BloodHound MCP

A Model Context Protocol (MCP) server that connects LLMs to BloodHound Community Edition and BloodHound Enterprise. Ask questions in natural language, get attack path analysis, run Cypher queries, and explore Active Directory, Azure/Entra ID, and OpenGraph environments — all from your AI assistant.

Demo

Watch the demonstration video

---

How It Works

The server exposes BloodHound CE's REST API and Neo4j graph through a set of 13 composite MCP tools, 10 reference resources, and a system prompt tuned for offensive security analysis.

Composite Tools

Each tool uses an info_type parameter to select what data is returned, keeping the tool surface small and token-efficient:

Tool	info_type Options
domain_info	list, info, users, groups, computers, ous, gpos, dc_syncers, foreign_admins, foreign_group_members, linked_gpos, search
user_info	info, sessions, memberships, admin_rights, rdp_rights, dcom_rights, ps_remote_rights, sql_admin_rights, constrained_delegation, controllables, controllers
group_info	info, members, memberships, admin_rights, rdp_rights, dcom_rights, ps_remote_rights, controllers, controllables
computer_info	info, sessions, local_admins, rdp_rights, dcom_rights, ps_remote_rights, sql_admins, constrained_delegation, controllables, controllers
ou_info	info, users, groups, computers, gpos
gpo_info	info, controllers
graph_analysis	shortest_path, edge_composition, search
adcs_info	templates, esc_paths
cypher_query	run, saved_list, saved_get
data_quality	stats, platform_list, platform_info
asset_groups	list, members, custom_selectors
custom_nodes	list, get, create, update, delete, validate_icon, extension_list, extension_upsert, extension_delete, extension_edges
file_upload	upload, start_job, upload_to_job, end_job

Resources

Reference material the LLM loads on demand — no extra API calls:

Resource URI	Contents
bloodhound://cypher/reference	Cypher syntax, schema, property names, patterns
bloodhound://cypher/offensive-queries	Battle-tested templates: DCSync, Kerberoasting, GPO abuse, delegation, ADCS, shadow credentials, NTLM relay, and more
bloodhound://guides/ad	AD node types and relationships quick reference
bloodhound://guides/ad-methodology	Full AD attack methodology and workflow
bloodhound://guides/azure	Azure/Entra ID analysis quick reference
bloodhound://guides/azure-methodology	Full Azure attack chains
bloodhound://guides/adcs	ADCS ESC1–ESC13 quick reference
bloodhound://guides/adcs-methodology	Detailed ESC analysis and exploitation
bloodhound://opengraph/guide	Custom node schema design and best practices
bloodhound://opengraph/examples	SQL Server and Web App OpenGraph examples

System Prompt

The bloodhound_assistant prompt includes behavioral rules that guide the LLM:

• Load the offensive query library before writing Cypher for any attack scenario
• Never draw privilege conclusions without checking group memberships and admincount
• Respect BloodHound's property naming conventions (hasspn, enabled, admincount — all lowercase)
• Handle uppercase name storage (DOMAIN ADMINS@CORP.LOCAL) correctly in filters
• Follow proper DCSync and GPO edge traversal patterns

---

Prerequisites

• Python 3.11+
• uv
• BloodHound Community Edition instance with data loaded
• BloodHound API credentials (Token ID + Token Key)

---

Installation

git clone https://github.com/mwnickerson/bloodhou

... [View full README on GitHub](https://github.com/mwnickerson/bloodhound_mcp#readme)