The BloodHound MCP server enables natural language interaction with Active Directory and Azure Active Directory environments using Large Language Models, allowing for complex queries and analysis without manual Cypher scripting.
Capabilities include:
Natural Language Queries: Perform AD/AAD queries using conversational commands
Execute Raw Cypher database queries
List AD Objects: Query users, computers, groups, domains, trusts, GPOs, network shares, and certificate templates based on various attributes
Identify Vulnerabilities: Find users vulnerable to AS-REP roasting, Kerberoasting, or with dangerous rights
Security Analysis: Identify privileged users, dangerous permissions, high-value targets, and vulnerable certificate templates (ESC1-ESC8)
Attack Path Routing: Map paths between objects based on permissions, sessions, or relationships
Azure Integration: Analyze Azure environments, list AAD groups synchronized with AD, and find paths to Azure VMs or Global Administrators (requires AzureHound)
Session Analysis: List and route based on active user sessions (requires sessions data)
Integrates with Neo4j database to store and query BloodHound data about Active Directory and Azure Active Directory environments, enabling natural language queries for security analysis without writing Cypher queries directly.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@BloodHound MCP show me all users with admin privileges in the domain"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
BloodHound MCP (Model Context Protocol) is an innovative extension of the BloodHound tool, designed to enable Large Language Models (LLMs) to interact with and analyze Active Directory (AD) and Azure Active Directory (AAD) environments through natural language queries. By leveraging the power of LLMs, BloodHound MCP allows users to perform complex queries and retrieve insights from their AD/AAD environments using simple, conversational commands.
Natural Language Queries: Use conversational language to query your AD/AAD environment without needing to write Cypher queries manually.
LLM-Powered Analysis: Harness the capabilities of Large Language Models to interpret and execute queries on your behalf.
Seamless Integration: Works with existing BloodHound data stored in Neo4j, providing a user-friendly interface for complex analysis.
Customizable: Easily configure the system to work with your specific environment and tools.
Related MCP server: BloodHound MCP Server
{
"mcpServers": {
"BloodHound": {
"name": "BloodHound",
"isActive": true,
"command": "uv",
"args": [
"run",
"--with",
"mcp[cli],neo4j",
"mcp",
"run",
"<PATH_TO_THE_PROJECT>server.py"
],
"env": {
"BLOODHOUND_URI": "bolt://localhost:7687",
"BLOODHOUND_USERNAME": "neo4j",
"BLOODHOUND_PASSWORD": "bloodhound"
}
}
}
}
To customize BloodHound MCP, update the configuration file in your MCP-supported tool. Key settings include:
Neo4j Database Connection:
BLOODHOUND_URI: The URI of your Neo4j database (e.g., bolt://localhost:7687).
BLOODHOUND_USERNAME: Your Neo4j username.
BLOODHOUND_PASSWORD: Your Neo4j password.
Server Settings: Adjust the command and args to match your environment and tool requirements.
We welcome contributions to BloodHound MCP! To get involved:
Fork the Repository: Create your own copy on GitHub.
Create a Branch: Work on your feature or fix in a new branch.
Submit a Pull Request: Include a clear description of your changes.
Custom queries from : https://github.com/CompassSecurity/BloodHoundQueries
[WIP] Computers with Most Sessions [Required: sessions]
Inputs: domain (required).
Find all enabled AS-REP roastable user(s)
Inputs: domain (required).
Find all enabled kerberoastable user(s)
Inputs: domain (required).
Find allshortestpaths with DCSync to domain object
Inputs: domain (required).
Find allshortestpaths with Shadow Credential permission to principal(s)
Inputs: domain (required).
Owned: [WIP] Find all Owners of Azure Applications with Owners to Service Principals with Dangerous Rights (Required: azurehound)
Inputs: domain (required).
Find enabled Certificate Template(s) [Required: Certipy]
Inputs: domain (required).
Owned: [WIP] Find all owned user with privileged access to Azure Tenancy (Required: azurehound)
Inputs: domain (required).
Owned: [WIP] Find all owned user where group membership grants privileged access to Azure Tenancy (Required: azurehound)
Inputs: domain (required).
Find allshortestpaths with dangerous rights to AdminSDHolder object
Inputs: domain (required).
[WIP] List all AAD Group(s) that are synchronized with AD (Required: azurehound)
Inputs: no named parameters.
[WIP] List all AD principal(s) with edge(s) to Azure principal(s) (Required: azurehound)
Inputs: no named parameters.
List all "Authenticated Users" group membership(s)
Inputs: domain (required).
List all Certificate Template(s) [Required: Certipy]
Inputs: domain (required).
List all cross-domain user session(s) and user group membership(s)
Inputs: domain (required).
List all "Domain Users" group membership(s)
Inputs: domain (required).
List all enabled Azure User(s) (Required: azurehound)
Inputs: no named parameters.
List all enabled Azure User(s) Azure Group membership(s) (Required: azurehound)
Inputs: no named parameters.
List all enabled user(s) that logged in within the last 90 days
Inputs: domain (required).
List all enabled user(s) but never logged in
Inputs: domain (required).
List all enabled user(s) that set password within the last 90 days
Inputs: domain (required).
List all enabled user(s) with foreign group membership
Inputs: domain (required).
List all enabled user(s) with "don't require passwords" attribute
Inputs: domain (required).
List all enabled user(s) with "password never expires" attribute
Inputs: domain (required).
List all enabled user(s) with "userpassword" attribute
Inputs: domain (required).
[WIP] List all Enrollment Right(s) for Certificate Template(s)
Inputs: domain (required).
List all GPO(s)
Inputs: domain (required).
List all group(s)
Inputs: domain (required).
List all owned computer(s)
Inputs: domain (required).
List all owned & enabled user(s)
Inputs: domain (required).
List all owned & enabled user(s) with an email address
Inputs: domain (required).
List all owned & enabled user(s) with "RDP" permission, and any active sessions and their group membership(s)
Inputs: domain (required).
List all owned & enabled user(s) with "SQLAdmin" permission
Inputs: domain (required).
List all owned user(s)
Inputs: domain (required).
[WIP] List all principal(s) used for syncing AD and AAD
Inputs: no named parameters.
List all principal(s) with "Local Admin" permission
Inputs: domain (required).
List all principal(s) with "RDP" permission
Inputs: domain (required).
List all principal(s) with "SQLAdmin" permission
Inputs: domain (required).
List all Tenancy (Required: azurehound)
Inputs: no named parameters.
List all user session(s) [Required: sessions]
Inputs: domain (required).
List all user(s) with description field
Inputs: domain (required).
List Certificate Authority server(s) [Required: Certipy]
Inputs: domain (required).
List computer(s) WITHOUT LAPS
Inputs: domain (required).
List custom privileged group(s)
Inputs: domain (required).
List domain computer(s)
Inputs: domain (required).
List domain controller(s)
Inputs: domain (required).
List domain(s)
Inputs: no named parameters.
List domain trust(s)
Inputs: no named parameters.
List enabled non-privileged user(s) with "Local Admin" permission
Inputs: domain (required).
List enabled non-privileged user(s) with "RDP" permission
Inputs: domain (required).
List enabled non-privileged user(s) with "RDP" permission, and any active sessions and their group membership(s)
Inputs: domain (required).
List enabled non-privileged user(s) with "SQLAdmin" permission
Inputs: domain (required).
List enabled principal(s) with "Constrained Delegation"
Inputs: domain (required).
List enabled principal(s) with "Unconstrained Delegation"
Inputs: domain (required).
List enabled user(s)
Inputs: domain (required).
List all enabled user(s) with "password never expires" attribute and not changed in last year
Inputs: domain (required).
List enabled user(s) with an email address
Inputs: domain (required).
List all enabled SVC account(s) with privileged group membership(s)
Inputs: domain (required).
List ESC1 vulnerable Certificate Template(s) [Required: Certipy]
Inputs: domain (required).
List ESC2 vulnerable Certificate Template(s) [Required: Certipy]
Inputs: domain (required).
List ESC3 vulnerable Certificate Template(s) [Required: Certipy]
Inputs: domain (required).
List ESC4 vulnerable Certificate Template(s) [Required: Certipy]
Inputs: domain (required).
List ESC6 vulnerable Certificate Template(s) [Required: Certipy]
Inputs: domain (required).
List ESC7 vulnerable Certificate Template(s) [Required: Certipy]
Inputs: domain (required).
List ESC8 vulnerable Certificate Template(s) [Required: Certipy]
Inputs: domain (required).
List high value target(s)
Inputs: domain (required).
List non-managed service account(s)
Inputs: domain (required).
List enabled non-privileged user(s) with "Local Admin" permission, and any active sessions and their group membership(s)
Inputs: domain (required).
List all owned & enabled user(s) with "Local Admin" permission, and any active sessions and their group membership(s)
Inputs: domain (required).
[WIP] List all principal(s) with privileged access to Azure Tenancy (Required: azurehound)
Inputs: no named parameters.
List privileged user(s) without "Protected Users" group membership
Inputs: domain (required).
[WIP] List privileges for Certificate Authority server(s) [Required: Certipy]
Inputs: domain (required).
List non-privileged user(s) with dangerous permissions to any node type
Inputs: domain (required).
Route all owned & enabled group membership(s)
Inputs: domain (required).
Route all owned & enabled non-privileged group(s) membership
Inputs: domain (required).
Route all owned & enabled privileged group(s) membership
Inputs: domain (required).
Route all sessions to computers (Required: sessions)
Inputs: domain (required).
Route all sessions to computers WITHOUT LAPS (Required: sessions)
Inputs: domain (required).
[WIP] Route from Azure User principal(s) that have dangerous rights to Azure User and User principal(s) (Required: azurehound)
Inputs: no named parameters.
Route from owned & enabled principals to high value target(s)
Inputs: domain (required).
Route non-privileged computer(s) with dangerous rights to computer(s) [HIGH RAM]
Inputs: domain (required).
Route non-privileged computer(s) with dangerous rights to GPO(s) [HIGH RAM]
Inputs: domain (required).
Route non-privileged computer(s) with dangerous rights to group(s) [HIGH RAM]
Inputs: domain (required).
Route non-privileged computer(s) with dangerous rights to privileged node(s) [HIGH RAM]
Inputs: domain (required).
Route non-privileged computer(s) with dangerous rights to user(s) [HIGH RAM]
Inputs: domain (required).
Route non-privileged user(s) with dangerous permissions to any node type
Inputs: domain (required).
Route non-privileged user(s) with dangerous rights to GPO(s) [HIGH RAM]
Inputs: domain (required).
Route non-privileged user(s) with dangerous rights to user(s) [HIGH RAM]
Inputs: domain (required).
Route non-privileged user(s) with dangerous rights to computer(s) [HIGH RAM]
Inputs: domain (required).
Route non-privileged user(s) with dangerous rights to privileged node(s) [HIGH RAM]
Inputs: domain (required).
Route non-privileged user(s) with dangerous rights to group(s) [HIGH RAM]
Inputs: domain (required).
Route all owned & enabled user(s) with Dangerous Rights to any node type
Inputs: domain (required).
Route all owned & enabled user(s) with Dangerous Rights to group(s)
Inputs: domain (required).
Route all owned & enabled user(s) with Dangerous Rights to user(s)
Inputs: domain (required).
Route from owned & enabled user(s) to all principals with "Unconstrained Delegation"
Inputs: domain (required).
[WIP] Route all principal(s) that have control permissions to Azure Application(s) running as Azure Service Principals (AzSP), and route from privileged ASP to Azure Tenancy (Required: azurehound)
Inputs: no named parameters.
[WIP] Route from principal(s) to Azure VM (Required: azurehound)
Inputs: no named parameters.
[WIP] Route from principal(s) to principal(s) with Global Administrator permissions (Required: azurehound)
Inputs: no named parameters.
Route all privileged user(s) with sessions to non-privileged computer(s) [Required: sessions]
Inputs: domain (required).
[WIP] Route all user principal(s) that have control permissions to Azure Service Principals (AzSP), and route from AzSP to principal(s) (Required: azurehound)
Inputs: no named parameters.
執行Cypher查詢並返回結果
Args: query: Cypher查詢字符串 parameters: 查詢參數字典
Returns: 查詢結果列表
Inputs: query (required), parameters.
[WIP] Users with most cross-domain sessions [Required: sessions]
Inputs: domain (required).
[WIP] Users with Most Local Admin Rights
Inputs: domain (required).
[WIP] Users with Most Sessions [Required: sessions]
Inputs: domain (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 106 tools
Many tools have overlapping purposes and unclear boundaries, causing significant ambiguity. For example, there are multiple 'list' tools for similar user attributes (e.g., list_enabled_users_with_password_never_expires vs list_enabled_users_pwd_never_expires_unchanged_1yr) and numerous 'route' tools with similar dangerous rights targeting different node types, making it difficult for an agent to distinguish between them without deep domain knowledge.
The naming is mixed with some consistency but notable deviations. Most tools follow a verb_noun pattern (e.g., list_all_gpos, find_all_enabled_as_rep_roastable_users), but there are inconsistencies like abbreviations (e.g., list_own_en_usrs_local_adm_sess), varying verb styles (find vs list vs route), and occasional use of underscores inconsistently, reducing predictability.
With 106 tools, the count is excessive and feels heavy for the domain of BloodHound (security analysis and Active Directory/Azure reconnaissance). This large number suggests over-fragmentation and redundancy, making it overwhelming for agents to navigate and likely including many tools that could be consolidated or parameterized.
The tool set appears highly complete for the BloodHound domain, covering a wide range of security analysis tasks such as listing, finding, and routing across users, groups, computers, certificates, and Azure resources. There are minor gaps (e.g., some tools marked as [WIP] or requiring specific data like sessions or azurehound), but overall, it provides extensive coverage for attack path discovery and privilege escalation scenarios.
A private graph database you query in plain English or Cypher. Hosted, nothing to install.
Official Microsoft MCP Server to query Microsoft Entra data using natural language
Query and retrieve information about various adversarial tactics and techniques used in cyber atta…