BloodHound MCP
An MCP server for BloodHound CE and Enterprise: the agent finds attack paths in Active Directory and Entra ID and writes Cypher.
- 143 ★ on the repository
- Last commit
- GPL-3.0
Broad access
Why this level
- The BloodHound token opens the domain's privilege map; upload and OpenGraph node tools change data in the database.
- The references describe offensive AD attack techniques: DCSync, Kerberoasting, ADCS, NTLM relay. Use them only in an environment cleared for testing.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/bloodhound-mcpDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The BloodHound token opens the domain's privilege map; upload and OpenGraph node tools change data in the database.
- The references describe offensive AD attack techniques: DCSync, Kerberoasting, ADCS, NTLM relay. Use them only in an environment cleared for testing.
This is third-party code. Review the repository files before installing.
What it does
The server connects an LLM to BloodHound Community Edition and BloodHound Enterprise through the REST API and the Neo4j graph. The agent examines domains, users, groups, computers, OUs and GPOs, finds shortest paths to Domain Admins, DCSync rights and ADCS ESC1 to ESC13 chains, and runs its own Cypher queries. The set consists of 13 composite tools with an `info_type` parameter, 10 reference resources and the `bloodhound_assistant` system prompt. The resources hold Cypher cheat sheets, methodologies for AD, Azure and ADCS and query templates. The `file_upload` tool uploads data collected by SharpHound and AzureHound, and `custom_nodes` handles OpenGraph node types.
Who it is for. Active Directory security specialists who analyse BloodHound data with Claude Code or Codex: contracted pentesters and defenders.
Good fit when
- You need the shortest path from a compromised user to Domain Admins in an authorised test.
- Defenders look for kerberoastable accounts and computers with unconstrained delegation.
- You have to find who holds DCSync or RDP rights on a group of computers.
- SharpHound or AzureHound results are uploaded to BloodHound straight from chat.
Not a fit when
- There is no written permission to test the environment.
- The BloodHound token cannot be handed to an agent: its rights decide access to data and writes.
- You need to work without BloodHound: the server does not collect data itself.
Example request
Find the shortest path from jsmith@corp.local to Domain Admins and show which rights lie on it.MCP
- Transport
- stdio
- Authentication
- API key
Environment variables
BLOODHOUND_DOMAINrequired- BloodHound instance address without a scheme.
BLOODHOUND_TOKEN_IDrequired, secret- Token ID from the API Tokens section.
BLOODHOUND_TOKEN_KEYrequired, secret- Token Key from the API Tokens section.
BLOODHOUND_PORT- Port, 443 by default.
BLOODHOUND_SCHEME- Scheme `https` or `http`.
BLOODHOUND_VERIFY_TLS- The value `false` turns off certificate verification.
Limitations
Python 3.11 and `uv`, a running BloodHound CE instance with data loaded and an API token made of Token ID and Token Key are required. By default the server talks `https` on port 443. TLS verification is on and is turned off explicitly with `BLOODHOUND_VERIFY_TLS=false`, only in a trusted lab. At startup it makes a signed read request to `/api/v2/self` and stops on failure. The upload and OpenGraph node tools write to the BloodHound database, so give the token minimal rights. An installation through `uvx` does not read `.env` from a separate checkout: the process that launches the client must set the variables.
How to disable. Remove the `bloodhound_mcp` block from the client's MCP config. Revoke the API token in BloodHound under Administration, API Tokens.
FAQ
How do I connect the server to Claude Code?
Add a `stdio` server to `~/.claude/mcp.json` with the `uvx` command and arguments `--from git+https://github.com/mwnickerson/bloodhound_mcp bloodhound-mcp`. The environment variables must be set in the process that launches Claude Code.
Where do I get the API token?
In BloodHound open Administration, then API Tokens, create a token and copy the Token ID and Token Key into `BLOODHOUND_TOKEN_ID` and `BLOODHOUND_TOKEN_KEY`.
How do I upload SharpHound data?
Ask the agent to upload a ZIP from a path or call `file_upload` with `info_type="upload_bytes"` and a file name. For several files use the chain `start_job`, `upload_bytes_to_job`, `end_job`.
What about a self-signed certificate?
In a trusted lab set `BLOODHOUND_VERIFY_TLS=false`. The server logs a warning and TLS verification stays off, so do not do this on untrusted networks.
Is Azure supported?
Yes, the server works with Active Directory, Azure and Entra ID and with OpenGraph node types. For Azure there is the reference resource `bloodhound://guides/azure` and an attack-chain methodology.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server for BloodHound: an agent analyzes Active Directory attack paths in plain language instead of hand-written Cypher queries to Neo4j
An offensive security MCP server: the agent runs 150+ pentest and recon tools and drives automated target assessments
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
An MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
README in short
Composite tools keep the surface small and save tokens: one tool covers an object type and `info_type` picks the data. The system prompt requires loading the offensive query library before writing Cypher and forbids privilege conclusions without checking group membership and `admincount`.