Skip to main content
protocols.pageprotocols.page
7687

Port 7687 – Neo4j Bolt

TCP

Port 7687 is the Neo4j Bolt protocol port – a binary protocol optimized for Cypher query execution. Bolt on port 7687 supports TLS encryption and is the recommended connection method for application drivers. Unlike the HTTP API on port 7474, Bolt provides connection pooling, transaction management, and streaming results.

Port Number

7687

Protocol

TCP

Service

Neo4j Bolt Protocol

Range

IANA Registered (1024–49151)

Description

Neo4j Bolt protocol on port 7687 provides high-performance binary communication between applications and the Neo4j database. All official Neo4j drivers (Java, Python, JavaScript, .NET, Go) connect via Bolt. The protocol supports multiplexing, explicit transactions, result streaming, and built-in TLS encryption (bolt+s:// or neo4j+s://). Bolt on port 7687 should be the only externally accessible Neo4j port for applications. Configure TLS with a valid certificate (dbms.ssl.policy.bolt.*) and require encrypted connections in production. Port 7474 (HTTP/Browser) should be restricted to localhost or admin networks. Use neo4j+s://host:7687 connection URIs to enforce TLS verification in application drivers.

Security risks

  • 1Same authentication weaknesses as port 7474: if auth is disabled (dbms.security.auth_enabled=false), Bolt connections on 7687 have full database access without credentials. All CVEs affecting Neo4j auth (CVE-2021-34371 RMI RCE) apply when 7687 is reachable
  • 2Credential brute-force: Bolt connections authenticate with username/password. Without rate limiting (not built into Neo4j by default), attackers can brute-force credentials. Implement connection limits via network firewall or proxy
  • 3Unencrypted Bolt (bolt://): plain Bolt transmits Cypher queries and results (including sensitive graph data) in cleartext. Always use bolt+s:// (TLS verified) or bolt+ssc:// (TLS self-signed) in production
  • 4Driver connection string leakage: application configs, environment variables, and log files often contain bolt://user:pass@host:7687 URIs with plaintext credentials

Firewall guidance

Port 7687 is the appropriate port for application access – but restrict to application server IPs only. Enable TLS: dbms.connector.bolt.tls_level=REQUIRED, dbms.ssl.policy.bolt.enabled=true with proper certificates. Never expose to the public internet. For development, bind to localhost: dbms.connector.bolt.listen_address=127.0.0.1:7687.

Diagnosis commands

Test Bolt connectivity and authentication

shell
cypher-shell -a bolt://localhost:7687 -u neo4j -p pass 'RETURN 1'

Check if TLS is active on Bolt port

shell
openssl s_client -connect host:7687 </dev/null 2>&1 | grep 'Verify'

Verify Bolt bind address and owning process

shell
ss -tlnp | grep 7687

List active Bolt connections (detect unauthorized clients)

shell
cypher-shell -a bolt://localhost:7687 -u neo4j -p pass 'CALL dbms.listConnections()'

Usage examples

Port 7687 – Neo4j Bolt
shell
cypher-shell -a neo4j+s://host:7687 -u neo4j -p pass
neo4j.driver('neo4j+s://host:7687', auth=('neo4j','pass'))
CALL dbms.listConnections()

Common services on this port

Neo4j (all editions)Neo4j Aura (managed)Memgraph (Bolt-compatible)Official Neo4j Drivers (Java, Python, JS, .NET, Go)

Related ports

7474

Neo4j HTTP API / Browser

7473

Neo4j HTTPS

7688

Neo4j Bolt (secondary/routing)

History

Bolt was introduced in Neo4j 3.0 (2016) as a purpose-built binary protocol replacing the REST HTTP API for application access. Named after the lightning bolt in Neo4j's logo. Port 7687 was registered with IANA for Bolt. The protocol supports chunked message transfer, compact serialization (PackStream), and pipelining multiple requests. Neo4j 4.x added routing capability to Bolt for cluster-aware drivers.

FAQ

What is the difference between bolt://, bolt+s://, and neo4j://?

bolt:// – unencrypted direct connection. bolt+s:// – TLS with certificate verification (production). bolt+ssc:// – TLS with self-signed cert (dev). neo4j:// – routing-aware driver discovers cluster topology and distributes queries across replicas. neo4j+s:// – routing with TLS. Always use neo4j+s:// for production clusters.