Glossary

What Is Cypher?

Cypher is a declarative query language for graph databases. Originally developed at Neo4j and now standardized as openCypher (and ISO/IEC GQL), Cypher uses ASCII-art-like patterns — (a)-[:KNOWS]->(b) — to describe nodes, edges, and traversals. It reads like a sentence and maps directly to how analysts already think about graph problems.

A Cypher Query at a Glance

MATCH (h:HOSTNAME {name: "example.com"})-[:RESOLVES_TO]->(ip:IPV4)
        <-[:RESOLVES_TO]-(other:HOSTNAME)
WHERE other.name <> h.name
RETURN other.name, ip.name
ORDER BY other.firstSeen DESC
LIMIT 50

Read literally: find all hostnames that resolve to the same IP as example.com, exclude the original hostname, and return the 50 most recently observed.

Why Cypher Beats SQL on Graph Problems

The same query in SQL would require a self-join on the resolutions table for every hop, with explicit join conditions and growing intermediate result sets. Cypher's pattern syntax compiles directly to graph traversal — no join planning, no cost surprises as the depth grows.

Cypher and the AI Era

Every major LLM has been trained on enough Cypher to generate it fluently. Ask Claude or GPT-4 "give me Cypher to find domains that share a registrant with this domain" and the answer is correct on the first try most of the time. That is a structural advantage — proprietary query languages require fine-tuning or custom prompting just to be usable through an AI agent.

Standardization Status

  • Cypher — original Neo4j dialect.
  • openCypher — open-source spec maintained by the openCypher project.
  • GQL (ISO/IEC 39075:2024) — the first ISO graph query language standard, derived heavily from Cypher.

Cypher in Whisper

Whisper implemented a full Cypher engine from scratch, tuned for the scale and shape of internet-infrastructure data. Analysts query directly via REST, SDKs, the Console, or — through MCP — through any AI assistant. Read more on the technology page.

Related Terms