agenthound

<div align="center"> # 🐕 AgentHound ### *BloodHound for AI Agents* **Map and visualize attack paths through your AI agent's MCP tool chain — before an attacker does.** 🇺🇸 English (you are here) · [🇯🇵 日本語](README.ja.md) · [🇨🇳 简体中文](README.zh-CN.md) [](LICENSE) [](https://www.python.org/downloads/release/python-3140/) [](https://github.com/Dolphinllc) [](CONTRIBUTING.md) <img src="docs/hero.png" alt="AgentHound visualizing an attack path from a chat input through Claude Desktop's MCP tools to a leaked GitHub token" width="100%" /> </div> --- ## Why AgentHound? The **MCP tool chain** is the new attack surface. A single prompt injection — direct or indirect — can chain through `read_file → send_email` and exfiltrate your AWS credentials before you blink. Existing MCP scanners flag tools in **isolation**. They miss the *combinations*. **AgentHound** treats your AI agent's environment as a graph and finds every path an attacker could walk: ``` [chat input] ──INJECTS──▶ [Claude Desktop] ──USES──▶ [filesystem] │ ▼ ──READS──▶ [~/.aws/credentials] │ ▼ ──CALLS──▶ [send_email] ──▶ attacker@evil ``` > Inspired by [BloodHound](https://github.com/SpecterOps/BloodHound) — which became the standard for Active Directory attack-path analysis. We're doing the same for the AI agent ecosystem. ## Features - 🧭 **Attack-path graph** — every Source → Sink walk in your environment - 🎨 **React Flow UI** — interactive, dark-themed, animated paths - 📊 **Severity scoring** — CVSS-inspired 0–10 risk score per path - 🔍 **Six attack classes** — credential theft, tool poisoning, indirect prompt injection, data exfiltration, command injection, privilege escalation - 📦 **MCP-first** — parses Claude Desktop / Cursor configs, with adapters for `tools/list` - 🛠️ **CLI + REST API + Web UI** — pick your interface - 🐍 **Python 3.14, MIT-licensed** — `pip install agenthound` and you're scanning ## Quick start (60 seconds) ```bash pip install agenthound # or: uv pip install agenthound agenthound scan # runs against the bundled sample environment agenthound paths --severity critical agenthound serve # FastAPI on :8765 ``` Then open the web UI: ```bash git clone https://github.com/Dolphinllc/agenthound cd agenthound/frontend && pnpm install && pnpm dev ``` → <http://localhost:3000> ## What gets scanned | Source | Status | |-------------------------------------------------|--------| | Claude Desktop `claude_desktop_config.json` | ✅ | | Cursor MCP settings | ✅ | | MCP `tools/list` JSON-RPC catalogs | ✅ | | Claude Agent SDK config | 🚧 | | LangChain agent definitions | 🚧 | | OpenAI Assistants / Responses API tool specs | 🚧 | ## Architecture ``` ┌──────────────┐ ┌────────────────┐ ┌──────────────────┐ ┌─────────────┐ │ Config │ ─▶ │ Parsers │ ─▶ │ NetworkX Graph │ ─▶ │ Path │ │ (json/yaml) │ │ (Pydantic) │ │ + Threat sources │ │ analyzer │ └──────────────┘ └────────────────┘ └──────────────────┘ └─────────────┘ │ ┌─────────────────────────────────────────────┘ ▼ ┌──────────────────────────────────┐ │ FastAPI (REST + JSON ScanResult) │ └──────────────┬───────────────────┘ │ ┌──────────────┴───────────────────┐ ▼ ▼ ┌───────────────┐ ┌───────────────────────┐ │ Typer CLI │ │ Next.js + React Flow │ └───────────────┘ └───────────────────────┘ ``` The graph engine is **pure NetworkX** — no database. Everything is JSON-serializable. Persistence (Neo4j/Memgraph) is on the roadmap for large environments. ## Sample output ``` ─────────────────── AgentHound scan summary ─────────────────── Nodes: 38 Edges: 41 Attack paths: 72 ┏━━━━━━━━━━┳━━━━━━━┓ ┃ Severity ┃ Count ┃ ┡━━━━━━━━━━╇━━━━━━━┩ │ critical │ 3 │ │ high │ 48 │ │ medium │ 21 │ │ low │ 0 │ └──────────┴───────┘ ``` ## Roadmap - [x] MVP: parser → graph → analyzer → CLI/UI - [x] Threat-source heuristics (chat, web fetch, tool poisoning) - [ ] Live MCP server probing (`agenthound probe stdio://server`) - [ ] Cypher-style query language for power users - [ ] AgentHound Cloud — managed scanning + team dashboards - [ ] CI plugin (`agenthound check` for pre-merge gating) - [ ] Federation: share anonymized attack-path corpora to grow the catalog ## Comparison | | AgentHound | mcp-scan / Snyk Agent Scan | Cisco MCP Scanner | OWASP MCP Top 10 | |--------------------------|:----------:|:--------------------------:|:-----------------:|:----------------:| | Static tool inspection | ✅ | ✅ | ✅ | docs only | | **Multi-hop attack paths** | ✅✨ | ❌ | ❌ | ❌ | | **Interactive graph UI** | ✅✨ | ❌ | ❌ | ❌ | | Severity-scored paths | ✅ | partial | ❌ | ❌ | | Local-first / no cloud | ✅ | ✅ | ✅ | n/a | | OSS license | MIT | Apache-2.0 | Apache-2.0 | CC | We **cooperate**, not compete: AgentHound consumes findings from `mcp-scan` and friends as additional graph signal. ## Contributing We welcome PRs, issues, and new attack patterns. See [CONTRIBUTING.md](CONTRIBUTING.md) and [good first issues](https://github.com/Dolphinllc/agenthound/labels/good%20first%20issue). To report a vulnerability **in AgentHound itself**, see [SECURITY.md](SECURITY.md). ## Citing AgentHound If you use AgentHound in research or in a public report, please cite: ```bibtex @software{agenthound2026, title = {AgentHound: BloodHound for AI Agents}, author = {{Dolphin LLC}}, year = {2026}, url = {https://github.com/Dolphinllc/agenthound} } ``` ## License MIT © 2026 [Dolphin LLC](https://github.com/Dolphinllc) — see [LICENSE](LICENSE).