AgentHound: BloodHound for the Agentic Stack

By Prahlad Menon 4 min read

If you’ve ever done Active Directory security work, you know BloodHound. Point it at a domain, watch it map every trust relationship, credential chain, and privilege escalation path — then visualize exactly how an attacker could pivot from a compromised workstation to Domain Admin.

AgentHound brings that same methodology to AI agent infrastructure.

The Attack Surface Nobody’s Mapping

MCP servers. A2A protocols. LiteLLM gateways. Ollama instances. Qdrant vector stores. Jupyter notebooks. Configuration files scattered across ~/.cursor/mcp.json, CLAUDE.md, .cursorrules, and a dozen other locations.

Every AI-enabled development environment is now a sprawling attack surface that most security teams haven’t even inventoried, let alone tested. AgentHound exists to fix that.

What It Actually Does

AgentHound runs the full offensive lifecycle:

1. Reconnaissance

# Scan a network for AI service ports
agenthound scan 10.0.0.0/24

# Probe for MCP and A2A protocol endpoints
agenthound discover 10.0.0.0/24

2. Credential Looting

# Inventory LiteLLM credential references
agenthound loot 10.0.0.20:4000 --type litellm \
  --master-key "$LITELLM_MASTER_KEY"

# Extract Ollama modelfiles and system prompts
agenthound loot 10.0.0.10:11434 --type ollama \
  --include-credential-values

3. Model Inversion A pure-Go GGUF parser runs statistical analysis on embedding matrices to recover likely fine-tune vocabulary — surfacing what models were trained on.

4. Tool/Instruction Poisoning

# Poison an MCP tool description via ContextForge
agenthound poison \
  https://gateway.example/servers/.../mcp \
  --type mcp.tool.description --adapter contextforge \
  --target-id support-lookup --inject-file payload.txt \
  --commit --engagement-id ENG-1

5. Config Implants

# Drop a malicious MCP server into a user's config
agenthound implant localhost --type mcp.config.malicious-server \
  --file "$HOME/.cursor/mcp.json" --inject-file server-entry.json \
  --commit --engagement-id ENG-1

# Clean up after assessment
agenthound revert ENG-1

The Graph Is the Point

Everything gets merged into a Neo4j graph with 23 node types and 32 edge kinds. The magic happens in the path analysis:

FindingQuestion It Answers
Credential-chain pathsWhich reused credential gives an agent access it never explicitly had?
Execution pathsWhich agents can reach shell, database, or network tools?
Exfiltration pathsWhere can sensitive data leave the environment?
Cross-protocol pivotsCan MCP become a bridge into an A2A trust domain?
Tool poisoningWhich tool descriptions could steer model behavior unsafely?
Tool shadowingWhich tool could hijack an expected action?

The 15 post-processors compute routes that raw facts can’t show — like how a credential hash in one MCP config matches a gateway master key, creating an implicit trust chain nobody explicitly granted.

What It Fingerprints

AgentHound covers the full agentic stack:

  • Agent clients: 12 MCP config formats plus instruction files (CLAUDE.md, AGENTS.md, .cursorrules)
  • MCP: Stdio and HTTP/SSE servers, tools, resources, prompts, authentication
  • A2A: Agent cards, JWS verification, skills, delegation chains
  • LiteLLM: Master keys, masked provider references, virtual-key metadata with spend context
  • Ollama/vLLM: Model metadata, modelfile hashes, system-prompt presence, fine-tune signals
  • Qdrant: Collections, point counts, payload samples
  • MLflow: Experiments, runs, registered models, artifact URIs
  • Jupyter: Sessions, notebook trees, anonymous-vs-authenticated exposure
  • Open WebUI/LangServe: Auth posture, upstream credentials, RAG config

Standards Mapping

Every finding maps to:

  • OWASP MCP Top 10
  • OWASP Agentic Top 10
  • MITRE ATLAS

Plus 35 detection rules, 19 prebuilt attack-path queries, and 0–100 risk scoring with retest-as-diff for tracking remediation.

Quick Start

# Start analysis server (Neo4j + Postgres + UI)
curl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/main/docker/docker-compose.public.yml | \
  docker compose -f - -p agenthound up -d --wait

# Install collector
brew install adithyan-ak/agenthound/agenthound

# Scan local agent configs
agenthound scan --config --ingest http://127.0.0.1:8080

# Open graph at http://127.0.0.1:8080

The collector is a single static Go binary — no runtime dependencies. Release archives include Cosign-signed checksums and SPDX SBOMs.

Safety Guardrails

This is an offensive tool, so it ships with defaults that won’t get you fired:

  • Dry-run by default on all mutation operations
  • Authorization checks before destructive actions
  • Reversible workflows with explicit --commit and agenthound revert
  • Engagement IDs for tracking which changes belong to which assessment

Why This Matters

The agentic ecosystem has grown faster than anyone’s ability to secure it. Every organization running MCP servers, coding agents, or AI gateways now has infrastructure that:

  1. Crosses trust boundaries in ways nobody explicitly designed
  2. Chains credentials through configurations scattered across dozens of files
  3. Exposes execution capabilities to models that can be prompt-injected

AgentHound is how you actually see what’s happening.

GitHub: github.com/adithyan-ak/AgentHound
Docs: docs.agenthound.io

The comparison to BloodHound is apt. Just as AD security transformed when defenders could finally see attack paths instead of guessing at them, AI agent security needs the same visibility. AgentHound is the first serious tool I’ve seen that treats “agentic infrastructure” as a coherent attack surface worth mapping.