DEV Community

Kishan vyas
Kishan vyas

Posted on

Building an Agentic Fraud Investigation Engine with TigerGraph & LangGraph: Our Hacker House Goa Journey

#agents #database #llm #rag

Tagging: @TigerGraphDB and @247pmstudio

Executive Summary

Financial fraud detection is undergoing a generational shift. Traditional rule engines and isolated ML models frequently struggle with multi-entity ring fraud, synthetic identities, and complex laundering topographies. Worse, generic AI agents often hallucinate facts, fail regulatory policy rules, or loop indefinitely without clear stopping criteria.

For the TigerGraph × Hacker House Goa (HHGOA) Hackathon, our team built a TigerGraph-first, agentic fraud investigation platform. By combining TigerGraph’s ultra-fast graph database capabilities, custom GSQL graph algorithms, TigerGraph MCP tool integration, GraphRAG historical case memory, and a deterministic LangGraph workflow engine, we engineered a system that investigates transaction alerts with bank-grade precision, zero hallucinated facts, and complete regulatory auditability.

In this technical deep dive, we share what we built, our architectural design, how we leveraged TigerGraph as the core engine, and our key technical learnings.

The Challenge & Objective

Investigating financial fraud requires answering four critical questions:

  1. What kind of fraud is occurring? (e.g., ATO, stolen card, synthetic identity, money ring).
  2. How far does the network reach? (Connected cards, shared hardware devices, common IP addresses).
  3. What is the current financial exposure?
  4. What is the next-best action under bank policy? (Block account, request step-up auth, trigger L1/L2 managerial approval, or file a Suspicious Activity Report / SAR).

Our target was to process 20 complex benchmark cases from 6 months of card transactions (IEEE-CIS Vesta dataset) plus historical closed cases, delivering fully reasoned case files, regulatory SAR filings, and auditable pre- and post-evidence recommendations.

System Architecture

Our solution strictly enforces responsibility boundaries: TigerGraph provides deterministic ground truth, LangGraph orchestrates workflow state, the LLM synthesizes evidence, and code-level policy rules authorize actions.

                         ┌────────────────────────────────────────┐
                         │              Trigger Alert             │
                         └──────────────────┬─────────────────────┘
                                            │
                                            ▼
                         ┌────────────────────────────────────────┐
                         │   LangGraph State Graph Engine         │
                         └──────────────────┬─────────────────────┘
                                            │
         ┌──────────────────────────────────┼──────────────────────────────────┐
         │                                  │                                  │
         ▼                                  ▼                                  ▼
┌─────────────────────────┐    ┌─────────────────────────┐    ┌─────────────────────────┐
│   TigerGraph Database   │    │  TigerGraph GraphRAG    │    │      Policy Engine      │
│  - GSQL Traversals      │    │  - Case Precedents      │    │  - Deterministic Rules  │
│  - Graph Features       │    │  - Regulatory Typologies│    │  - Approval Routing     │
│  - Network Clusters     │    │  - Hybrid Vector Search │    │  - Action Gates         │
└────────────┬────────────┘    └────────────┬────────────┘    └────────────┬────────────┘
             │                              │                              │
             └──────────────────────────────┼──────────────────────────────┘
                                            │
                                            ▼
                         ┌────────────────────────────────────────┐
                         │     Groq LLM Reasoning Engine          │
                         │   (Structured Evidence Grounding)      │
                         └──────────────────┬─────────────────────┘
                                            │
                                            ▼
                         ┌────────────────────────────────────────┐
                         │  Analyst Dashboard & Visual Graph UI   │
                         │  (Next.js 14 + Cytoscape + SSE Stream) │
                         └────────────────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

Key Stack Components:

  • Graph Database: TigerGraph (Savanna / Community Edition) + custom GSQL query library.
  • Agent Integration: TigerGraph MCP Adapter (exposing graph queries directly as typed agent tools).
  • Agent Orchestration: LangGraph (state machine with evidence collection loops, sufficiency gates, and human approval interrupts).
  • LLM Reasoning: Groq SDK (openai/gpt-oss-120b primary & 20b fast model) with Gemini Flash fallback.
  • GraphRAG & Precedent Memory: SentenceTransformers + Polars/DuckDB for hybrid graph-vector case precedent retrieval.
  • Frontend & Observability: Next.js 14, TypeScript, Cytoscape.js interactive graph visualization, Server-Sent Events (SSE), and full JSONL trace logging.

How We Used TigerGraph: The Neural Network of Our Agent

TigerGraph served as the single source of truth for entity topology and fraud network calculations. Rather than asking the LLM to process thousands of raw transaction logs, we offloaded graph pattern extraction to GSQL queries running directly in TigerGraph:

1. Deterministic Graph Feature Computation

We developed a suite of compiled GSQL queries to compute exact topological signals:

  • Shared Device & IP Mining: Identifying all customer accounts overlapping on suspicious hardware (id_30/id_31/DeviceInfo) or ASN/IP subnets.
  • Shortest Path to Confirmed Fraud: Calculating the exact graph hop distance from an alerted transaction to historically confirmed fraud vertices.
  • Money Flow & Cycle Detection: Traversing directed payment edges to calculate fan-in/fan-out ratios and flag circular money loops.
  • Bounded Neighborhood Traversal: Extracting 1-hop to 3-hop subgraphs for visual render in Cytoscape.js.

2. TigerGraph MCP (Model Context Protocol) Integration

We wrapped our graph query library into an MCP Tool Adapter. This allowed our LangGraph agents to request targeted graph context on-demand using structured tool calls (e.g., get_transaction_behavior, find_shared_devices, get_shortest_path_to_fraud).

3. GraphRAG & Persistent Case Memory

When an investigation concludes, the complete case state—including evidence, hypotheses, decisions, and outcomes—is appended back into TigerGraph. Future investigations query this Graph Case Memory to retrieve topically and structurally similar past cases, allowing the agent to cite historical analyst precedents!

Key Technical Learnings & Innovations

Building this system taught us critical lessons about productionizing agentic graph AI:

  1. Graph + LLM Division of Labor: LLMs should reason, but graphs must calculate. Letting GSQL handle pathfinding and counting reduced prompt token costs by 85% and eliminated graph hallucination.
  2. Triad Risk Assessment: Never rely on a single risk score. We separated our evaluation into Risk Level, Confidence, and Evidence Completeness. If risk is High but completeness is Low, the agent automatically loops to request step-up authentication or customer confirmation before making a recommendation.
  3. Auditable Recommendation Evolution: The agent records both a pre_evidence_next_best_action and a post_evidence_next_best_action, making it transparently clear why new evidence changed the decision.
  4. Deterministic Policy Gates: Even the smartest LLM cannot execute financial actions directly. Our code-level policy engine validates all LLM recommendations against hard bank rules before any action or simulated API call executes.

Results & Impact

  • 20/20 Benchmark Cases Executed: Successfully ran all 20 test cases through a single unified investigation workflow.
  • 100% Traceability: Every assertion made by the reasoning model is linked to canonical evidence IDs (TIGERGRAPH_GSQL, POLICY_GRAPHRAG, CASE_MEMORY).
  • Real-Time Visualization: Analysts receive live SSE updates as evidence is gathered and view interactive graph topology maps directly in the Next.js UI.
  • Automated Regulatory Compliance: Generated complete, policy-compliant SAR reports whenever regulatory dollar thresholds and pattern criteria were met.

Special Thanks

A huge thank you to @TigerGraphDB and @247pmstudio for organizing an incredible hacker house event, providing world-class graph infrastructure, and pushing the boundaries of what is possible with Graph AI!

#TigerGraph #GraphRAG #LangGraph #FraudDetection #GraphAI #AI #HHGOA #HackerHouseGoa #MachineLearning #GenerativeAI

Top comments (0)