Happy slice of mcp pizzaMCP.pizza

bloodhound_mcp

MCP.Pizza Chef: mwnickerson

Thirteen tools cover a BloodHound Community or Enterprise install: domains, users, groups, computers, policies, certificate weaknesses, shortest attack paths and a free-form query runner, backed by ten built-in reference guides on Active Directory, Entra ID and certificate abuse. This reads the map BloodHound has already collected; it never touches the real network and runs no attacks. It can, though, save, publicly share and delete stored queries, add or remove custom node types, and upload new collection files, none of which asks first. Sign-in uses a BloodHound token pair kept in a local file.

Data
Other

Use This MCP server To

Find the shortest path from a user to domain admin List everyone who can reset another account's password Check which accounts could pull password hashes Spot weak certificate templates in my domain See which computers a compromised account can reach Check how complete my collected data actually is

README

BloodHound MCP

License: GPL v3

A Model Context Protocol (MCP) server that connects LLMs to BloodHound Community Edition and BloodHound Enterprise. Ask questions in natural language, get attack path analysis, run Cypher queries, and explore Active Directory, Azure/Entra ID, and OpenGraph environments — all from your AI assistant.

Demo

Watch the demonstration video

How It Works

The server exposes BloodHound CE's REST API and Neo4j graph through a set of 13 composite MCP tools, 10 reference resources, and a system prompt tuned for offensive security analysis.

Composite Tools

Each tool uses an info_type parameter to select what data is returned, keeping the tool surface small and token-efficient:

Tool info_type Options
domain_info list, info, users, groups, computers, ous, gpos, dc_syncers, foreign_admins, foreign_group_members, linked_gpos, search
user_info info, sessions, memberships, admin_rights, rdp_rights, dcom_rights, ps_remote_rights, sql_admin_rights, constrained_delegation, controllables, controllers
group_info info, members, memberships, admin_rights, rdp_rights, dcom_rights, ps_remote_rights, controllers, controllables
computer_info info, sessions, local_admins, rdp_rights, dcom_rights, ps_remote_rights, sql_admins, constrained_delegation, controllables, controllers
ou_info info, users, groups, computers, gpos
gpo_info info, controllers
graph_analysis shortest_path, edge_composition, search
adcs_info templates, esc_paths
cypher_query run, saved_list, saved_get
data_quality stats, platform_list, platform_info
asset_groups list, members, custom_selectors
custom_nodes list, get, create, update, delete, validate_icon, extension_list, extension_upsert, extension_delete, extension_edges
file_upload upload, start_job, upload_to_job, upload_bytes, upload_bytes_to_job, end_job

bloodhound_mcp FAQ

Do I need an API key?
Yes, two parts: a token ID and a token key created inside your own BloodHound install, saved in a local settings file. The key itself is never sent over the network, because each request is signed with it instead. You also need a BloodHound instance already loaded with data.
Does it attack anything or touch my live network?
No. It only reads the map BloodHound has already collected. It cannot log into machines, change Active Directory or run an exploit.
So it cannot change anything at all?
Not quite. Inside BloodHound it can delete saved queries, share a saved query publicly with other users, create, edit and delete custom node types, and upload new collection files. None of those asks for confirmation and there is no read-only mode.
Do the options in the instructions match the code?
Not everywhere. The summary table names two saved-query options the code does not recognise, and leaves out saving, updating, deleting, sharing and checking queries entirely. If an option is rejected, the tool lists the ones it does accept.
Which apps does it work in?
Claude Desktop and Claude Code have documented settings, and any app that can run a local command will work.
How hard is setup?
You download the code, install its parts with a Python tool called uv, create a settings file holding your token, then point your app at the folder. Expect a terminal session.
Is it still maintained?
Yes, unusually so. It was updated within the past week, carries its own test suite, and the tool list in its notes matches the code exactly.
Can I use this at work?
It is shared under the GPL version 3, which is fine for internal use. If you hand out a modified version you must publish your changes too. And only point it at systems you are authorised to assess.
Is there anything to be careful about with the connection?
There is a setting that switches off certificate checking, meant for lab machines with self-signed certificates. It is on by default and warns you when disabled, so leave it on anywhere but an isolated lab.