bloodhound
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| BH_LANG | No | Response language (auto/fr/en) | auto |
| BH_AUDIT | No | Log queries to runs/audit.log (0/1) | 1 |
| BH_MODEL | No | Claude model to use | sonnet |
| NEO4J_URI | No | Neo4j connection URI | bolt://localhost:7687 |
| NEO4J_USER | No | Neo4j username | neo4j |
| BH_MAX_ROWS | No | Maximum number of rows to return | 1000 |
| BH_SHOW_ROWS | No | Display raw rows as table (0/1) | 0 |
| NEO4J_PASSWORD | No | Neo4j password | bloodhoundcommunityedition |
| BH_QUERY_TIMEOUT | No | Query timeout in seconds | 30 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| get_schemaA | List node labels, relationship types and property keys with per-label counts. |
| run_cypherA | Run a READ-ONLY Cypher query. Writes and procedure CALLs are rejected. Prefer the dedicated tools. |
| search_objectA | Find objects whose name/objectid contains a term. Optional label (User|Computer|Group|Domain|GPO|OU|Container|AZ*). |
| node_detailsA | Full properties of a node (by name or objectid) plus inbound/outbound edge counts by type. |
| security_profileA | Security triage of a principal (by name or objectid): attributes, memberships, who controls it, tier-0 distance. |
| shortest_pathA | Shortest attack path between two nodes (by name/objectid). Only abusable edges by default; include_structural to traverse all. |
| paths_to_tier0B | Shortest attack paths from a principal to any tier-0 object (Domain Admins / tier-0). |
| blast_radiusC | What a principal can reach through abusable edges within N hops. |
| mark_ownedA | Mark a principal (by name/objectid) as attacker-owned (stored app-side, not written to the DB). |
| list_ownedA | List principals currently marked as owned. |
| paths_from_ownedB | Shortest attack paths from any owned principal to tier-0. |
| kerberoastableC | Enabled users with an SPN (Kerberoastable). (requête vérifiée) |
| asrep_roastableC | Enabled users that do not require Kerberos pre-auth (AS-REP roastable). (requête vérifiée) |
| dcsyncC | Principals that can DCSync a domain (GetChanges + GetChangesAll). (requête vérifiée) |
| unconstrained_delegationC | Users AND computers configured for unconstrained delegation. (requête vérifiée) |
| constrained_delegationC | Principals with constrained delegation and their allowed targets. (requête vérifiée) |
| rbcdC | Resource-based constrained delegation (AllowedToAct). (requête vérifiée) |
| can_read_lapsC | Principals that can read LAPS passwords, and on which computers. (requête vérifiée) |
| can_read_gmsaC | Principals that can read gMSA passwords. (requête vérifiée) |
| tier_zeroD | Tier-0 objects (CE label Tag_Tier_Zero). (requête vérifiée) |
| domain_adminsC | Members (direct + nested) of every Domain Admins group. (requête vérifiée) |
| domain_controllersC | Domain Controllers (members of the -516 group). (requête vérifiée) |
| domain_trustsD | Trust relationships between domains. (requête vérifiée) |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 23 tools
Each tool targets a distinct operation: generic graph access (get_schema, run_cypher, search_object, node_details), prebuilt vulnerability queries (kerberoastable, dcsync, rbcd, etc.), path analysis (shortest_path, paths_to_tier0, blast_radius), and ownership tracking (mark_owned, list_owned, paths_from_owned). Even related path tools differ in starting point and goal, so no two tools are easily confused.
All names use snake_case and are short, but the pattern is mixed: some are verb-led (get_schema, search_object, mark_owned), others are noun-led or technique names (domain_admins, kerberoastable, dcsync). This is a minor deviation from a strict verb_noun convention, but it remains readable and predictable within the BloodHound domain.
With 23 tools, the server is on the heavier side of the ideal range, but BloodHound's broad feature set (generic queries, attack paths, delegation checks, ownership) justifies the count. Each tool serves a distinct, practical purpose without redundant entries.
The server covers core BloodHound workflows: arbitrary read-only queries, node lookups, common attack vector detection, path analysis, and owned-object management. Some expected operations like direct group membership listing or session hunting are absent, but run_cypher allows agents to work around these gaps, so the surface is not severely incomplete.