Following the Money with a Graph: Building LedgerLens on FalkorDB

shruti sharma — Sat, 17 Oct 2026 19:30:04 +0000

Synthetic data. Risk signals, not accusations.

Imagine you've just become president of your housing society and you ask one simple question: where did our reserve fund go?
In a spreadsheet, the answer is a wall of rows. But the real story isn't in any single row. It's in the relationships between them: a relative who never pays, a repair vendor who is paid every year for jobs that keep reopening, a transfer that passes through two companies before landing at an outside trust. That's the kind of problem a graph is made for, so I built LedgerLens, an agent that investigates a society's finances by following those hidden links in FalkorDB.

The story I built it around

I wrote a fully synthetic dataset (no real people, no real money) with a planted story:

Relatives of the old president have 15 to 24 months of unpaid or waived dues, while everyone else pays an extra levy.
A vendor, SH-Group, keeps getting paid, yet the same complaints reopen: 9 water leaks, 8 lift breakdowns, 6 corridor lighting issues.
Eight transfers, 400,000,000 in total, were recorded only in a secret ledger and moved from the reserve fund to SH-Group, then to a shell company, then to an outside trust.
Two sets of people and companies quietly share addresses.
One contract was approved at a meeting with no quorum, and one waiver had no meeting at all.

I also planted decoys the agent must not flag: a properly approved medical waiver, a relative who pays on time, an ordinary defaulter with no links, and an honest vendor. A tool that flags everyone is useless, so the decoys were my accuracy test.

How FalkorDB does the real work

The graph has about 1,200 nodes and 1,350 relationships: people, flats, bills, vendors, transfers, meetings, decisions and more. Every risk signal is a Cypher query, not Python logic:

Multi-hop traversal from the old president through RELATIVE_OF|FRIEND_OF to flat owners, combined with bill counts.
shortestPath from the Reserve Fund to the Trust through SENT and RECEIVED_BY transfers.
Pattern matching for transfers recorded in the secret ledger with no approving decision.
Aggregation over REOPENS chains to find repeated complaints per vendor.
Shared-address matching between people and companies.
OPTIONAL MATCH to find decisions with no meeting or no quorum.

An LLM (Groq) then writes the summary, but it only sees the rows the queries return. The app shows every Cypher query and its result under a "How it got there" section, so a human can verify each claim. If you removed FalkorDB, there would be nothing left to say.

What went wrong (and what I learned)

1. My first query flagged a decoy. The "hidden beneficiaries" query listed the president's cousin, who pays on time, with 36 "unpaid" bills. I had filtered on the bill status field, which didn't match my data. Switching to the paid amount fixed it. Lesson: the decoys caught a bug that a happy-path test would never have found.

2. shortestPath has a rule. I wrote MATCH p = shortestPath(...), as in many Cypher examples, and FalkorDB told me it only supports shortestPath inside WITH or RETURN. Moving it to WITH shortestPath(...) AS p fixed it. A one-line note in the docs would help beginners.

3. Don't let the model decide what to look at. My first agent let the LLM choose which tools to call, and the model I used often stopped after one query. I changed the design so all the queries run every time and the model only summarises. Less "agentic" flexibility, much more reliable evidence.

4. Wording matters. I told the model to report "risk signals worth review" and never accuse anyone. Without that instruction it started using words like "kick-backs". For a tool about real-world trust, the tone is part of the product.

Takeaways

Graphs shine when the question is about connections, not rows.
Seeding decoys is the cheapest way to test whether an investigation tool is honest.
Showing the query next to the answer builds more trust than a confident summary.
FalkorDB was easy to start with: one Docker command and I was running Cypher in the browser.

I built this over about two days for the Graph Hacks hackathon, with Claude helping write much of the code. I made the design decisions, ran everything and checked the results against my own answer key.

Code: https://github.com/shrutisharma-sh/LedgerLense
Demo video: https://youtu.be/2GG1GAXGLPY?si=coA5-D-hdiBU9Jnv

Built for Graph Hacks: Context for AI Agents (FalkorDB), Track 01.

DEV Community: shruti sharma

Following the Money with a Graph: Building LedgerLens on FalkorDB

The story I built it around

How FalkorDB does the real work

What went wrong (and what I learned)

Takeaways