AgentHound Documentation¶
The offensive security framework for AI agent infrastructure — run the full red-team lifecycle (recon, credential looting, model & modelfile inventory, model inversion, tool/instruction poisoning, config-implant persistence, and attack-path analysis) across MCP, A2A, and AI services. BloodHound for the agentic stack.
Get Started¶
- Install — Homebrew, Docker, or build from source
- Quickstart — First scan to first finding in 10 minutes
Operator Guides¶
- Network Scanning — Sweep CIDRs for AI/ML services + fingerprint
- Rules Bundles — Out-of-band fingerprint rule updates (
--rules-bundle) - Protocol Discovery — Find MCP servers and A2A agents by protocol shape
- Looting — Extract credentials and model artifacts from discovered services
- LiteLLM — Observed master key, masked provider references, and hashed virtual-key inventory
- Ollama — Model inventory, modelfiles, fine-tune detection
- Offensive Actions — Poison tool descriptions, implant configs, revert
- Attack Paths — Credential chains, cross-protocol pivots, exfiltration routes
- Deployment — Production setup, reverse proxy, backups
- Security and OPSEC — Threat model, audit trail, operator posture
Reference¶
- CLI Reference — Every command, flag, and env var
- API Reference — REST endpoints, auth, request/response schemas
- Graph Model — 23 node types, 32 edge types (20 raw + 12 composite), ID strategy, merge semantics
- CAN_REACH — Transitive agent→resource access (one of the 12 composite edges)
- Detection Rules — 19 pre-built queries + OWASP mapping
- Rule Syntax — YAML schema for detection + fingerprint rules
- Configuration — Env vars, state directories, defaults
- Risk Scoring — Edge weights, node scores, sensitivity classification
Architecture¶
- System Design — Two-binary split, data flow, tech stack
- Ingest Pipeline — Validate → normalize → deduplicate → write → post-process
- Post-Processors — 15 post-processors computing 12 composite edges, in dependency order
Contributing¶
- Development Setup — Clone to green CI in 5 minutes
- Writing Modules — Add a fingerprinter, looter, or poisoner
- Authoring Rules — Write + test YAML detection rules
Decisions¶
- ADR-0001: Two-Binary Split — Why collector and server are separate binaries
Where does my new doc go?¶
| Question | Folder |
|---|---|
| How to USE the tool operationally? | operator/ |
| A lookup table, schema, or flag reference? | reference/ |
| How the code works internally? | architecture/ |
| How to add something to the codebase? | contributing/ |
| A first-time setup walkthrough? | getting-started/ |
| An architecture decision? | adr/ |
One concept per file. Split before 500 lines. kebab-case filenames.