BankWeave

Health and size of the whole system: FalkorDB memory/version, graphs (banks, cases), consortium size (accounts, banks, transfers) and the alert queue by status (open / case / cleared). Call this first to orient yourself. FalkorDB features: INFO memory, GRAPH.LIST, GRAPH.RO_QUERY aggregations.

{
  "type": "object",
  "properties": {},
  "title": "engine_overviewArguments"
}

List every FalkorDB graph BankWeave keeps, grouped by kind: the consortium (cross-bank, hashed), one graph per bank (that bank's partial view), one graph per case, the typology knowledge base. Use graph_schema(graph) for labels, relationship types and indexes.

{
  "type": "object",
  "properties": {},
  "title": "list_graphsArguments"
}

Schema of one graph: node labels, relationship types, property keys and indexes with their kind (RANGE, FULLTEXT, VECTOR). graph: 'consortium', 'bank_<id>', 'case_<id>' or 'typology_kb'. FalkorDB features: db.labels, db.relationshipTypes, db.propertyKeys, db.indexes.

{
  "type": "object",
  "properties": {
    "graph": {
      "default": "consortium",
      "title": "Graph",
      "type": "string"
    }
  },
  "title": "graph_schemaArguments"
}

List investigation cases (newest first) with status, title, seed account, number of alerts/accounts, the banks involved and whether its case graph is loaded. Use a case id with get_case. FalkorDB features: GRAPH.RO_QUERY over the consortium graph.

{
  "type": "object",
  "properties": {
    "limit": {
      "default": 30,
      "title": "Limit",
      "type": "integer"
    }
  },
  "title": "list_casesArguments"
}

Everything about one case from its own case graph: header, claims (each with naive vs echo-proof confidence, paths vs independent_sources, state, supporting/challenging evidence ids), evidence (kind, origin, state active/needs_verification/superseded, summary), proposed and approved actions with the claims that justify them, and SAR status. case_id like 'C-44c08392'. FalkorDB features: one graph per case, GRAPH.RO_QUERY.

{
  "type": "object",
  "properties": {
    "case_id": {
      "title": "Case Id",
      "type": "string"
    },
    "max_evidence": {
      "default": 40,
      "title": "Max Evidence",
      "type": "integer"
    }
  },
  "required": [
    "case_id"
  ],
  "title": "get_caseArguments"
}

Why a claim has the confidence it has (GraphEcho echo-proof scoring). Groups supporting and challenging evidence by ORIGIN: many paths that lead back to the same origin count once. Returns paths vs independent origins, naive (path-counting) vs echo-proof confidence, each origin group with its multiplicity and weight, which origin kinds were never explored, and the derived-claim / evidence chain with the Cypher each evidence item ran. Pure read: the score is recomputed in memory, nothing is written. FalkorDB features: GRAPH.RO_QUERY, variable-length DERIVED_FROM traversal.

{
  "type": "object",
  "properties": {
    "case_id": {
      "title": "Case Id",
      "type": "string"
    },
    "claim_id": {
      "title": "Claim Id",
      "type": "string"
    }
  },
  "required": [
    "case_id",
    "claim_id"
  ],
  "title": "explain_claimArguments"
}

An account's cross-bank neighbourhood in the consortium graph: its scores (pagerank, motif score, community, WCC component size, pass-through pairs), shared identity (device, IP, address with how widely each is shared), cases and alerts on it, counterparties held at OTHER banks (count and volume) and its bounded 1-2 hop neighbourhood with the banks it spans. A bank alone only sees its own side of these links. FalkorDB features: GRAPH.RO_QUERY, bounded undirected expansion.

{
  "type": "object",
  "properties": {
    "account_id": {
      "title": "Account Id",
      "type": "string"
    },
    "depth": {
      "default": 2,
      "title": "Depth",
      "type": "integer"
    }
  },
  "required": [
    "account_id"
  ],
  "title": "account_networkArguments"
}

Shortest money paths from one account to another, hop by hop with transaction ids, amounts and the bank of every account on the path, so you can see the money cross banks. Without case_id it searches the consortium along outgoing transfers; with case_id it searches that case graph in both directions. No path = no claim. FalkorDB features: algo.SPpaths.

{
  "type": "object",
  "properties": {
    "src": {
      "title": "Src",
      "type": "string"
    },
    "dst": {
      "title": "Dst",
      "type": "string"
    },
    "max_len": {
      "default": 6,
      "title": "Max Len",
      "type": "integer"
    },
    "path_count": {
      "default": 3,
      "title": "Path Count",
      "type": "integer"
    },
    "case_id": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Case Id"
    }
  },
  "required": [
    "src",
    "dst"
  ],
  "title": "trace_money_pathArguments"
}

Candidate laundering rings: communities of accounts that trade mostly among themselves, found by label propagation on the transfer graph. Cross-bank rings (members at more than one bank) come first, since no single bank can see them whole. Pass account_id to return only the ring that contains that account. FalkorDB features: algo.labelPropagation.

{
  "type": "object",
  "properties": {
    "account_id": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Account Id"
    },
    "min_size": {
      "default": 3,
      "title": "Min Size",
      "type": "integer"
    },
    "max_size": {
      "default": 60,
      "title": "Max Size",
      "type": "integer"
    },
    "limit": {
      "default": 10,
      "title": "Limit",
      "type": "integer"
    },
    "graph": {
      "default": "consortium",
      "title": "Graph",
      "type": "string"
    }
  },
  "title": "find_ringsArguments"
}

Accounts where money pools: PageRank over TRANSFERS, highest first, with bank ids. graph: 'consortium', 'bank_<id>' or 'case_<id>'. FalkorDB features: algo.pageRank.

{
  "type": "object",
  "properties": {
    "top_k": {
      "default": 10,
      "title": "Top K",
      "type": "integer"
    },
    "graph": {
      "default": "consortium",
      "title": "Graph",
      "type": "string"
    }
  },
  "title": "top_hubsArguments"
}

Weakly connected components of the transfer graph (largest first): size, number of banks, a sample of members, plus how many components are tiny 'islands' that triage clears instantly. graph: 'consortium', 'bank_<id>' or 'case_<id>'. FalkorDB features: algo.wcc.

{
  "type": "object",
  "properties": {
    "limit": {
      "default": 10,
      "title": "Limit",
      "type": "integer"
    },
    "graph": {
      "default": "consortium",
      "title": "Graph",
      "type": "string"
    }
  },
  "title": "connected_componentsArguments"
}

Accounts whose behaviour (activity, amounts, timing, degree profile) is closest to this one, by cosine distance over Account.behavior_vec (lower = more alike), with their banks. Useful to find mule accounts that act like a known one at other banks. FalkorDB features: HNSW vector index, db.idx.vector.queryNodes.

{
  "type": "object",
  "properties": {
    "account_id": {
      "title": "Account Id",
      "type": "string"
    },
    "k": {
      "default": 5,
      "title": "K",
      "type": "integer"
    }
  },
  "required": [
    "account_id"
  ],
  "title": "similar_accountsArguments"
}

Fuzzy name search over customers (Person) or businesses (Company) across all banks, with the accounts and banks each one owns. Tokens are OR-ed, so partial names work. FalkorDB features: full-text index, db.idx.fulltext.queryNodes.

{
  "type": "object",
  "properties": {
    "name": {
      "title": "Name",
      "type": "string"
    },
    "label": {
      "default": "Person",
      "title": "Label",
      "type": "string"
    },
    "k": {
      "default": 10,
      "title": "K",
      "type": "integer"
    }
  },
  "required": [
    "name"
  ],
  "title": "search_customersArguments"
}

The alert queue with counts by status. status: 'open', 'case' (escalated into a case) or 'cleared'; omit for all. Each alert has its rule, reason, account, bank, case id and the recorded clearing reason. Use an alert id with triage_alert. FalkorDB features: range indexes on Alert.status, GRAPH.RO_QUERY.

{
  "type": "object",
  "properties": {
    "status": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Status"
    },
    "limit": {
      "default": 20,
      "title": "Limit",
      "type": "integer"
    }
  },
  "title": "list_alertsArguments"
}

Why an alert was cleared or escalated into a case. Returns the alert, the triage decision and its reason, the graph signals the triage agent recorded (component size, motif score, cross-bank counterparties, typologies, shared identity, prior cases), and a LIVE re-check: the account's weakly connected component size (islands smaller than the configured threshold clear instantly) and its motif score components. FalkorDB features: algo.wcc, GRAPH.RO_QUERY.

{
  "type": "object",
  "properties": {
    "alert_id": {
      "title": "Alert Id",
      "type": "string"
    }
  },
  "required": [
    "alert_id"
  ],
  "title": "triage_alertArguments"
}

Laundering typology guidance (e.g. 'fan-out then fan-in through mules', 'structuring below reporting threshold') from BankWeave's typology knowledge graph, with citations. Abstains when nothing matches well. FalkorDB features: full-text index on the typology_kb graph.

{
  "type": "object",
  "properties": {
    "question": {
      "title": "Question",
      "type": "string"
    }
  },
  "required": [
    "question"
  ],
  "title": "typology_guidanceArguments"
}

Last resort: run your own read-only Cypher on one graph. Runs as GRAPH.RO_QUERY (the engine rejects writes) after a guard: one statement, no CREATE/MERGE/SET/DELETE/REMOVE/ DROP/FOREACH/LOAD CSV, CALL only for algo.* and the db.* read/index-query procedures, LIMIT appended when missing, at most 200 rows, 10 s timeout. graph: 'consortium', 'bank_<id>', 'case_<id>' or 'typology_kb' (see graph_schema for labels and properties).

{
  "type": "object",
  "properties": {
    "cypher": {
      "title": "Cypher",
      "type": "string"
    },
    "graph": {
      "default": "consortium",
      "title": "Graph",
      "type": "string"
    },
    "limit": {
      "default": 50,
      "title": "Limit",
      "type": "integer"
    }
  },
  "required": [
    "cypher"
  ],
  "title": "run_readonly_cypherArguments"
}