(rand() * 80000 + 1000) AS balance,
dates[toInteger(rand() * size(dates))] AS openDate
CREATE (p:Person {person_id: 'NOISE_P' + toString(i), name: fullName, age: age, risk_score: risk})
CREATE (a:Account {account_id: 'NOISE_ACC' + toString(i), account_type: accType, balance: balance, opened_date: openDate, status: 'active'})
CREATE (p)-[:OWNS {since: openDate}]->(a);
UNWIND range(1, 500) AS i
WITH i,
toInteger(rand() * 50 + 1) AS fromIdx,
toInteger(rand() * 50 + 1) AS toIdx,
['transfer', 'debit_card', 'check', 'atm_withdrawal', 'direct_deposit', 'wire_transfer', 'mobile_payment'] AS txnTypes,
['2024-01-15', '2024-02-20', '2024-03-10', '2024-04-05', '2024-05-18', '2024-06-22', '2024-07-14', '2024-08-09', '2024-09-25', '2024-10-30'] AS dates
WHERE fromIdx <> toIdx
WITH i, fromIdx, toIdx, txnTypes, dates,
txnTypes[toInteger(rand() * size(txnTypes))] AS txnType,
toInteger(rand() * 5000 + 10) AS amount,
(rand() < 0.05) AS shouldFlag,
dates[toInteger(rand() * size(dates))] AS txnDate
MATCH (from:Account {account_id: 'NOISE_ACC' + toString(fromIdx)})
MATCH (to:Account {account_id: 'NOISE_ACC' + toString(toIdx)})
CREATE (from)-[:TRANSACTION {
transaction_id: 'NOISE_TXN' + toString(i),
amount: amount,
timestamp: txnDate + 'T' + toString(toInteger(rand() * 24)) + ':' + toString(toInteger(rand() * 60)) + ':00',
type: txnType,
flagged: shouldFlag
}]->(to);
CYPHER
echo ""
echo "========================================"
echo "Setup Complete!"
echo "========================================"
echo ""
echo "Next steps:"
echo "1. Restart Claude Desktop (Quit and reopen)"
echo "2. Open Memgraph Lab at https://localhost:3000"
echo "3. Start asking Claude questions about the mule account data!"
echo ""
echo "Example query: 'Show me all accounts owned by people with high or critical risk scores in Memgraph'"
echo ""
EOF
chmod +x ~/setup_memgraph_complete.sh
~/setup_memgraph_complete.shThe script will:
- Install Rancher Desktop (if not already installed)
- Install Homebrew (if needed)
- Pull and start Memgraph container
- Install Node.js and Memgraph MCP server
- Configure Claude Desktop automatically
- Install mgconsole CLI tool
- Set up database schema with indexes
- Populate with mule account data and 500+ noise transactions
After the script completes, restart Claude Desktop (quit and reopen) for the MCP configuration to take effect.
4. Verifying the Setup
Verify the setup by accessing Memgraph Lab at https://localhost:3000 or using mgconsole via Docker:
docker exec -it memgraph mgconsole --host 127.0.0.1 --port 7687In mgconsole, run:
MATCH (n) RETURN count(n);You should see:
+----------+
| count(n) |
+----------+
| 152 |
+----------+
1 row in set (round trip in 0.002 sec)Check the transaction relationships:
MATCH ()-[r:TRANSACTION]->() RETURN count(r);You should see:
+----------+
| count(r) |
+----------+
| 501 |
+----------+
1 row in set (round trip in 0.002 sec)Verify the mule accounts are still identifiable:
MATCH (p:Person)-[:OWNS]->(a:Account)
WHERE p.risk_score IN ['high', 'critical']
RETURN p.name, a.account_id, p.risk_score
ORDER BY p.risk_score DESC;This should return the 5 suspicious accounts from our mule network:
+------------------+------------------+------------------+
| p.name | a.account_id | p.risk_score |
+------------------+------------------+------------------+
| "Michael Brown" | "ACC003" | "high" |
| "Lisa Chen" | "ACC004" | "high" |
| "David Martinez" | "ACC005" | "high" |
| "Robert Wilson" | "ACC006" | "critical" |
| "Unknown Entity" | "ACC007" | "critical" |
+------------------+------------------+------------------+
5 rows in set (round trip in 0.002 sec)5. Using Claude with Memgraph
Now that everything is set up, you can interact with Claude Desktop to analyze the mule account network. Here are example queries you can try:
Example 1: Find All High-Risk Accounts
Ask Claude:
Show me all accounts owned by people with high or critical risk scores in MemgraphClaude will query Memgraph and return results showing the suspicious accounts (ACC003, ACC004, ACC005, ACC006, ACC007), filtering out the 50+ noise accounts.
Example 2: Identify Transaction Patterns
Ask Claude:
Find all accounts that received money from ACC006 within a 24-hour period. Show the transaction amounts and timestamps.Claude will identify the three mule accounts (ACC003, ACC004, ACC005) that received similar amounts in quick succession.
Example 3: Trace Money Flow
Ask Claude:
Trace the flow of money from ACC007 through the network. Show me the complete transaction path.Claude will visualize the path: ACC007 -> ACC006 -> [ACC003, ACC004, ACC005], revealing the laundering pattern.
Example 4: Calculate Total Funds
Ask Claude:
Calculate the total amount of money that flowed through ACC006 in September 2024Claude will aggregate all incoming and outgoing transactions for the controller account.
Example 5: Find Rapid Withdrawal Patterns
Ask Claude:
Find accounts where money was withdrawn within 48 hours of being deposited. What are the amounts and account holders?This reveals the classic mule account behavior of quick cash extraction.
Example 6: Network Analysis
Ask Claude:
Show me all accounts that have transaction relationships with ACC006. Create a visualization of this network.Claude will generate a graph showing the controller account at the center with connections to both the source and mule accounts.
Example 7: Risk Assessment
Ask Claude:
Which accounts have received flagged transactions totaling more than $15,000? List them by total amount.This helps identify which mule accounts have processed the most illicit funds.
6. Understanding the Graph Visualization
When Claude displays graph results, you’ll see:
- Nodes: Circles representing accounts and persons
- Edges: Lines representing transactions or ownership relationships
- Properties: Attributes like amounts, timestamps, and risk scores
The graph structure makes it easy to spot:
- Central nodes (controllers) with many connections
- Similar transaction patterns across multiple accounts
- Timing correlations between related transactions
- Isolation of legitimate vs. suspicious account clusters
7. Advanced Analysis Queries
Once you’re comfortable with basic queries, try these advanced analyses:
Community Detection
Ask Claude:
Find groups of accounts that frequently transact with each other. Are there separate communities in the network?Temporal Analysis
Ask Claude:
Show me the timeline of transactions for accounts owned by people under 25 years old. Are there any patterns?Shortest Path Analysis
Ask Claude:
What's the shortest path of transactions between ACC007 and ACC003? How many hops does it take?8. Cleaning Up
When you’re done experimenting, you can stop and remove the Memgraph container:
docker stop memgraph
docker rm memgraphTo remove the data volume completely:
docker volume rm memgraph_dataTo restart later with fresh data, just run the setup script again.
9. Troubleshooting
Docker Not Running
If you get errors about Docker not running:
open -a DockerWait for Docker Desktop to start, then verify:
docker infoMemgraph Container Won’t Start
Check if ports are already in use:
lsof -i :7687
lsof -i :3000Kill any conflicting processes or change the port mappings in the docker run command.
Claude Can’t Connect to Memgraph
Verify the MCP server configuration:
cat ~/Library/Application\ Support/Claude/claude_desktop_config.jsonEnsure Memgraph is running:
docker ps | grep memgraphRestart Claude Desktop completely after configuration changes.
mgconsole Command Not Found
Install it manually:
brew install memgraph/tap/mgconsoleNo Data Returned from Queries
Check if data was loaded successfully:
mgconsole --host 127.0.0.1 --port 7687 -e "MATCH (n) RETURN count(n);"If the count is 0, rerun the setup script.
10. Next Steps
Now that you have a working setup, you can:
- Add more complex transaction patterns
- Implement real-time fraud detection rules
- Create additional graph algorithms for anomaly detection
- Connect to real banking data sources (with proper security)
- Build automated alerting for suspicious patterns
- Expand the schema to include IP addresses, devices, and locations
The combination of Memgraph’s graph database capabilities and Claude’s natural language interface makes it easy to explore and analyze complex relationship data without writing complex Cypher queries manually.
11. Conclusion
You now have a complete environment for analyzing banking mule accounts using Memgraph and Claude Desktop. The graph database structure naturally represents the relationships between accounts, making it ideal for fraud detection. Claude’s integration through MCP allows you to query and visualize this data using natural language, making sophisticated analysis accessible without deep technical knowledge.
The test dataset demonstrates typical mule account patterns: rapid movement of funds through multiple accounts, young account holders, recently opened accounts, and structured amounts designed to avoid reporting thresholds. These patterns are much easier to spot in a graph database than in traditional relational databases.
Experiment with different queries and explore how graph thinking can reveal hidden patterns in connected data.