We Compared MCPs and Graph Queries on the Same Tasks

During an incident or deployment review, agents must connect records across tools without confusing production with test copies. We gave both agents the same ten questions: one used native MCPs, the other Anyshift graph tools with prepared queries.

The environment included AWS, Kubernetes, Datadog, GitHub and PagerDuty. Each task used two to four systems.

Native MCPs versus Anyshift: source records joined by the agent versus a prepared query over stored relationshipsNative MCPs join source records during the investigation; a prepared graph query reads stored relationships
Five integrations available; each task uses two to four. Prepared graph queries, one selected pair per task. Answer quality and available evidence differed in some cases.

Our first benchmark compared the graph with Kubernetes and AWS MCPs. On average, the graph used 86.1% fewer tokens for PR review (13,888 vs. 99,634) and 81.3% fewer for node-impact analysis (21,824 vs. 116,451). Both setups met the answer requirements in all three runs per task and setup.

A separate test added Datadog: the graph used 88.0% fewer tokens (25,033 vs. 209,188), but MCPs checked extra evidence.

The Agents Retrieved Data in Two Ways

An agent tracing an alert must connect it to an application and its host. We tested two retrieval methods:

1. Native MCPs: the agent queried each source and joined the responses. We suggested an investigation route; the agent chose its calls. MCP provides the interface for those calls.

2. Anyshift graph: the agent inspected the graph’s data structure and ran Cypher query. Cypher is the graph’s query language. The agent used the returned records to answer.

We Measured Tokens, Time and Tool Calls

We measured tokens, time and tool calls from tool startup to final answer. Tokens count the text a model reads and generates. We checked each answer against source data.

The averages cover ten pairs. A Datadog connection failure required one paired retry, bringing the total to 22 sessions. We kept that retry and the other nine original pairs, including incomplete answers.

Mean per taskPrepared graph queriesNative MCPsReduction
Cumulative model tokens60,294356,29683.1%
Completion time74.3 s139.4 s46.7%
Tool calls2.023.791.6%
Average model tokens: Anyshift graph 60,294; native MCPs 356,296
Descriptive means across ten selected pairs, including incomplete answers and startup issues. Tokens include repeated and cached input. These are not dollar savings.

Test 1: Find a Queue’s Applications and Hosting Machines

In this example, we tested whether each agent could find the applications using a message queue and the machines hosting them.

Why it is important: A message backlog can delay orders or background jobs. Identifying the senders, receivers and their machines helps engineers decide where to investigate the delay.

Both agents traced a RabbitMQ queue, which holds messages between applications, through Kubernetes to its AWS hosting machines.

Which apps use this queue, and where do they run?
Native MCPs
Separate source records
Queue activity
Apps & pods
Machines
Agent finds and joins the records
16 calls · 147.7 s284,762 tokens
Graph
Relationships stored before the task
2 sendersQueue1 receiver
PodsNodeEC2
Agent runs a prepared query
2 calls · 61.7 s57,292 tokens
Both found: 2 senders, 1 receiver and their hosting machines.
One paired run. Graph calls: schema inspection + supplied query.

Both agents found the same two senders, one receiver and hosting machines. Source checks confirmed these roles for the requested period.

Queue investigation, one run per setupPrepared graph queryNative MCPsReduction
Model tokens57,292284,76279.9%
Completion time61.7 s147.7 s58.2%
Tool calls21687.5%

The graph agent used two calls, versus 16 native calls, for matching evidence.

Test 2: Match Each App Copy to Its Incident Service

In this example, we tested whether each agent could distinguish applications with the same name across environments and find their incident-service connections.

Why it is important: Production and test applications can share the same name. Matching each copy to the correct incident service helps responders investigate the right environment.

Both agents separated three checkout-api copies by Kubernetes location and identifier, then found their records in PagerDuty, which manages incidents.

Which incident service belongs to each app?
Native MCPs
Separate source records
3 app copies
Incident services
Agent finds and joins the records
33 calls · 156.3 s381,556 tokens
Graph
Relationships stored before the task
ProductionService A
Demo-prodService B
StagingUnknown
Agent runs a prepared query
2 calls · 53.4 s56,101 tokens
Both found: 3 distinct apps, 2 incident-service links, 1 unknown.
One paired run. The native agent also checked recent traffic; evidence checks differed.

Both agents separated the three applications, found two PagerDuty records and left the third connection unknown.

Environment identity, one run per setupPrepared graph queryNative MCPsReduction
Model tokens56,101381,55685.3%
Completion time53.4 s156.3 s65.8%
Tool calls23393.9%

Both Agents Used the Same Model and Time Limit

We held the settings constant, started fresh sessions and verified answers against source systems.

ControlMethod
EnvironmentOne synthetic development environment with five integrations
ModelGPT-5.5, low reasoning; fresh sessions; 240-second limit
TaskSame question within each pair; read-only access
Native setupFive MCPs and a suggested route; the agent chose its calls
Graph setupData-structure inspection and one prepared Cypher query through Anyshift MCP
Evidence checksSource snapshots, unique resource identifiers and monitoring queries; manual review
TimingRetrieval and answer generation, including tool startup and the graph connection relay
RepetitionsOne selected pair per task; one technical retry of both setups

Most monitoring checks used the same two-hour period; historical questions used a separate fixed period. The checked resource layout stayed stable while Anyshift continued collecting data.

Token Counts Do Not Directly Measure Cost

Teams budgeting agent tasks must account for cheaper cached input. Our counts include that input, so 83% fewer tokens does not imply 83% less spend. We did not calculate dollar savings or include graph collection, storage and maintenance costs.

We Compared Time and Tokens Across All Ten Tasks

Each pair answered the same question. Choose Tokens or Time to compare the two methods. Open Why it matters to see the decision each task supports.

Native MCPsAnyshift graph
Node impact
Native MCPs:
Cumulative model tokens: 492,248Completion time: 154.2 s
Anyshift graph:
Cumulative model tokens: 65,531Completion time: 125.4 s
Alert → infrastructure
Native MCPs:
Cumulative model tokens: 273,028Completion time: 105.5 s
Anyshift graph:
Cumulative model tokens: 55,780Completion time: 56.7 s
Database → apps
Native MCPs:
Cumulative model tokens: 419,165Completion time: 159.9 s
Anyshift graph:
Cumulative model tokens: 58,849Completion time: 68.6 s
Incident → infrastructure
Native MCPs:
Cumulative model tokens: 569,674Completion time: 145.9 s
Anyshift graph:
Cumulative model tokens: 57,935Completion time: 54.1 s
Apps → data services
Native MCPs:
Cumulative model tokens: 174,806Completion time: 134.1 s
Anyshift graph:
Cumulative model tokens: 64,480Completion time: 97.0 s
Queue → apps
Native MCPs:
Cumulative model tokens: 284,762Completion time: 147.7 s
Anyshift graph:
Cumulative model tokens: 57,292Completion time: 61.7 s
Service callers
Native MCPs:
Cumulative model tokens: 240,738Completion time: 142.7 s
Anyshift graph:
Cumulative model tokens: 56,351Completion time: 58.9 s
Deployed version
Native MCPs:
Cumulative model tokens: 348,775Completion time: 119.7 s
Anyshift graph:
Cumulative model tokens: 59,005Completion time: 67.0 s
Change history
Native MCPs:
Cumulative model tokens: 378,211Completion time: 128.1 s
Anyshift graph:
Cumulative model tokens: 71,613Completion time: 100.5 s
App environments
Native MCPs:
Cumulative model tokens: 381,556Completion time: 156.3 s
Anyshift graph:
Cumulative model tokens: 56,101Completion time: 53.4 s
Native MCPsAnyshift graph
Node impact
Native MCPs:
Cumulative model tokens: 492,248Completion time: 154.2 s
Anyshift graph:
Cumulative model tokens: 65,531Completion time: 125.4 s
Alert → infrastructure
Native MCPs:
Cumulative model tokens: 273,028Completion time: 105.5 s
Anyshift graph:
Cumulative model tokens: 55,780Completion time: 56.7 s
Database → apps
Native MCPs:
Cumulative model tokens: 419,165Completion time: 159.9 s
Anyshift graph:
Cumulative model tokens: 58,849Completion time: 68.6 s
Incident → infrastructure
Native MCPs:
Cumulative model tokens: 569,674Completion time: 145.9 s
Anyshift graph:
Cumulative model tokens: 57,935Completion time: 54.1 s
Apps → data services
Native MCPs:
Cumulative model tokens: 174,806Completion time: 134.1 s
Anyshift graph:
Cumulative model tokens: 64,480Completion time: 97.0 s
Queue → apps
Native MCPs:
Cumulative model tokens: 284,762Completion time: 147.7 s
Anyshift graph:
Cumulative model tokens: 57,292Completion time: 61.7 s
Service callers
Native MCPs:
Cumulative model tokens: 240,738Completion time: 142.7 s
Anyshift graph:
Cumulative model tokens: 56,351Completion time: 58.9 s
Deployed version
Native MCPs:
Cumulative model tokens: 348,775Completion time: 119.7 s
Anyshift graph:
Cumulative model tokens: 59,005Completion time: 67.0 s
Change history
Native MCPs:
Cumulative model tokens: 378,211Completion time: 128.1 s
Anyshift graph:
Cumulative model tokens: 71,613Completion time: 100.5 s
App environments
Native MCPs:
Cumulative model tokens: 381,556Completion time: 156.3 s
Anyshift graph:
Cumulative model tokens: 56,101Completion time: 53.4 s
Node impact

Engineers identify apps at risk before a machine restart.

Alert → infrastructure

Responders locate the machines behind an alert.

Database → apps

Engineers identify apps that a database outage could affect.

Incident → infrastructure

Responders find the infrastructure they need to inspect.

Apps → data services

Engineers find shared dependencies to investigate together.

Queue → apps

Responders locate senders and receivers during a message backlog.

Service callers

Engineers identify callers that a service change could affect.

Deployed version

Engineers check declared versions during a release review.

Change history

Responders inspect routing changes around an incident.

App environments

Responders select the right incident service for each app copy.

Times include tool startup and answer generation. Tokens include cumulative input and output, including cached input.