BloodHound-MCP-AI
An MCP server for BloodHound: an agent analyzes Active Directory attack paths in plain language instead of hand-written Cypher queries to Neo4j
- 384 ★ on the repository
- Last commit
Broad access
Why this level
- BloodHound data describes the weak spots of a domain and enters the model's context
- The query_bloodhound tool runs any Cypher query, and the README does not say writes are blocked
- A dual-use tool: acceptable only with the domain owner's permission
Install
- Works in
Manual install
git clone https://github.com/MorDavid/BloodHound-MCP-AI.git && cd BloodHound-MCP-AI && pip install -r requirements.txtThe README shows a placeholder instead of the repository URL; the real one is used here. After installing, wire the server in with the config block below.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- BloodHound data describes the weak spots of a domain and enters the model's context
- The query_bloodhound tool runs any Cypher query, and the README does not say writes are blocked
- A dual-use tool: acceptable only with the domain owner's permission
This is third-party code. Review the repository files before installing.
What it does
A Python server connects to the Neo4j database where BloodHound stores collected Active Directory data and gives an agent more than 75 ready-made tools. They are built on Cypher queries from BloodHound CE: there is no need to write a query by hand: you state the question and the agent picks a tool and runs it. The tools cover domain structure, privilege escalation paths, Kerberos issues (Kerberoasting and AS-REP Roasting), certificate services weaknesses, account hygiene, NTLM relay vectors and delegation abuse. A separate query_bloodhound tool accepts any Cypher query. The README examples include finding paths from Kerberoastable accounts to Domain Admins, listing computers where Domain Users have local admin rights, finding inactive privileged accounts and building a report on the state of the domain.
Who it is for. For pentesters and Active Directory defenders who already use BloodHound and want to query its data through Claude Code or Claude Desktop.
Good fit when
- On an authorized audit you need the shortest paths to Domain Admins in an already collected graph
- A defense team needs to check which privileged accounts have been inactive for a long time
- You need a management report on the state of the domain built from BloodHound data
- You want to find domain controllers and computers exposed to NTLM relay
- You want to list certificate services weaknesses in a domain without writing Cypher queries
Not a fit when
- You have no permission from the domain owner to analyze it: the tool is meant for authorized security assessment
- BloodHound data has not been collected yet: the server only reads the graph and probes nothing in the domain itself
- You want a replacement for the BloodHound graphical interface with visualization: answers come back as text with no graph in them
- You need a tool for non-technical readers without Neo4j access: the server requires a running database
Example request
Show all paths from Kerberoastable users to Domain Admins and sort them by chain length.MCP
- Transport
- stdio
- Authentication
- API key
Environment variables
BLOODHOUND_URI- Neo4j address, bolt://localhost:7687 by default.
BLOODHOUND_USERNAME- Neo4j user, neo4j by default.
BLOODHOUND_PASSWORDrequired, secret- Password of the Neo4j user. Use your own.
Limitations
You need BloodHound 4.x or newer with data already collected, a Neo4j database and Python 3.8 or newer. The connection is set with the BLOODHOUND_URI, BLOODHOUND_USERNAME and BLOODHOUND_PASSWORD variables. The code defaults to the address `bolt://localhost:7687` and creates the Neo4j driver without connection encryption, so keep the database on your own machine.
The query_bloodhound tool runs any Cypher query, and the README describes no write protection: give the server a read-only Neo4j account. BloodHound data describes the weak spots of a domain, and its contents enter the model's context.
Clone the repository by its real address: the README shows the placeholder `your-username/MCP-BloodHound` instead. The last commit dates from June 2025, so check compatibility with newer BloodHound CE versions right away. The MIT license is stated in the README but is not detected in the GitHub metadata.
How to disable. Delete the BloodHound-MCP block from the MCP client config and restart the client. For safety give the server its own database user and revoke that access when you are done.
FAQ
How do I connect BloodHound to Claude through MCP?
Clone the repository, run `pip install -r requirements.txt` and add a block with the `python` command and the path to BloodHound-MCP.py to the client config. Set BLOODHOUND_URI, BLOODHOUND_USERNAME and BLOODHOUND_PASSWORD in env.
Does this server need a separate database?
No, the server reads the same Neo4j database where BloodHound loaded the Active Directory data. BloodHound collects the data first, then the server answers questions about it.
How many tools does BloodHound-MCP give and what do they do?
More than 75. They are queries on domain structure, privilege escalation paths, Kerberos, certificate services, NTLM relay and delegation, plus a universal query_bloodhound for any Cypher query.
Can I use BloodHound-MCP without the domain owner's permission?
No. The README asks you to obtain permission before analyzing any Active Directory environment, to treat BloodHound data as sensitive and to follow responsible disclosure for any vulnerabilities found.
How does BloodHound-MCP differ from general pentest MCP servers?
It does not run scanners and does not attack. The server asks questions of a ready BloodHound graph about Active Directory attack paths, so it helps with analyzing results and collects no data.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server for BloodHound CE and Enterprise: the agent finds attack paths in Active Directory and Entra ID and writes Cypher.
AdStrike is an Active Directory assessment MCP server that turns engagement material into HTML, Markdown and JSON reports.
An offensive security MCP server: the agent runs 150+ pentest and recon tools and drives automated target assessments
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
MCP server for the ARL-Next platform: returns ports, fingerprints, certificates, vulnerabilities and leaks for a domain, IP or URL from your asset database
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| BloodHound-MCP-AI (this card) | no | API key | 384 | |
| HexStrike AI MCP Agents | no | not required | 13,546 | runs 150+ pentest tools and does not analyze a ready BloodHound graph |
| MCP Kali Server | no | not required | 872 | a bridge to a Kali Linux terminal for running commands |
README in short
The README presents the project as the first BloodHound integration with AI through MCP, noting that it is not an Anthropic product. It lists the requirements, three install steps and a set of questions you can put to the agent. A security note requires permission to analyze and careful handling of the data.