Labsco
MCP SERVER

BloodHound MCP

by mwnickerson ↗

Ask BloodHound about an Active Directory or Azure environment in plain language — attack paths, admin rights, DCSync, ADCS — and get the Cypher run for you.

Vulnerability Scanning & Application Security
Summary
The graph you already collected, questioned in English.

The value is in the offensive-query library and the system prompt behind it: the assistant is told to load the battle-tested Cypher templates before writing its own, and never to call something an admin without checking group memberships and admincount first. Read the security note before you point it anywhere real — BloodHound data sent through this tool reaches your LLM provider's servers, so the README steers it at lab ranges and training, not production AD.

What it is

A server that connects an LLM to BloodHound Community Edition and BloodHound Enterprise over their REST API and Neo4j graph: 13 composite tools, 10 reference resources, and a bloodhound_assistant system prompt tuned for offensive-security analysis.

What you get
  • Thirteen composite tools instead of a sprawl of endpoints — each takes an info_type parameter to pick what comes back, which keeps the tool surface small and the token cost down
  • domain_info covers a whole domain: users, groups, computers, OUs, GPOs, dc_syncers, foreign_admins, foreign_group_members and linked_gpos among its info_type options
  • user_info, group_info and computer_info answer the privilege questions directly — sessions, memberships, admin_rights, rdp_rights, dcom_rights, ps_remote_rights, sql_admin_rights, constrained_delegation, and the controllers/controllables both directions
  • graph_analysis runs shortest_path between two principals, edge_composition to see why an edge exists, and search
  • adcs_info returns certificate templates and esc_paths for the ADCS ESC1–ESC13 escalations
  • cypher_query runs raw Cypher (run) and manages saved queries (saved_list, saved_get), backed by a bloodhound://cypher/offensive-queries library of templates for DCSync, Kerberoasting, GPO abuse, delegation, ADCS, shadow credentials and NTLM relay
  • custom_nodes and file_upload handle OpenGraph and collection ingest: model non-AD infrastructure as custom node types, and upload a SharpHound or AzureHound ZIP by path or as base64 bytes, single-shot or across a start_job / upload_bytes_to_job / end_job sequence
  • data_quality (stats, platform_list, platform_info) and asset_groups (list, members, custom_selectors) round out the read surface
  • Ten resources the model loads on demand without spending API calls — Cypher reference, AD and Azure quick references and full methodologies, ADCS ESC guides, and OpenGraph schema examples
Requirements

A BloodHound CE or Enterprise instance with data loaded, and an API token pair from its Administration → API Tokens page held in BLOODHOUND_TOKEN_ID and BLOODHOUND_TOKEN_KEY, with the host in BLOODHOUND_DOMAIN. Python 3.11+ and uv; the published launch line is uvx --from git+https://github.com/mwnickerson/bloodhound_mcp bloodhound-mcp. It defaults to https on 443 — BLOODHOUND_PORT and BLOODHOUND_SCHEME override that, and BLOODHOUND_VERIFY_TLS=false exists only for a trusted lab with a self-signed certificate. At startup it makes a signed read-only call to /api/v2/self and refuses to serve if the credentials, connectivity or TLS fail, timing out after 10 seconds.

Setup effort

One command plus a key — uvx --from git+https://github.com/mwnickerson/bloodhound_mcp bloodhound-mcp, then supply credentials