We Compared MCPs and Graph Queries on the Same Tasks
During an incident or deployment review, agents must connect records across tools without confusing production with test copies. We gave both agents the same ten questions: one used native MCPs, the other Anyshift graph tools with prepared queries.
The environment included AWS, Kubernetes, Datadog, GitHub and PagerDuty. Each task used two to four systems.
Our first benchmark compared the graph with Kubernetes and AWS MCPs. On average, the graph used 86.1% fewer tokens for PR review (13,888 vs. 99,634) and 81.3% fewer for node-impact analysis (21,824 vs. 116,451). Both setups met the answer requirements in all three runs per task and setup.
A separate test added Datadog: the graph used 88.0% fewer tokens (25,033 vs. 209,188), but MCPs checked extra evidence.
The Agents Retrieved Data in Two Ways
An agent tracing an alert must connect it to an application and its host. We tested two retrieval methods:
1. Native MCPs: the agent queried each source and joined the responses. We suggested an investigation route; the agent chose its calls. MCP provides the interface for those calls.
2. Anyshift graph: the agent inspected the graph’s data structure and ran Cypher query. Cypher is the graph’s query language. The agent used the returned records to answer.
We Measured Tokens, Time and Tool Calls
We measured tokens, time and tool calls from tool startup to final answer. Tokens count the text a model reads and generates. We checked each answer against source data.
The averages cover ten pairs. A Datadog connection failure required one paired retry, bringing the total to 22 sessions. We kept that retry and the other nine original pairs, including incomplete answers.
| Mean per task | Prepared graph queries | Native MCPs | Reduction |
|---|---|---|---|
| Cumulative model tokens | 60,294 | 356,296 | 83.1% |
| Completion time | 74.3 s | 139.4 s | 46.7% |
| Tool calls | 2.0 | 23.7 | 91.6% |
Test 1: Find a Queue’s Applications and Hosting Machines
In this example, we tested whether each agent could find the applications using a message queue and the machines hosting them.
Why it is important: A message backlog can delay orders or background jobs. Identifying the senders, receivers and their machines helps engineers decide where to investigate the delay.
Both agents traced a RabbitMQ queue, which holds messages between applications, through Kubernetes to its AWS hosting machines.
Both agents found the same two senders, one receiver and hosting machines. Source checks confirmed these roles for the requested period.
| Queue investigation, one run per setup | Prepared graph query | Native MCPs | Reduction |
|---|---|---|---|
| Model tokens | 57,292 | 284,762 | 79.9% |
| Completion time | 61.7 s | 147.7 s | 58.2% |
| Tool calls | 2 | 16 | 87.5% |
The graph agent used two calls, versus 16 native calls, for matching evidence.
Test 2: Match Each App Copy to Its Incident Service
In this example, we tested whether each agent could distinguish applications with the same name across environments and find their incident-service connections.
Why it is important: Production and test applications can share the same name. Matching each copy to the correct incident service helps responders investigate the right environment.
Both agents separated three checkout-api copies by Kubernetes location and identifier, then found their records in PagerDuty, which manages incidents.
Both agents separated the three applications, found two PagerDuty records and left the third connection unknown.
| Environment identity, one run per setup | Prepared graph query | Native MCPs | Reduction |
|---|---|---|---|
| Model tokens | 56,101 | 381,556 | 85.3% |
| Completion time | 53.4 s | 156.3 s | 65.8% |
| Tool calls | 2 | 33 | 93.9% |
Both Agents Used the Same Model and Time Limit
We held the settings constant, started fresh sessions and verified answers against source systems.
| Control | Method |
|---|---|
| Environment | One synthetic development environment with five integrations |
| Model | GPT-5.5, low reasoning; fresh sessions; 240-second limit |
| Task | Same question within each pair; read-only access |
| Native setup | Five MCPs and a suggested route; the agent chose its calls |
| Graph setup | Data-structure inspection and one prepared Cypher query through Anyshift MCP |
| Evidence checks | Source snapshots, unique resource identifiers and monitoring queries; manual review |
| Timing | Retrieval and answer generation, including tool startup and the graph connection relay |
| Repetitions | One selected pair per task; one technical retry of both setups |
Most monitoring checks used the same two-hour period; historical questions used a separate fixed period. The checked resource layout stayed stable while Anyshift continued collecting data.
Token Counts Do Not Directly Measure Cost
Teams budgeting agent tasks must account for cheaper cached input. Our counts include that input, so 83% fewer tokens does not imply 83% less spend. We did not calculate dollar savings or include graph collection, storage and maintenance costs.
We Compared Time and Tokens Across All Ten Tasks
Each pair answered the same question. Choose Tokens or Time to compare the two methods. Open Why it matters to see the decision each task supports.
Engineers identify apps at risk before a machine restart.
Responders locate the machines behind an alert.
Engineers identify apps that a database outage could affect.
Responders find the infrastructure they need to inspect.
Engineers find shared dependencies to investigate together.
Responders locate senders and receivers during a message backlog.
Engineers identify callers that a service change could affect.
Engineers check declared versions during a release review.
Responders inspect routing changes around an incident.
Responders select the right incident service for each app copy.
