Building an Agentic Fraud Investigation System with TigerGraph, LangGraph & MCP
TL;DR : We built a 9-node LangGraph agent that investigates fraud cases end-to-end. It uses TigerGraph Community Edition as the knowledge graph substrate, TigerGraph MCP for tool access, and NVIDIA NIM for LLM reasoning. It produced FinCEN-standard SAR narratives for cases requiring regulatory filing, and wrote every case back to the graph as memory for future investigations. All 20 HHGOA…
The article describes the development of a fraud investigation system using TigerGraph, LangGraph and MCP technologies. The system is built around a 9-node LangGraph workflow, with TigerGraph serving as the knowledge graph substrate and memory layer. TigerGraph MCP exposes graph operations as tools, while NVIDIA NIM handles LLM reasoning within the workflow.
The system architecture consists of distinct layers - the graph layer for investigation context, the MCP layer for exposing graph operations as tools, and the LangGraph layer which coordinates the investigation workflow. The data layer starts with the HHGOA benchmark data, loading relevant entities and relationships into TigerGraph so investigations can traverse connections around suspicious transactions.
TigerGraph acts as the investigation substrate, containing 11 vertex types and 21 edge types to represent transactions, customers, devices, email domains, billing regions and other relevant entities and their relationships. This graph structure allows the investigation agent to move from a suspicious transaction to its associated customer, card, device, email domain, billing region, transactions and historical cases through explicit relationships.
Rather than blindly flagging suspicious transactions, the system provides an investigation layer that collects evidence, performs graph-based analysis, applies policy checks, executes actions and stores the resolved case back into the graph for future reference. This investigation layer takes a flagged case and carries it through evidence collection, reasoning, policy enforcement and permanent storage.
The system includes four deterministic fraud pattern detectors that analyze graph relationships and transaction history to build structured evidence for the agent to reason over. These include detecting shared devices, velocity bursts, amount anomalies and new devices with proxy information. The investigation is orchestrated as a 9-node LangGraph workflow that combines deterministic evidence collection with LLM-based investigation and action recommendation, while allowing the agent to request additional evidence if needed.
The investigation agent builds a curated Evidence Pack containing relevant transaction context, connected entities, detected patterns, similar prior cases, missing evidence and contradictions. This focused evidence pack is used by the LLM to reason about the case and recommend actions. Once an action is recommended, the system writes the case back to the graph, creating a permanent record of the investigation.
The entire process allows the system to investigate fraud cases end-to-end, leveraging the strengths of graph databases, tool-based access and LLM reasoning to move beyond simple transaction flagging and enable comprehensive investigation and regulatory reporting.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
