The offensive security framework for AI agent infrastructure

MCP · A2A · model gateways · inference servers · vector stores · MLOps · notebooks · 12 agent clients

Quickstart · Capabilities · Lifecycle · Graph Model · Docs · Safety

Authorized use only. AgentHound ships read-only discovery and active exploitation modules. Run it only against infrastructure you own or are written-authorized to assess. See Safety & Authorization.

AgentHound is an open-source offensive security framework for AI agent infrastructure. It runs the full engagement - recon, fingerprinting, credential looting, modelfile / system-prompt / fine-tune inventory, model inversion, tool and instruction poisoning, and config-implant persistence - across every layer of the modern agentic stack, then merges every fact into one Neo4j graph and proves the attack paths that tie it all together. Agenthound is BloodHound for the agentic stack.

⚡ Capabilities

🌐 Full-spectrum agentic attack surface One framework attacks every layer - MCP, A2A, model gateways, inference servers, vector stores, MLOps, notebooks, and 12 agent clients. The whole estate is one target set.	🔓 Credential inventory across the gateway & service plane Hand the LiteLLM looter one master key to inventory the observed master-key exposure, masked upstream-provider references, and hashed virtual-key references with spend metadata. Only observed credential material participates in cross-service value_hash correlation.
🧬 Modelfile, system-prompt & fine-tune inventory Enumerate every model on an unauthenticated Ollama - names, digests, sizes, modelfiles, templates, and system prompts. Fine-tunes (SYSTEM / ADAPTER directives) get flagged; a model with observable modelfile content carries a stable content hash for cross-run comparison.	🔬 Model inversion / training-data residue extraction A pure-Go GGUF parser runs statistical inversion on the embedding matrix of any weight file you feed it to recover likely fine-tune vocabulary tokens - surfacing what a model was trained on as graph nodes.
☠️ Active exploitation - tool/instruction poisoning + config implant Rewrite a ContextForge-managed MCP tool description, inject CLAUDE.md / .cursorrules, or implant a malicious MCP server for persistence. Every mutation is dry-run by default and carries provider-specific recovery state.	🗄️ RAG, vector-store & notebook attack surface Inventory Qdrant collections and Jupyter sessions and notebook trees. Jupyter protected operations are tried without credentials first and retried with an operator-supplied bearer value only after a 401/403, so anonymous access is recorded only when it actually succeeds; bounded tree truncation is published as partial inventory.
🕸️ Cross-protocol & credential-chain attack paths 15 post-processors compute the routes raw facts can't show - credential chains, cross-protocol pivots, exfiltration paths - up to 6 hops, across MCP and A2A.	🧪 Indirect prompt injection, modeled as data-flow Prompt injection treated as taint propagation: untrusted-input tools → tainted siblings → high-impact sinks, traced as real graph edges.
📊 Detection & standards intelligence 19 prebuilt attack-path queries, 35 detection rules, 0–100 risk scoring, and retest-as-diff - crosswalked to OWASP MCP / Agentic Top 10 and MITRE ATLAS.	🧩 Write your own attacks A new attack against a new AI service is one module away - implement an action interface, drop a register.go, blank-import it. Same SDK, same lifecycle, same graph.

🎯 Every plane of the stack is a target

Plane	What AgentHound attacks	Modules
Agent client	12 MCP client configs + instruction files (CLAUDE.md, AGENTS.md, .cursorrules)	config
Protocol	MCP servers (stdio + HTTP/SSE), A2A agents (agent cards, JWS, delegation)	mcp, a2a, protoscan
Model gateway	LiteLLM - observed master-key exposure plus masked provider and hashed virtual-key inventory	litellmfp, litellmloot
Inference	Ollama, vLLM - model inventory, modelfiles, system prompts, fine-tune detection	ollamafp, ollamaloot, vllmfp
Vector / RAG	Qdrant collections	qdrantfp, qdrantloot
MLOps	MLflow experiments + runs	mlflowfp, mlflowloot
Notebook	Jupyter sessions + notebook tree	jupyterfp, jupyterloot
Frontend	Open WebUI (RAG docs, upstream keys), LangServe	openwebuifp, openwebuiloot, langservefp

📦 By the numbers

• 25 directories under modules/ - 22 sdk/module registrations, 2 sdk/campaign scenarios, and the protoscan discovery engine
• 8 lifecycle CLI commands - scan · discover · loot · extract · poison · implant · revert · campaign (enumerate + fingerprint run inside scan)
• 8 fingerprinters · 6 looters · 1 model-inversion extractor · 2 poisoners · 1 implanter
• Graph: 23 node labels · 32 edge kinds (20 raw + 12 composite) · 15 post-processors
• Intelligence: 35 text-detection rules + 7 YAML fingerprint rules + 1 code-backed Jupyter detector · 19 prebuilt attack-path queries · OWASP MCP Top 10 + OWASP Agentic Top 10 + 7 MITRE ATLAS techniques
• One static collector binary (~9.9 MiB, no DB/UI/server deps, offline by default). Apache-2.0, cosign-signed releases with SBOM.

🚀 Quick start

Prerequisites: Docker + Compose v2. No Go, no Node, no git clone.

# 1. Start the analysis server (Neo4j + Postgres + UI, binds 127.0.0.1:8080)
curl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/main/docker/docker-compose.public.yml | docker compose -f - -p agenthound up -d --wait

# 2. Install the collector (single static binary, ~9.9 MiB → ~/.local/bin)
curl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/main/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"

# 3. Scan your own machine - offline, read-only, secrets hashed - and stream it in
agenthound scan --config --output - | curl --data-binary @- -H "Content-Type: application/json" http://127.0.0.1:8080/api/v1/ingest

# 4. Open the graph
open http://127.0.0.1:8080   # xdg-open on Linux

Collection identity and the PostgreSQL/Neo4j storage pairing are automatic; there are no host, network, or storage-pair IDs to configure or preserve. Artifacts from multiple hosts and networks can be imported into one server. AgentHound derives read-only collection-point and network-context provenance on the target and scopes ambiguous graph identities and lifecycle coverage at ingest. The derived IDs are provenance, not authentication.

Prefer a reproducible, pinned install? Every release is cosign-signed with an SBOM:

curl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/v1.0.1/install.sh | sh

Also available via Homebrew (brew tap adithyan-ak/agenthound, then brew install adithyan-ak/agenthound/agenthound adithyan-ak/agenthound/agenthound-server), go install, and signed release binaries - see the installation guide.

🔪 The offensive lifecycle

One binary runs the whole offensive lifecycle. scan, discover, and loot write ingest envelopes; extract and the credential-reach campaign do so only on committed runs. poison and implant report mutation status and persist protected receipts; revert consumes those receipts and reports rollback status; the MCP poison round-trip campaign emits a bounded RunReport, not graph evidence. loot, extract, poison, and implant have per-action AUTHORIZED gates. campaign has a distinct acknowledgement, and committed mutation scenarios also require the poison acknowledgement. extract, poison, implant, and campaign default to dry-run. poison and implant record recovery paths for agenthound revert; extract analyzes a local artifact, does not mutate it, and has no Reverter - see Safety & Authorization.

1. Recon - find the AI estate:

agenthound scan 10.0.0.0/24
agenthound discover 10.0.0.0/24 --mcp --a2a

2. Loot - inventory credential evidence and model metadata without durable target mutation (GET/HEAD plus documented idempotent lookup/search POSTs):

agenthound loot 10.0.0.20:4000 --type litellm --master-key sk-... --engagement-id ENG-1 --output -
agenthound loot 10.0.0.10:11434 --type ollama --include-credential-values --engagement-id ENG-1

Looter types: litellm, ollama, openwebui, mlflow, qdrant, jupyter.

3. Extract - invert a locally-available GGUF weight file to recover fine-tune residue:

agenthound extract <model-id> --type embedding-invert --artifact /path/to/model.gguf --commit --engagement-id ENG-1

4. Exploit + persist - sanctioned, reversible offensive actions:

# Optional management override; required when management is on another origin.
export AGENTHOUND_CONTEXTFORGE_TOKEN='...'
agenthound campaign https://gateway.example/servers/<server-uuid>/mcp \
    --scenario mcp-poison-roundtrip --adapter contextforge \
    --target-id support-lookup --engagement-id ENG-ROUNDTRIP --commit
agenthound poison https://gateway.example/servers/<server-uuid>/mcp \
    --type mcp.tool.description --adapter contextforge \
    --target-id support-lookup --inject-file payload.txt \
    --commit --engagement-id ENG-1
agenthound implant --type mcp.config.malicious-server --target-id ~/.cursor/mcp.json --inject "..." --commit --engagement-id ENG-1
agenthound revert ENG-1

ContextForge management is a named provider contract, not a generic MCP update API. AgentHound derives the deployment root and server UUID from the server-scoped MCP URL; copy the v1.0.5 server ID exactly in its canonical lowercase 32-hex form. Use --management-url without /v1 only when the management root differs. MCP authentication comes from AGENTHOUND_MCP_TOKEN or one unambiguous exact-URL client-config Authorization header. AGENTHOUND_CONTEXTFORGE_TOKEN is an independent management override; without it, same-origin management reuses the resolved MCP bearer, while cross-origin management fails closed. Use a provider session token or an API token with an empty/wildcard permission ceiling. For non-admins, AgentHound separately proves effective provider RBAC for servers.read, tools.read, and tools.update; restrict the account's roles to those permissions and make it the direct owner of both objects. A platform-admin bypass is accepted only from the provider-authenticated profile.

5. Analyze - pathfind and gate:

agenthound-server query --prebuilt litellm-credential-leak
agenthound-server query --findings --fail-on critical

See the full CLI reference for every verb, flag, and module.

🔎 What AgentHound finds

AgentHound's findings are built around the questions red teams and defenders ask when they need to understand reachability, blast radius, and pathing risk.

Finding	What it means	Question it answers
Credential-chain paths	The same secret appears in multiple contexts, letting trust cross service boundaries.	Which reused credential gives an agent access it never explicitly had?
Reachability	Agents, MCP servers, tools, resources, prompts, A2A skills, and AI services are joined into one graph.	What can this agent actually reach if trust edges are followed?
Execution paths	An agent can reach shell-like, database, network, or other high-impact tools.	Which agents have a path to command execution, data-plane control, or production impact?
Exfiltration paths	An agent can read sensitive data and also reach an outbound channel.	Where can sensitive data leave the environment?
Cross-protocol pivots	MCP, A2A, host context, and AI-service infrastructure combine into one reachable path.	Can one agent protocol become a bridge into another trust domain?
Tool poisoning	Tool descriptions, prompts, or instruction files contain suspicious model-steering content.	Which tools or instructions could influence model behavior in unsafe ways?
Tool shadowing	A lookalike tool mimics a trusted capability or name.	Which tool could intercept or hijack an expected action?
Rug pulls	A tool's description, schema, or server instructions changed between scans.	What changed since the last known-good graph, and did it create a new risk path?
Unauthenticated servers or agents	MCP servers or A2A protocol handlers affirmatively accepted a credential-free probe; A2A uses a bounded read-only nonexistent-task lookup and never submits a message.	Which exposed agent surfaces need immediate review?
Risk hotspots	Nodes and paths are prioritized with risk scores and prebuilt graph queries.	Where should investigation or remediation start first?

See Detection Rules and Risk Scoring for the full catalog.

🔗 Path primitives

AgentHound doesn't just list findings - it creates graph edges you can chain, query, and report:

• CAN_REACH: an agent can traverse trust, credential, host, or protocol relationships to reach a target.
• CAN_EXECUTE: an agent can reach a tool capable of command, database, network, or code execution.
• CAN_EXFILTRATE_VIA: an agent can read sensitive data and send it through an outbound channel.
• CAN_IMPERSONATE: an A2A agent can act as another A2A agent.
• SHADOWS: a tool mimics a trusted tool closely enough to hijack expected behavior.
• POISONED_DESCRIPTION / POISONED_INSTRUCTIONS: tool or instruction text contains model-steering content.

These edges turn AI-agent infrastructure into something you can pathfind instead of manually reason about.

🗺️ Example path

flowchart LR
  Agent["AgentInstance<br/>claude-desktop"]
  Notes["MCPServer<br/>internal-notes"]
  Identity["Identity<br/>configured auth"]
  ConfigCred["Credential<br/>configured secret<br/>value_hash: a3f9..."]
  Gateway["LiteLLMGateway<br/>prod"]
  MasterCred["Credential<br/>gateway master key<br/>value_hash: a3f9..."]
  ProviderRef["Credential<br/>masked provider reference<br/>material not observed"]

  Agent -- TRUSTS_SERVER --> Notes
  Notes -- AUTHENTICATES_WITH --> Identity
  Identity -- USES_CREDENTIAL --> ConfigCred
  ConfigCred -. VALUE_HASH_MATCH .-> MasterCred
  Gateway -- EXPOSES_CREDENTIAL --> MasterCred
  Gateway -- EXPOSES_CREDENTIAL --> ProviderRef
  Agent -- CAN_REACH --> ProviderRef

Loading

No single config file declares this path. AgentHound correlates the two collector-owned credential records by value_hash and computes the reachability edge once both outputs land in the same graph. The provider target remains a reference-only finding: it does not assert that AgentHound obtained usable upstream provider secret material.

🛡️ Safety & authorization

Built to be run under authorization, with the controls this audience checks for:

• Read-only looter contract - GET/HEAD only (narrow idempotent-search carve-outs), each guarded by a get_only_test.go regression test.
• Mutating verbs dry-run by default - poison, implant, and mutation campaigns do not modify a target without --commit. extract performs its local analysis in dry-run and uses --commit only to emit ingest data.
• Compile-time-mandatory recovery path - Poisoner / Implanter embed Reverter; every destructive module must implement recovery. Runtime restoration is verified, not guaranteed across provider policy changes, conflicts, or unavailable targets.
• Receipt before mutation - the undo receipt is persisted to disk before the write lands.
• AUTHORIZED gates + --engagement-id - interactive first-run prompts; every receipt and edge threaded for IR coordination.
• Recon guardrails - public-IP targets require opt-in + an authorization-file watermark; link-local/multicast refused outright.

It is explicitly not a C2, not an evasion implant (EDR will flag a binary named agenthound), and not a multi-user SaaS. It is an authorized-assessment framework, and the design says so.

Read the security posture guide and offensive actions guide.

📚 Docs · Contributing · License

Quickstart · CLI · Graph Model · Detection Rules · Security

Write your own attack: implement an action interface, drop a register.go, blank-import it - see CONTRIBUTING.md and the module authoring guide. Found a vulnerability in AgentHound itself? See SECURITY.md.

AgentHound is licensed under the Apache License 2.0.