{"passport":{"unfragile":{"@version":"1.0","version":"2026-05","artifact":{"id":"awesome-bloodhound-mcp","slug":"bloodhound-mcp","name":"BloodHound-MCP","type":"mcp","url":"https://github.com/MorDavid/BloodHound-MCP-AI","page_url":"https://unfragile.ai/bloodhound-mcp","categories":["mcp-servers","code-review-security"],"tags":[],"pricing":{"model":"open_source","free":true,"starting_price":null},"status":"active","verified":false},"capabilities":[{"id":"awesome-bloodhound-mcp__cap_0","uri":"capability://tool.use.integration.natural.language.to.cypher.query.translation.for.active.directory.analysis","name":"natural language to cypher query translation for active directory analysis","description":"Translates conversational security queries into optimized Cypher queries executed against BloodHound's Neo4j graph database. The FastMCP server acts as an intermediary that interprets natural language intent and routes it to specialized security analysis tools, which then construct and execute graph database queries. This eliminates the need for security professionals to learn Cypher syntax while maintaining full access to BloodHound's relationship mapping capabilities.","intents":["Query Active Directory attack paths using plain English instead of Cypher","Ask questions about domain relationships without learning graph query syntax","Analyze security posture through conversational interaction with BloodHound data","Discover privilege escalation paths by describing attack scenarios in natural language"],"best_for":["Security professionals and penetration testers unfamiliar with Cypher","Red teams needing rapid attack path discovery without syntax overhead","Organizations integrating BloodHound analysis into AI-assisted security workflows"],"limitations":["Query translation accuracy depends on AI model's understanding of security domain terminology","Complex multi-step attack scenarios may require multiple sequential queries rather than single natural language statement","No query optimization layer — generated Cypher may be less efficient than hand-crafted queries for large datasets"],"requires":["BloodHound 4.x+ with populated Neo4j database","FastMCP-compatible AI client (Claude, GPT-4, or other MCP-supporting LLM)","Python 3.8+","Neo4j database connection with BLOODHOUND_URI, BLOODHOUND_USERNAME, BLOODHOUND_PASSWORD environment variables"],"input_types":["natural language text queries","conversational security questions"],"output_types":["structured attack path data","relationship graphs","security analysis results","natural language explanations of findings"],"categories":["tool-use-integration","planning-reasoning"],"confidence":0.5,"matches":0,"success_rate":0},{"id":"awesome-bloodhound-mcp__cap_1","uri":"capability://planning.reasoning.attack.path.discovery.and.visualization.through.graph.traversal","name":"attack path discovery and visualization through graph traversal","description":"Executes specialized Cypher queries that traverse BloodHound's Active Directory graph to identify privilege escalation and lateral movement paths. The system implements graph traversal algorithms that discover multi-hop relationships between users, groups, computers, and resources, exposing attack chains that could lead to domain compromise. Results are returned as structured relationship data that can be visualized or analyzed programmatically.","intents":["Identify shortest attack paths from a compromised user to domain admin","Discover all possible privilege escalation routes in the domain","Find lateral movement opportunities between systems","Analyze which users pose the highest risk based on their position in the attack graph"],"best_for":["Red team operators conducting domain penetration tests","Blue team defenders performing security assessments","Security architects designing Active Directory hardening strategies"],"limitations":["Accuracy depends on completeness of BloodHound data collection — missing relationships will produce incomplete attack paths","Large domains with thousands of nodes may experience query latency for comprehensive path discovery","Does not account for temporal factors or time-based access controls","Cannot model attack paths requiring social engineering or credential theft outside of AD relationships"],"requires":["BloodHound 4.x+ with complete Active Directory enumeration data","Neo4j database with sufficient indexing on node properties for performance","Python 3.8+","Network connectivity to Neo4j bolt endpoint"],"input_types":["source entity (user, computer, group)","target entity (resource, group, computer)","optional path length constraints"],"output_types":["attack path chains (ordered lists of relationships)","relationship metadata (relationship types, properties)","node information (names, types, properties)"],"categories":["planning-reasoning","search-retrieval"],"confidence":0.5,"matches":0,"success_rate":0},{"id":"awesome-bloodhound-mcp__cap_10","uri":"capability://automation.workflow.environment.based.configuration.and.credential.management","name":"environment-based configuration and credential management","description":"Implements secure configuration management through environment variables for database connection parameters and credentials. The system reads BLOODHOUND_URI, BLOODHOUND_USERNAME, and BLOODHOUND_PASSWORD from the environment at startup, enabling flexible deployment across different environments without code changes. This approach supports containerized deployments, CI/CD pipelines, and secure credential handling through environment-based secrets management.","intents":["Configure BloodHound-MCP for different deployment environments","Manage database credentials securely without hardcoding","Enable containerized deployment with environment-based configuration","Support CI/CD pipelines with dynamic credential injection"],"best_for":["DevOps teams deploying BloodHound-MCP in containerized environments","Organizations requiring secure credential management","Teams managing multiple BloodHound instances across environments"],"limitations":["Environment variables visible in process listings and container inspection","No built-in credential rotation or expiration management","Requires external secrets management for production deployments","Default Neo4j URI (bolt://localhost:7687) assumes local database"],"requires":["Python 3.8+","Environment variables: BLOODHOUND_URI, BLOODHOUND_USERNAME, BLOODHOUND_PASSWORD","Secure environment variable management (secrets manager, CI/CD platform)"],"input_types":["environment variables"],"output_types":["configuration objects","database connection parameters"],"categories":["automation-workflow","safety-moderation"],"confidence":0.5,"matches":0,"success_rate":0},{"id":"awesome-bloodhound-mcp__cap_2","uri":"capability://data.processing.analysis.domain.and.organizational.unit.analysis.with.relationship.mapping","name":"domain and organizational unit analysis with relationship mapping","description":"Provides specialized tools for analyzing Active Directory domain structure, organizational units, group policies, and trust relationships. These tools execute Cypher queries that map domain topology, identify policy inheritance chains, and expose trust configurations that could be exploited. The system returns structured data about domain organization, group memberships, and inter-domain relationships.","intents":["Understand the organizational structure of a domain and its OUs","Identify group policy inheritance chains and potential policy conflicts","Analyze domain trust relationships and cross-domain attack vectors","Map group membership hierarchies to understand privilege distribution"],"best_for":["Security architects designing domain security policies","Auditors assessing domain configuration compliance","Incident responders understanding domain structure during investigations"],"limitations":["Requires complete BloodHound enumeration including all OUs and group policies","Does not analyze group policy content or enforcement — only relationships","Cannot detect policy conflicts or misconfigurations without additional analysis tools","Trust relationship analysis limited to what BloodHound collects (may miss external trusts)"],"requires":["BloodHound 4.x+ with domain enumeration data","Python 3.8+","Neo4j database connection"],"input_types":["domain name","organizational unit names","group names"],"output_types":["domain structure hierarchy","group membership lists","trust relationship data","policy inheritance chains"],"categories":["data-processing-analysis","search-retrieval"],"confidence":0.5,"matches":0,"success_rate":0},{"id":"awesome-bloodhound-mcp__cap_3","uri":"capability://safety.moderation.authentication.security.vulnerability.detection.and.analysis","name":"authentication security vulnerability detection and analysis","description":"Executes specialized Cypher queries to identify authentication-related security misconfigurations and vulnerabilities in Active Directory. This includes detection of weak authentication mechanisms (NTLM, Kerberos weaknesses), unconstrained delegation, resource-based constrained delegation misconfigurations, and accounts with dangerous properties. The system returns structured data about vulnerable authentication paths and configurations.","intents":["Find accounts configured with unconstrained delegation that could be exploited","Identify computers accepting NTLM authentication that could be vulnerable to relay attacks","Discover resource-based constrained delegation misconfigurations","Locate accounts with dangerous properties like 'Do Not Require Kerberos Preauthentication'"],"best_for":["Security teams focused on authentication hardening","Penetration testers identifying Kerberos and NTLM attack vectors","Compliance auditors assessing authentication security controls"],"limitations":["Detection limited to misconfigurations that BloodHound collects — runtime authentication behavior not analyzed","Cannot detect all authentication vulnerabilities (e.g., weak password policies require separate tools)","Delegation analysis depends on accurate BloodHound enumeration of delegation settings","Does not perform active authentication testing or credential validation"],"requires":["BloodHound 4.x+ with authentication configuration data","Python 3.8+","Neo4j database connection"],"input_types":["account names","computer names","optional authentication mechanism filters"],"output_types":["vulnerable account lists","delegation configuration data","authentication weakness assessments","risk severity ratings"],"categories":["safety-moderation","data-processing-analysis"],"confidence":0.5,"matches":0,"success_rate":0},{"id":"awesome-bloodhound-mcp__cap_4","uri":"capability://safety.moderation.pki.and.certificate.based.attack.analysis","name":"pki and certificate-based attack analysis","description":"Provides tools for analyzing Public Key Infrastructure configurations and certificate-based attack vectors in Active Directory environments. These tools execute Cypher queries to identify certificate templates with dangerous configurations, certificate authority relationships, and potential certificate-based privilege escalation paths. The system returns structured data about PKI vulnerabilities and exploitation chains.","intents":["Identify certificate templates with dangerous configurations that could enable privilege escalation","Analyze certificate authority trust relationships and potential compromise paths","Discover accounts that can enroll in vulnerable certificate templates","Find certificate-based privilege escalation opportunities"],"best_for":["Security teams assessing PKI security posture","Penetration testers identifying certificate-based attack vectors","PKI administrators auditing certificate template configurations"],"limitations":["Requires BloodHound with PKI data collection (requires specific enhancements)","Cannot validate certificate validity or expiration without additional tools","Does not analyze certificate revocation lists or OCSP configurations","Limited to Active Directory-integrated PKI analysis"],"requires":["BloodHound 4.x+ with PKI enumeration data","Python 3.8+","Neo4j database connection"],"input_types":["certificate template names","certificate authority names","account names"],"output_types":["vulnerable certificate template lists","enrollment privilege data","privilege escalation paths","PKI relationship graphs"],"categories":["safety-moderation","data-processing-analysis"],"confidence":0.5,"matches":0,"success_rate":0},{"id":"awesome-bloodhound-mcp__cap_5","uri":"capability://safety.moderation.ntlm.relay.and.network.based.attack.vector.analysis","name":"ntlm relay and network-based attack vector analysis","description":"Executes specialized Cypher queries to identify NTLM relay vulnerabilities and network-based attack opportunities in Active Directory environments. These tools analyze which systems accept NTLM authentication, identify signing and sealing requirements, and map potential relay targets. The system returns structured data about NTLM relay risks and network attack paths.","intents":["Identify computers that accept NTLM authentication and could be relay targets","Find systems with NTLM signing disabled that are vulnerable to relay attacks","Analyze which accounts could be compromised through NTLM relay chains","Discover network-based privilege escalation opportunities"],"best_for":["Network security teams assessing NTLM exposure","Penetration testers identifying relay attack vectors","Security architects planning NTLM deprecation strategies"],"limitations":["Analysis limited to BloodHound-collected NTLM configuration data","Does not perform active NTLM relay testing or network traffic analysis","Cannot detect all relay vulnerabilities without network-level monitoring","Requires accurate enumeration of NTLM signing and sealing settings"],"requires":["BloodHound 4.x+ with NTLM configuration data","Python 3.8+","Neo4j database connection"],"input_types":["computer names","service names","optional NTLM configuration filters"],"output_types":["relay target lists","NTLM configuration data","relay chain analysis","risk assessments"],"categories":["safety-moderation","data-processing-analysis"],"confidence":0.5,"matches":0,"success_rate":0},{"id":"awesome-bloodhound-mcp__cap_6","uri":"capability://safety.moderation.hybrid.cloud.and.azure.active.directory.integration.analysis","name":"hybrid cloud and azure active directory integration analysis","description":"Provides tools for analyzing security implications of hybrid cloud environments where on-premises Active Directory is synchronized with Azure Active Directory. These tools execute Cypher queries to identify cross-environment attack paths, Azure AD Connect compromise risks, and privilege escalation opportunities spanning on-premises and cloud environments. The system returns structured data about hybrid environment vulnerabilities.","intents":["Identify attack paths that span on-premises AD and Azure AD","Analyze Azure AD Connect security and potential compromise scenarios","Discover privilege escalation opportunities in hybrid environments","Assess cloud-to-on-premises attack vectors"],"best_for":["Organizations with hybrid cloud deployments","Security teams managing both on-premises and cloud identities","Penetration testers assessing hybrid environment security"],"limitations":["Requires BloodHound with Azure AD enumeration capabilities","Analysis limited to relationships that BloodHound collects","Does not analyze Azure-specific security controls or policies","Cannot detect cloud-only attack vectors without Azure-specific tools"],"requires":["BloodHound 4.x+ with Azure AD enumeration data","Python 3.8+","Neo4j database connection"],"input_types":["on-premises account names","Azure AD account names","optional environment filters"],"output_types":["cross-environment attack paths","Azure AD Connect risk assessments","hybrid privilege escalation chains","environment synchronization data"],"categories":["safety-moderation","data-processing-analysis"],"confidence":0.5,"matches":0,"success_rate":0},{"id":"awesome-bloodhound-mcp__cap_7","uri":"capability://tool.use.integration.mcp.server.hosting.and.tool.registry.management","name":"mcp server hosting and tool registry management","description":"Implements a FastMCP server that hosts and manages the 75+ specialized security analysis tools through the Model Context Protocol. The server handles tool registration, parameter validation, execution orchestration, and result formatting. It provides a standardized interface that allows any MCP-compatible AI client to discover and invoke security analysis tools without direct Neo4j knowledge. The server manages database connections, error handling, and response serialization.","intents":["Enable AI clients to discover available security analysis tools through MCP protocol","Provide standardized tool invocation interface for security analysis","Manage database connections and query execution on behalf of AI clients","Serialize and format security analysis results for AI consumption"],"best_for":["Developers integrating BloodHound analysis into AI-assisted security workflows","Organizations deploying BloodHound analysis through MCP-compatible AI platforms","Security teams building custom AI agents for Active Directory analysis"],"limitations":["MCP protocol overhead adds latency compared to direct Neo4j queries","Tool registry is static at server startup — cannot dynamically add tools without restart","Error handling and timeout management depend on MCP client implementation","No built-in rate limiting or query throttling for resource protection"],"requires":["Python 3.8+","FastMCP framework","Neo4j database with BloodHound data","MCP-compatible AI client (Claude, GPT-4, or other LLM with MCP support)","Environment variables: BLOODHOUND_URI, BLOODHOUND_USERNAME, BLOODHOUND_PASSWORD"],"input_types":["MCP tool invocation requests","tool parameters (strings, lists, optional filters)"],"output_types":["MCP tool results","structured JSON responses","error messages with diagnostic information"],"categories":["tool-use-integration","automation-workflow"],"confidence":0.5,"matches":0,"success_rate":0},{"id":"awesome-bloodhound-mcp__cap_8","uri":"capability://data.processing.analysis.neo4j.graph.database.connection.and.query.execution","name":"neo4j graph database connection and query execution","description":"Manages connections to the Neo4j graph database containing BloodHound data and executes Cypher queries through the Neo4j Python driver. The system handles connection pooling, authentication, query parameterization, and result processing. It provides a reliable interface for executing security analysis queries against the graph database while managing connection lifecycle and error handling.","intents":["Execute Cypher queries against BloodHound's Neo4j database","Manage database connections and connection pooling","Handle authentication and credential management securely","Process and format query results for tool consumption"],"best_for":["Developers building security analysis tools on top of BloodHound","Organizations deploying BloodHound analysis at scale","Security teams requiring reliable database access for automated analysis"],"limitations":["Performance depends on Neo4j database configuration and indexing","Large result sets may consume significant memory","No built-in query optimization or caching layer","Connection credentials stored in environment variables — requires secure credential management"],"requires":["Neo4j 4.x+ database instance","Neo4j Python driver","Python 3.8+","Network connectivity to Neo4j bolt endpoint","Environment variables: BLOODHOUND_URI (default: bolt://localhost:7687), BLOODHOUND_USERNAME, BLOODHOUND_PASSWORD"],"input_types":["Cypher query strings","query parameters (dictionaries)"],"output_types":["Neo4j result records","structured data (lists, dictionaries)","error information"],"categories":["data-processing-analysis","tool-use-integration"],"confidence":0.5,"matches":0,"success_rate":0},{"id":"awesome-bloodhound-mcp__cap_9","uri":"capability://planning.reasoning.conversational.security.analysis.through.ai.assisted.reasoning","name":"conversational security analysis through ai-assisted reasoning","description":"Enables security professionals to conduct multi-turn conversations with an AI agent that understands Active Directory security concepts and can reason about attack scenarios. The AI agent uses the MCP tool registry to select appropriate security analysis tools, interpret results, and provide contextual security insights. This capability transforms BloodHound analysis from a query-response interaction into a collaborative investigation where the AI can ask clarifying questions, suggest additional analysis, and synthesize findings.","intents":["Conduct multi-turn conversations about Active Directory security posture","Ask follow-up questions about attack paths and vulnerabilities","Receive AI-generated security recommendations based on analysis results","Explore 'what-if' scenarios for security hardening decisions"],"best_for":["Security professionals seeking AI-assisted Active Directory analysis","Red teams conducting collaborative attack planning","Security architects evaluating hardening strategies with AI guidance"],"limitations":["AI reasoning quality depends on model capability and security domain knowledge","Conversational context limited by AI model's context window","AI may make incorrect security assumptions or recommendations without expert review","No built-in fact-checking or validation of AI-generated insights"],"requires":["MCP-compatible AI client with security domain knowledge","BloodHound-MCP server running and accessible","Neo4j database with BloodHound data","User expertise to validate AI recommendations"],"input_types":["natural language security questions","conversational follow-ups","scenario descriptions"],"output_types":["natural language analysis and insights","security recommendations","attack scenario explanations","risk assessments"],"categories":["planning-reasoning","text-generation-language"],"confidence":0.5,"matches":0,"success_rate":0}],"trust":{"score":32,"verified":false,"data_access_risk":"high","permissions":["BloodHound 4.x+ with populated Neo4j database","FastMCP-compatible AI client (Claude, GPT-4, or other MCP-supporting LLM)","Python 3.8+","Neo4j database connection with BLOODHOUND_URI, BLOODHOUND_USERNAME, BLOODHOUND_PASSWORD environment variables","BloodHound 4.x+ with complete Active Directory enumeration data","Neo4j database with sufficient indexing on node properties for performance","Network connectivity to Neo4j bolt endpoint","Environment variables: BLOODHOUND_URI, BLOODHOUND_USERNAME, BLOODHOUND_PASSWORD","Secure environment variable management (secrets manager, CI/CD platform)","BloodHound 4.x+ with domain enumeration data"],"failure_modes":["Query translation accuracy depends on AI model's understanding of security domain terminology","Complex multi-step attack scenarios may require multiple sequential queries rather than single natural language statement","No query optimization layer — generated Cypher may be less efficient than hand-crafted queries for large datasets","Accuracy depends on completeness of BloodHound data collection — missing relationships will produce incomplete attack paths","Large domains with thousands of nodes may experience query latency for comprehensive path discovery","Does not account for temporal factors or time-based access controls","Cannot model attack paths requiring social engineering or credential theft outside of AD relationships","Environment variables visible in process listings and container inspection","No built-in credential rotation or expiration management","Requires external secrets management for production deployments","builder identity is not verified yet","no observed match outcomes yet"],"rank_breakdown":{"adoption":0.05,"quality":0.47,"ecosystem":0.49999999999999994,"match_graph":0.25,"freshness":0.52,"weights":{"adoption":0.25,"quality":0.25,"ecosystem":0.15,"match_graph":0.23,"freshness":0.12}},"observed_outcomes":{"matches":0,"success_rate":0,"avg_confidence":0,"top_intents":[],"last_matched_at":null},"maintenance":{"status":"active","updated_at":"2026-06-17T09:51:02.371Z","last_scraped_at":"2026-05-03T14:00:15.503Z","last_commit":null},"community":{"stars":null,"forks":null,"weekly_downloads":null,"model_downloads":null,"model_likes":null}},"distribution":{"claim_url":"https://unfragile.ai/submit?claim=bloodhound-mcp","compare_url":"https://unfragile.ai/compare?artifact=bloodhound-mcp"}},"signature":"a2PTLpEboUsmnwPOIfev7IjHsIPuAu/tx0LbeT2SRiWLtEaQdMot9BsqiyR7tdCThhaUU36xc8ohg+492QKdBQ==","signedAt":"2026-06-21T17:09:11.057Z","signedBy":"unfragile.ai","version":1},"_links":{"self":"https://unfragile.ai/api/v1/passport/bloodhound-mcp","artifact":"https://unfragile.ai/bloodhound-mcp","verify":"https://unfragile.ai/api/v1/verify?slug=bloodhound-mcp","publicKey":"https://unfragile.ai/api/v1/trust-passport-public-key","spec":"https://unfragile.ai/trust","schema":"https://unfragile.ai/schema.json","docs":"https://unfragile.ai/docs"}}