Fraud App — Development skill for Claude Code

Sentinel: agentic fraud investigation on TigerGraph

Sentinel takes an alert from the case pack and investigates it against a TigerGraph graph of 590,742 card transactions and 5,565 closed cases. It decides whether the alert is fraud, which pattern it is and how far it goes, then recommends next best actions under the bank's Fraud Policy, with approval routes.

**Deliverable:** [`cases/`](cases/) holds 20 answer files. Every one passes the validator (`python -m app.validate`), and each is backed by an `InvestigationCase` vertex in TigerGraph.

Architecture

flowchart LR
  A[case_pack row] --> B[intake]
  B --> C[MCP probes
tigergraph-mcp stdio
run_installed_query]
  C --> D[deterministic detectors]
  D --> E[log-odds scoring]
  E --> F[policy engine: initial NBA]
  F -->|stop rule §6| J
  F --> G[evidence request + simulated reply]
  G --> H[re-score + final NBA]
  H --> I[GraphRAG brief
vector + graph expansion]
  I --> K[Claude: summary + SAR narrative]
  K --> V[validator]
  V --> J[write InvestigationCase to TigerGraph]
  J --> L[cases/HHG-xxx.json]
  TG[(TigerGraph FraudGraph)] --- C
  TG --- J

How TigerGraph is used

• Schema: graph FraudGraph (`tigergraph/schema.gsql`).
  • Vertices: Customer, Card, Transaction, DeviceProfile, EmailDomain, BillingRegion, ClosedCase, InvestigationCase, FraudPattern, DocChunk.
  • Edges: OWNS, MADE, FROM_DEVICE, PURCHASER_EMAIL, RECIPIENT_EMAIL, BILLED_IN, NEXT, INVOLVES, ON_CARD, CONNECTED_TO, CC_PATTERN and IC_*, with reverse edges where a traversal needs them.
• Loading: one GSQL loading job (`tigergraph/loading_jobs.gsql`) loads everything in about 12 s with 0 errors. It creates 590,742 transactions, 14,317 cards, 13,553 customers, 9,706 device profiles and 5,565 closed cases.
• Installed GSQL queries (`tigergraph/queries/all.gsql`): txn_detail, card_history,