Skip to main content
Glama

BloodHound Enterprise MCP

License: GPL v3

A Model Context Protocol (MCP) server that connects LLMs to BloodHound Enterprise. Ask questions in natural language, get attack path analysis, run Cypher queries, and explore Active Directory, Azure/Entra ID, and OpenGraph environments — all from your AI assistant.

Fork Attribution

This project is a fork of mwnickerson/bloodhound_mcp. The original project and its contributors created the BloodHound MCP foundation this fork builds on.

This fork modifies the original BloodHound Community Edition-focused implementation for BloodHound Enterprise API coverage, multi-tenant MCP configuration, expanded endpoint wrappers, Enterprise attack path/risk posture workflows, and BHE-specific documentation. The project remains licensed under GPL-3.0; see LICENSE and NOTICE.


Related MCP server: PentestMCP

How It Works

The server exposes BloodHound Enterprise's REST API and Neo4j graph through a set of composite MCP tools, reference resources, and a system prompt tuned for offensive security analysis.

Composite Tools

Each tool uses an info_type parameter to select what data is returned, keeping the tool surface small and token-efficient:

Tool

info_type Options

domain_info

list, info, search, users, groups, computers, controllers, gpos, ous, dc_syncers, foreign_admins, foreign_gpo_controllers, foreign_groups, foreign_users, inbound_trusts, outbound_trusts, linked_gpos, adcs_escalations

entity_info

base_info, base_controllables, base_controllers, container_info, container_controllers, azure_entity

user_info

info, sessions, memberships, admin_rights, rdp_rights, dcom_rights, ps_remote_rights, sql_admin_rights, constrained_delegation, controllables, controllers

group_info

info, members, memberships, admin_rights, rdp_rights, dcom_rights, ps_remote_rights, controllers, controllables

computer_info

info, sessions, local_admins, rdp_rights, dcom_rights, ps_remote_rights, sql_admins, constrained_delegation, controllables, controllers

ou_info

info, users, groups, computers, gpos

gpo_info

info, computers, controllers, ous, tier_zeros, users

graph_analysis

kinds, search, shortest_path, edge_composition, relay_targets, pathfinding, acl_inheritance

adcs_info

cert_template_info, cert_template_controllers, cert_template_published_to_cas, root_ca_info, root_ca_controllers, root_ca_pki_hierarchy, enterprise_ca_info, enterprise_ca_controllers, enterprise_ca_pki_hierarchy, enterprise_ca_published_templates, aia_ca_info, aia_ca_controllers, aia_ca_pki_hierarchy, nt_auth_store_info, nt_auth_store_controllers, nt_auth_store_trusted_cas

cypher_query

run, interpret, list_saved, create_saved, get_saved, update_saved, delete_saved, share_saved, saved_permissions, export_saved, import_saved, export_saved_many, validate

attack_paths

domain_findings, finding_trends, types, start_analysis, details, domain_available_types, domain_details, domain_sparkline, acceptance

risk_posture

stats, history

enterprise_info

version, spec, audit, config, features

enterprise_admin

self, permissions, permission, roles, role, users, users_minimal, user, saml, saml_sso, saml_provider, sso_providers, sso_signing_certificate

data_quality

completeness, ad_domain, azure_tenant, platform

asset_groups

list, get, create, update, delete, collections, custom_selectors, members, member_counts, combo_node, create_selectors, update_selectors, delete_selector, list_tags, create_tag, tag_members, tag_member_selectors, tag_member_counts, tag_selectors, tag_selector_members, tag_selector_member_counts, preview_tag_selectors, search_tags, tag_history, search_tag_history, certifications, update_certifications

custom_nodes

list, get, create, update, delete, validate_icon, extension_list, extension_upsert, extension_delete, extension_edges

file_upload

upload, start_job, upload_to_job, end_job, list_jobs, completed_tasks, accepted_types

operations_info

datapipe_status, analysis, meta_nodes, meta_tree, meta_entity

collection_info

collector_manifest, collector_checksum, kennel_manifest, kennel_enterprise_manifest, clients, client, client_completed_tasks, client_completed_jobs, jobs_available, jobs_finished, jobs, job_current, job, job_log, tasks_available, tasks_finished, tasks, task_current, task, task_log, events, event

Resources

Reference material the LLM loads on demand — no extra API calls:

Resource URI

Contents

bloodhound://cypher/reference

Cypher syntax, schema, property names, patterns

bloodhound://cypher/query-building-reference

Quick query-building syntax patterns

bloodhound://cypher/supported-syntax

Supported BloodHound Cypher syntax, caveats, and unsupported constructs

bloodhound://cypher/offensive-queries

Battle-tested templates: DCSync, Kerberoasting, GPO abuse, delegation, ADCS, shadow credentials, NTLM relay, and more

bloodhound://guides/ad

AD node types and relationships quick reference

bloodhound://guides/ad-methodology

Full AD attack methodology and workflow

bloodhound://guides/azure

Azure/Entra ID analysis quick reference

bloodhound://guides/azure-methodology

Full Azure attack chains

bloodhound://guides/adcs

ADCS ESC1–ESC13 quick reference

bloodhound://guides/adcs-methodology

Detailed ESC analysis and exploitation

bloodhound://opengraph/guide

Custom node schema design and best practices

bloodhound://opengraph/examples

SQL Server and Web App OpenGraph examples

System Prompt

The bloodhound_assistant prompt includes behavioral rules that guide the LLM:

  • Load the offensive query library before writing Cypher for any attack scenario

  • Never draw privilege conclusions without checking group memberships and admincount

  • Respect BloodHound's property naming conventions (hasspn, enabled, admincount — all lowercase)

  • Handle uppercase name storage (DOMAIN ADMINS@CORP.LOCAL) correctly in filters

  • Follow proper DCSync and GPO edge traversal patterns


Prerequisites

  • Python 3.11+

  • uv

  • BloodHound Enterprise instance with data loaded

  • BloodHound API credentials (Token ID + Token Key)


Installation

git clone https://github.com/mwnickerson/bloodhound_mcp.git ~/git/bhe_mcp
cd ~/git/bhe_mcp
uv sync

Create a .env file in the project root:

BLOODHOUND_DOMAIN=your-bloodhound-instance.domain.com
BLOODHOUND_TOKEN_ID=your-token-id
BLOODHOUND_TOKEN_KEY=your-token-key

The server defaults to https on port 443. Override if needed:

BLOODHOUND_PORT=8080
BLOODHOUND_SCHEME=http

Configuration

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "bhe_mcp": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/bhe_mcp",
        "run",
        "main.py"
      ]
    }
  }
}

Claude Code

Add to ~/.claude/mcp.json:

{
  "mcpServers": {
    "bhe_mcp": {
      "type": "stdio",
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/bhe_mcp",
        "run",
        "main.py"
      ]
    }
  }
}

OpenAI Codex CLI

Add to ~/.codex/config.toml (or .codex/config.toml for project-scoped config):

[mcp_servers.bhe_mcp]
command = "uv"
args = ["--directory", "/path/to/bhe_mcp", "run", "main.py"]

Since the server loads credentials from .env automatically, no env block is needed. If you prefer to pass them explicitly:

[mcp_servers.bhe_mcp]
command = "uv"
args = ["--directory", "/path/to/bhe_mcp", "run", "main.py"]

[mcp_servers.bhe_mcp.env]
BLOODHOUND_DOMAIN = "your-bloodhound-instance.domain.com"
BLOODHOUND_TOKEN_ID = "your-token-id"
BLOODHOUND_TOKEN_KEY = "your-token-key"

For multiple BHE tenants, point each MCP server at the same checkout and give each one its own env file. This keeps demo and maplesyrup distinct by server name and by the codename in the env file path:

[mcp_servers.bloodhound_demo]
command = "uv"
args = ["--directory", "/path/to/bhe_mcp", "run", "main.py"]

[mcp_servers.bloodhound_demo.env]
UV_CACHE_DIR = "/path/to/uv-cache"
BLOODHOUND_ENV_FILE = "/path/to/bloodhound_demo.env"

[mcp_servers.bloodhound_maplesyrup]
command = "uv"
args = ["--directory", "/path/to/bhe_mcp", "run", "main.py"]

[mcp_servers.bloodhound_maplesyrup.env]
UV_CACHE_DIR = "/path/to/uv-cache"
BLOODHOUND_ENV_FILE = "/path/to/bloodhound_maplesyrup.env"

MCP Inspector

  • Command: uv

  • Args: --directory /path/to/bhe_mcp run main.py

BloodHound API Token

  1. Log into BloodHound Enterprise

  2. Navigate to AdministrationAPI Tokens

  3. Create a new token and copy the Token ID and Token Key into your .env


Usage

Example Queries

Reconnaissance:

What domains are in BloodHound?
Show me all Domain Admins in CORP.LOCAL
Find all kerberoastable users
Which computers have unconstrained delegation?

User and Group Analysis:

What admin rights does jsmith@corp.local have?
Show me all sessions for the administrator account
What groups is this user a member of?
Who controls the IT ADMINS group?

Attack Path Analysis:

Find the shortest path from jsmith@corp.local to Domain Admins
Who has DCSync rights in the domain?
Show me all GPO abuse paths
Find ADCS ESC1 paths in the domain

Custom Cypher:

Run a Cypher query to find all users with SPN set and admincount=1
Find all computers where DOMAIN USERS can RDP

OpenGraph Support

BloodHound 8.0+ supports custom node types via OpenGraph, letting you model non-AD infrastructure (cloud resources, databases, custom assets) in the same graph as Active Directory.

The custom_nodes tool handles legacy CRUD operations on node type display configurations through /api/v2/custom-nodes. For BloodHound v9.0.0+ instances with OpenGraph extension management enabled, the same composite tool also supports /api/v2/extensions and /api/v2/extensions-edges via extension_list, extension_upsert, extension_delete, and extension_edges.

Use the bloodhound://opengraph/guide and bloodhound://opengraph/examples resources for schema design and Cypher patterns. For structured OpenGraph schemas, upsert the extension schema first, then ingest collection data with file_upload.

Requires BloodHound 8.0 or later. OpenGraph extension management requires BloodHound 9.0.0+ and the corresponding feature flag to be enabled.


Security Considerations

BloodHound data processed through this tool is transmitted to your LLM provider's servers. Do not use this with production AD data unless you have assessed that risk.

Recommended use cases:

  • Lab environments (GOAD, DetectionLab, custom ranges)

  • Training and certification prep

  • Research and tool development

  • Non-production domain analysis

Best practices:

  • Rotate BloodHound API tokens regularly

  • Use a read-only API token where possible

  • Consider a local LLM bridge for sensitive environments


Testing

# Full test suite
uv run pytest

# Specific modules
uv run pytest tests/test_main_mcp_tools.py -v
uv run pytest tests/test_bloodhound_api.py -v

# Integration tests (requires a live BloodHound instance)
BLOODHOUND_INTEGRATION_TESTS=1 uv run pytest tests/test_integration.py -v

Contributing

Contributions are welcome. Open an issue to discuss significant changes before submitting a PR.

  1. Fork the repo

  2. Create a feature branch

  3. Add tests for new functionality

  4. Run uv run pytest and confirm everything passes

  5. Submit a pull request


Acknowledgments

  • SpecterOps for BloodHound

  • Orange Cyberdefense for GOAD (used for testing)

  • @jlowin for FastMCP

  • @xpn for MCP inspiration via the Mythic MCP project

License

GNU General Public License v3.0 — see LICENSE for details.

Available Tools

20 tools
adcs_infoA

QUery AD Certificate Services data from BloodHound object_id is the template_id or the ca_id depending on the info_type info_type options: cert_template_info - certificate template properties (object_id = template ID) cert_template_controllers - who can modify this template - key for ESC1/ESC2 (object_id = template ID) cert_template_published_to_cas - Enterprise CAs publishing this template root_ca_info - root ca properties (object_id = CA ID) root_ca_controllers - who controls the root ca - key for ESC4/ESC5 (object_id = CA ID) root_ca_pki_hierarchy - PKI hierarchy for a root CA enterprise_ca_info - enterprise CA properties (object_id = CA ID) enterprise_ca_controllers - who controls the enterprise CA - key for ESC3/ESC6 (object_id = CA ID) enterprise_ca_pki_hierarchy - PKI hierarchy for an enterprise CA enterprise_ca_published_templates - templates published to this enterprise CA aia_ca_info - AIA CA properties aia_ca_controllers - who controls the AIA CA (object_id = CA ID) aia_ca_pki_hierarchy - PKI hierarchy for an AIA CA nt_auth_store_info - NT Auth Store properties nt_auth_store_controllers - controllers of an NT Auth Store nt_auth_store_trusted_cas - trusted Enterprise CAs for an NT Auth Store

args:
    object_id: Template ID or CA ID depending on info_type (required)
    info_type: what to retrieve (required)
    limit: Max Results (default 100, useful in large environments)
    skip: Pagination offset (default 0)
ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
info_typeYes
object_idYes

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the burden. It states it is a query operation and mentions pagination parameters, but does not explicitly disclose side effects, authentication needs, or return format. The read-only nature is implied but not stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured with a purpose statement up front and a clear bulleted list of info_type options. Every line adds necessary detail; it is not padded, though it could be slightly more concise by grouping similar options.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema, the description compensates by explaining what each info_type returns (properties, controllers, hierarchy, etc.) and the pagination parameters. It lacks explicit return structure, but for a query tool with many options, this is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description significantly enriches the parameter definitions by explaining exactly what object_id means (template ID or CA ID depending on info_type), listing all possible info_type values, and defining limit and skip for pagination. This far exceeds the sparse schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool queries AD Certificate Services data from BloodHound, with a specific resource and action. It distinguishes itself from sibling tools by focusing on ADCS-specific info types rather than general entity info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context on how object_id relates to info_type and enumerates all valid info_type values with explanations. Does not explicitly mention alternatives or when to avoid, but the exhaustive list gives strong usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

asset_groupsA

Manage Asset isolation groups and tages in BloodHound

info_type options:
    list - list all asset groups (optional filters: name, tag, sort_by, system_group)
    get - get a specific asset group (requires: asset_group_id)
    create - create a new asset group (requires: name, tag)
    update - update an existing asset group (requires: asset_group_id)
    delete - delete an asset group (requires: asset_group_id)
    collections - list historical membership snapshots (requires: asset_group_id)
    custom_selectors - get custom selector/member count (requires: asset_group_id)
    members - list asset group members (requires: asset_group_id)
    member_counts - get member counts by object type (requires: asset_group_id)
    combo_node - get the combo tree for an asset group (requires: asset_group_id)
    create_selectors - add auto membership selectors (requires: asset_group_id, selectors_json)
    update_selectors - set auto membership selectors (requires: asset_group_id, selectors_json)
    delete_selector - delete an asset group selector (requires: asset_group_id, asset_group_selector_id)
    list_tags - list asset group tags (optional: name, tag, sort_by)
    create_tag - create a new asset group tag (requires: name, tag)
    tag_members - list members of a tag (requires: asset_group_tag_id)
    tag_member_selectors - get selectors for a tag member (requires: asset_group_tag_id, asset_group_member_id)
    tag_member_counts - get tag member counts (requires: asset_group_tag_id)
    tag_selectors - list tag selectors (requires: asset_group_tag_id)
    tag_selector_members - list members for a tag selector (requires: asset_group_tag_id, asset_group_tag_selector_id)
    tag_selector_member_counts - count members for a tag selector (requires: asset_group_tag_id, asset_group_tag_selector_id)
    preview_tag_selectors - preview selectors (requires: request_json)
    search_tags - search asset group tags (requires: request_json)
    tag_history - list tag history records
    search_tag_history - search tag history records (requires: request_json)
    certifications - get certifications for privilege zones
    update_certifications - certify or revoke objects (requires: request_json)

args:
    info_type: operation to perform (default: list)
    asset_group_id: Asset group ID (for get, update, delete, collections, member_counts, update_selectors)
    asset_group_tag_id: Tag ID (for tag_members)
    name: Group/tag name (for create, update, create_tag, or filters)
    tag: Tag value (for create, update, create_tag, or filters)
    sort_by: Sort field (for list, list tags)
    system_group: Filter by system group (for list)
    selectors_json: JSON array of selector specs (for update_selectors)
    request_json: JSON request body for preview/search/certification actions
    skip: Pagination offset (default 0)
    limit: Max results (default 100)
ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
nameNo
skipNo
limitNo
sort_byNo
info_typeNolist
request_jsonNo
system_groupNo
asset_group_idNo
selectors_jsonNo
asset_group_tag_idNo
asset_group_member_idNo
asset_group_selector_idNo
asset_group_tag_selector_idNo

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It lists mutating operations (create, update, delete) and parameter requirements, but it does not describe side effects, permission needs, reversibility, or response formats. For a mutation-heavy tool, omitting such details leaves the agent without knowledge of consequences or preconditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy but well-structured: a one-line summary, a categorized list of 24 operations, and an arg listing. It front-loads the purpose and uses a consistent, scannable format. While every line is informative, the sheer volume and repetition of parameter lists prevent a perfect score for conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 14 parameters, no annotations, no output schema, and 24 operations, the description is remarkably thorough on operation semantics and parameter requirements. It falls short on describing return values, error behavior, or output formats, which would be necessary for an agent to interpret results. Given the complexity, the coverage is strong but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description fully compensates. Each of the 14 parameters is described with its purpose and the specific info_types it applies to (e.g., 'asset_group_tag_id: Tag ID (for tag_members)'). It also documents defaults for skip/limit and explains JSON request parameters (selectors_json, request_json), providing all necessary semantics beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Manage Asset isolation groups and tages in BloodHound,' providing a clear verb+resource pair. It enumerates 24 distinct info_type sub-operations, which distinguishes it from sibling tools like group_info or domain_info by focusing on the asset-groups feature. However, the verb 'Manage' is generic and could be more specific (e.g., 'List, create, update, and delete'), preventing a top score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives detailed guidance on required parameters for each info_type (e.g., 'get - get a specific asset group (requires: asset_group_id)'), which helps an agent select the correct operation. It does not, however, reference sibling tools or state when this tool should be used instead of another, nor does it provide exclusions. Usage context is implied by the resource (asset groups and tags) but not explicitly framed against alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

attack_pathsA

Query BloodHound Enterprise attack path data.

info_type options:
    domain_findings - export attack path findings for a domain (needs: domain_id)
    finding_trends - list attack path finding trends
    types - list all attack path types
    start_analysis - start attack path analysis
    details - get all attack path findings with details
    domain_available_types - list attack path types available in a domain (needs: domain_id)
    domain_details - list attack path details for a domain (needs: domain_id)
    domain_sparkline - list attack path sparkline values for a domain (needs: domain_id)
    acceptance - update attack path risk acceptance (needs: attack_path_id, acceptance_json)

args:
    info_type: what to retrieve or update (default: details)
    domain_id: Domain object ID for domain-scoped attack path endpoints
    attack_path_id: Attack path finding ID for risk acceptance
    acceptance_json: JSON string or object accepted by the BHE risk acceptance API
    finding_name: Case-insensitive filter for finding/type/name fields
    source_name: Case-insensitive filter for source fields
    target_name: Case-insensitive filter for target fields
    environment_id: Case-insensitive filter for environment/domain fields
    accepted: Filter findings by accepted/risk acceptance state
ParametersJSON Schema
NameRequiredDescriptionDefault
acceptedNo
domain_idNo
info_typeNodetails
source_nameNo
target_nameNo
finding_nameNo
attack_path_idNo
environment_idNo
acceptance_jsonNo

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations available, the description carries the full burden. It does disclose that 'acceptance' updates risk acceptance and 'start_analysis' initiates analysis, indicating non-read operations, but it doesn't discuss side effects, permissions, reversibility, or return behavior. This is moderate disclosure but leaves important behavioral unknowns for a tool with mutation capabilities.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured, starting with a clear purpose and then using organized lists for info_type options and arguments. It is dense but not bloated, and every line serves to explain a mode or parameter. It's slightly lengthy due to the tool's complexity, but the structure makes it easy to navigate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with no output schema and no annotations, the description covers all operation modes and parameter semantics, which is sufficient for correct selection and invocation of most options. However, it lacks details on the shape of returned data, pagination, error handling, or authentication requirements, leaving some gaps for a fully complete understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Since schema description coverage is 0%, the description compensates by explaining all 9 parameters, including their purpose, required associations (e.g., domain_id for domain-scoped endpoints), filter case-insensitivity, and type for acceptance_json. It adds significant meaning beyond the bare schema titles, though some parameter descriptions remain terse.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Query BloodHound Enterprise attack path data' and then enumerates nine specific operation types via info_type, covering finding export, trends, analysis, and risk acceptance. This makes the tool's purpose and scope unambiguous, and distinguishes it from general graph analysis or Cypher query tools among the siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage context for each info_type, indicating required parameters per mode (e.g., 'domain_findings - needs: domain_id') and noting the default value for info_type (details). It does not explicitly contrast with sibling tools or state when NOT to use this tool, so it falls slightly short of full guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

collection_infoA

Query BloodHound Enterprise collection infrastructure status.

info_type options:
    collector_manifest - get collector manifest (needs: collector_type)
    collector_checksum - get collector checksum (needs: collector_type, release_tag)
    kennel_manifest - get kennel manifest
    kennel_enterprise_manifest - get kennel enterprise manifest
    clients - list clients
    client - get a client (needs: client_id)
    client_completed_tasks - list completed tasks for a client (needs: client_id)
    client_completed_jobs - list completed jobs for a client (needs: client_id)
    jobs_available - list available jobs
    jobs_finished - list finished jobs
    jobs - list jobs
    job_current - get current job
    job - get a job (needs: job_id)
    job_log - get job log (needs: job_id)
    tasks_available - list available tasks
    tasks_finished - list finished tasks
    tasks - list tasks
    task_current - get current task
    task - get a task (needs: task_id)
    task_log - get task log (needs: task_id)
    events - list scheduled events
    event - get scheduled event (needs: event_id)
ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
job_idNo
task_idNo
event_idNo
client_idNo
info_typeNoclients
asset_nameNo
release_tagNo
collector_typeNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It clearly states 'Query' (read-only) and details all operations and their parameter dependencies. It does not discuss authorization, rate limits, or error behavior, but for a status query tool, the disclosed information is substantial and accurate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with its purpose and then organized as a clean list of options with dependencies. Every line earns its place; the length is justified by the number of sub-operations. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (10 parameters, many info_type variants), the description covers all operation-specific requirements. It does not describe return values or error handling, but with no output schema and the read-only nature, the provided information is largely sufficient for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so admirably by listing each info_type and explicitly stating which parameters are required for each, effectively providing a full usage map. This adds critical meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear, specific verb+resource statement: 'Query BloodHound Enterprise collection infrastructure status.' It then enumerates all info_type options, which precisely distinguishes this from sibling tools like user_info or domain_info. The scope is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides an extensive list of info_type values with their required parameters, giving clear context on when to use each subtype. It does not explicitly mention alternatives or when not to use the tool, but the sibling tool names and the focused scope make the intended usage obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

computer_infoA

Query computer data from BloodHound. info_type options: info - general computer properties and attributes admin_rights - objects this computer has admin rights on admin_users - users/groups that have admin rights on this computer constrained_delegation - services this computer can delegate to via kerberos constrained_users - users with contained delegation TO this computer controllables - objects this computer can control controllers - principals that have control over this computer dcom_rights - machines this computer can execute DCOM on dcom_users - users/groups with DCOM rights ON this computer group_membership - groups this computer belongs to ps_remote_rights - machines this computer can PSRemote to ps_remote_users - users/groups with PSRemote rights ON this computer rdp_rights - machines this computer can RDP to rdp_users - users/groups with RDP rights ON this computer sessions - users with active sessions on this computer sql_admins - SQL servers this computer is admin on

args:
    computer_id: BloodHound object ID of the computer (required)
    info_type: what to retrieve (default: info)
    limit: Max Results (default 100, useful in large environments)
    skip: Pagination offset (default 0)
ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
info_typeNoinfo
computer_idYes

TDQS

A4.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It explains defaults and parameter effects but does not disclose output format, pagination behavior beyond skip/limit, or potential side effects (though it is a query tool). This is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with clear bullet points for info_type and args. Every line provides necessary information without redundancy, making it dense and effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, all parameters, all info_type behaviors, defaults, and required fields. Given no output schema, it is as complete as expected for a query tool, leaving little ambiguity for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fully compensates by explaining every parameter, listing all info_type options with their meanings, and providing defaults for limit, skip, and info_type. This adds significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Query computer data from BloodHound' with a specific verb and resource, and enumerates distinct info_type options. This distinguishes it from sibling tools like user_info and group_info by focusing on computer-specific data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides detailed context for each info_type, making it clear what to use for various retrieval needs. However, it does not explicitly mention alternative tools or scenarios where this tool should not be used, which would strengthen the guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

custom_nodesA

Manage OpenGraph custom node display configs and v9 extension schemas. info_type options: list - list all custom node configs get - get details for a specific node kind (needs: kind_name) create - create new node kind with display metadata (needs: custom_types_json) update - update a node kind's display config (needs: kind_name, config_json) delete - delete a node kind (needs: kind_name) validate_icon - validate icon config before creating/updating (needs: icon_config_json) extension_list - list OpenGraph extensions (BloodHound v9+) extension_upsert - create/update extension schema (needs: extension_json or extension_file_path) extension_delete - delete extension schema by ID (needs: extension_id) extension_edges - list extension edge kinds (optional: schemas, is_traversable)

args:
    info_type: what to retrieve (default: list)
    kind_name: Custom node kind name (for get,update, delete)
    custom_types_json: JSON string or object for creating a new node kind (for create)
    config_json: JSON string or object for updating a node kind's display config (for update)
    icon_config_json: JSON string or object for validating icon config (for validate_icon)
    extension_json: JSON string or object for BloodHound v9 OpenGraph extension upsert
    extension_file_path: local JSON file path for BloodHound v9 OpenGraph extension upsert
    extension_id: OpenGraph extension ID for delete
    schemas: schema name or list of schema names for extension edge filtering
    is_traversable: bool or BloodHound filter string (for example: eq:true)
ParametersJSON Schema
NameRequiredDescriptionDefault
schemasNo
info_typeNolist
kind_nameNo
config_jsonNo
extension_idNo
extension_jsonNo
is_traversableNo
icon_config_jsonNo
custom_types_jsonNo
extension_file_pathNo

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does state that validate_icon is used 'before creating/updating', giving a workflow hint, and the operation names (delete, update) are relatively self-explanatory. However, it does not mention side effects such as permanence of delete, whether updates are immediate, or any permission/authorization requirements. This is a moderate gap for a management tool with destructive operations, so a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Although the description is relatively long, it is well-organized into a summary line, an info_type list, and an args list. Each line conveys necessary information without redundancy. The structure front-loads the core purpose then details each operation and its parameters, making it easy for an agent to scan and extract relevant details. It is appropriately sized for a tool with 10 parameters and 9 operation modes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description thoroughly covers the operations and their required parameters, which addresses the main selection and invocation concerns. However, since there is no output schema, it does not describe what the tool returns for each info_type (e.g., whether list returns an array, whether get returns a config object). This would be valuable for an agent to know the outcome. The description is otherwise complete for the tool's complexity, so this is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides no descriptions (0% coverage), so the description fully compensates. It explains each of the 10 parameters, including their purpose and the info_type operations they are needed for (e.g., 'kind_name: Custom node kind name (for get, update, delete)'). This adds substantial meaning beyond the schema's bare titles and defaults, giving the agent all required context for invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb phrase 'Manage OpenGraph custom node display configs and v9 extension schemas', identifying both the resource and action. It also enumerates all info_type operations (list, get, create, update, delete, etc.), making the tool's scope unmistakable and distinguishing it from sibling tools that focus on other entity types (e.g., group_info, computer_info).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly explains the usage by listing each info_type and the required arguments for each operation, which serves as a mini-guide for when to use which sub-operation. However, it does not explicitly state when not to use this tool or mention alternatives, nor does it contrast with sibling tools. The context of being the tool for custom node/extension configuration is implied but not spelled out in comparison form.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cypher_queryA

Execute and manage Cypher queries in BloodHound.

info_type options:
    run - execute a cypher query (needs: query; optional: include_properties)
    interpret - interpret a natural language query into cypher (needs: query, result_json)
    list_saved - list saved queries (optional: name, skip, limit)
    create_saved - save a new query (needs: name, query)
    get_saved - get details of a saved query (needs: query_id)
    update_saved - update an existing saved query (needs: query_id; optional: name, query, description)
    delete_saved - delete a saved query (needs: query_id)
    share_saved - share a saved query with other users (needs: query_id; optional: user_ids, public)
    saved_permissions - get saved query permissions (needs: query_id)
    export_saved - export a saved query (needs: query_id)
    import_saved - import saved queries (needs: payload_json)
    export_saved_many - export saved queries (optional: query_ids)
    validate - validate a cypher query for syntax and semantics (needs: query)

args:
    info_type: Operation to perform
    query: Cypher query string (for run, create_saved, update_saved, validate)
    include_properties: Include node/edge properties in results (for run, default: True)
    name: Query name (for create_saved, update_saved, list_saved filter)
    query_id: Saved query ID (for get_saved, update_saved, delete_saved, share_saved)
    result_json: JSON result string from a previous run (for interpret)
    description: Query description (for update_saved)
    user_ids: Comma-separated user IDs to share with (for share_saved)
    query_ids: Comma-separated saved query IDs to export
    payload_json: JSON string/object for saved query import
    public: Make query public (for share_saved, default: False)
    limit: Max results (default 100)
    skip: Pagination offset (default 0)
ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
skipNo
limitNo
queryNo
publicNo
query_idNo
user_idsNo
info_typeYes
query_idsNo
descriptionNo
result_jsonNo
payload_jsonNo
include_propertiesNo

TDQS

A4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden for behavioral disclosure. It names operations like 'delete_saved' and 'update_saved' but does not mention side effects, permanence, permission requirements, or return behavior. The destructive nature of delete is only implicit through the operation name, leaving significant transparency gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Despite being long, the description is logically structured into 'info_type options' and 'args', with each item earning its place. It is front-loaded with a clear purpose statement and uses a consistent needs/optional format. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (13 params, 13 operation modes, no output schema), the description covers operations and parameters well. However, it omits return value formats, error handling, and any examples, leaving the agent to guess what outputs to expect from actions like 'run' or 'interpret'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must fully compensate. It does so by listing all 13 parameters and explaining each one's purpose and applicable operations. This adds substantial meaning beyond the bare schema fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool executes and manages Cypher queries in BloodHound. The verb 'Execute and manage' plus the resource 'Cypher queries' distinguishes it from sibling info tools like domain_info or graph_analysis. The enumerated info_type operations further clarify its scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides detailed per-operation guidance (needs vs optional parameters), giving clear context for each action. However, it does not explicitly state when to choose this tool over siblings or provide exclusion criteria, so it falls short of a perfect 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

data_qualityA

Query data quality and collection statistics from BloodHound info_type options: completeness - overall database completeness stats (no params needed) ad_domain - collection quality over time for an AD domain (needs: domain_id) azure_tenant - collection quality over time for an azure tenant (needs: tenant_id) platform - aggregate quality stats for a platform (needs: platform_id - "ad" or "azure")

args:
info_type: what to retrieve (default: completeness)
domain_id: AD domain ID
platform_id: "ad" or "azure"
start: Start datetime in RFC-3339 format
end: end datetime in RFC-3339 format
sort_by: Sort field - "created_at" or "updated_at" (optional)
skip: Pagination offset (default 0)
limit: max results (default 100)
ParametersJSON Schema
NameRequiredDescriptionDefault
endNo
skipNo
limitNo
startNo
sort_byNo
domain_idNo
info_typeNocompleteness
tenant_idNo
platform_idNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It details the varying behavior for each info_type, parameter dependencies, and optional pagination/sorting. It implies a read-only query operation, which is appropriate for the tool's purpose. While it does not mention authentication or rate limits, the description provides substantive behavioral context beyond mere schema fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a brief purpose statement, a clear bulleted list of info_type options, and a separate args list. It is appropriately sized for the tool's complexity, with every line providing actionable information and no redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (four modes, nine parameters) and lack of output schema/annotations, the description is largely complete. It covers all input semantics and mode-specific requirements. However, it does not describe the return value or response structure, which would be useful but is not critical for a query tool. The description overall is strong and sufficient for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully compensate. It does so by documenting all nine parameters, including their purpose and required formats (e.g., 'start: Start datetime in RFC-3339 format', 'platform_id: "ad" or "azure"'). This is a complete and high-quality parameter explanation, exceeding what the minimal schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair: 'Query data quality and collection statistics from BloodHound.' It then enumerates distinct info_type variants (completeness, ad_domain, azure_tenant, platform), which clearly delineates the tool's scope and differentiates each mode. This is specific and distinguishes from sibling tools like collection_info or risk_posture.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance for each info_type, including which parameters are required for each (e.g., ad_domain needs domain_id, azure_tenant needs tenant_id). It does not explicitly mention alternatives or when not to use this tool, but the provided context strongly implies the appropriate use cases, making it clear enough for an agent to select this tool correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

domain_infoA

Query domain level data from BloodHound info_type options: list - list all domains (no domain_id needed) info - domain entity info (needs domain_id) search - search objects by name/ID (needs query param, domain_id not needed) users - users in the domain groups - groups in the domain computers - computers in the domain controllers - security prinicpals with control relationships gpos - Group Policy Objects ous - Organizational unites dc_syncers - Principals with DCSync rights foreign_admins - admins from other domains foreign_gpo_controllers - GPO controllers from other domains foreign_groups - groups with cross domain members foreign_users - users referenced across domains inbound_trusts - domains that trust this domain outbound_trusts - domains this domain trusts linked_gpos - linked GPOs in this domain adcs_escalations - ADCS escalation findings in this domain Args: info_type: what to retrieve (default: list) domain_id: Domain object ID (required for most info_types) query: Search text (for info_type=search only) object_type: Filter by type - User, computer, Group, GPO, OU, Domain, AZUer, etc. (search only) limit: Max Results (default 100, useful in large environments) skip: Pagination offset (default 0)

ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
queryNo
domain_idNo
info_typeNolist
object_typeNo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses the exact behavior of each info_type, parameter dependencies, and defaults (limit=100, skip=0). It highlights that search is limited to name/ID and object_type filtering, providing concrete behavioral specifics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear opening and organized list of info_type options. While long, every line adds necessary detail for a multi-mode tool; no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema or annotations, the description explains the tool's modes and parameters comprehensively. It lacks explicit output format or error details, but for a query tool, the return types are largely inferable from the info_type names.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description fully compensates by explaining every parameter: info_type options, domain_id necessity, query's purpose, object_type filter, and pagination controls. This goes far beyond the schema's bare titles and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool queries domain level data from BloodHound, and the extensive list of info_type options (list, info, search, users, groups, etc.) precisely defines its scope. This distinguishes it from sibling tools focused on specific entity types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for each info_type, noting when domain_id is required (e.g., info) and when query is needed (search). It implies domain-level queries are the tool's focus, but it does not explicitly name alternative tools for when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

enterprise_adminA

Query read-only BloodHound Enterprise administrative metadata.

info_type options:
    self - get authenticated requester info
    permissions - list permissions
    permission - get a permission (needs: permission_id)
    roles - list roles
    role - get a role (needs: role_id)
    users - list BloodHound users
    users_minimal - list minimal user records
    user - get a user (needs: user_id)
    saml - list SAML providers
    saml_sso - list SAML sign-on endpoints
    saml_provider - get SAML provider (needs: saml_provider_id)
    sso_providers - list SSO providers
    sso_signing_certificate - get SSO signing certificate (needs: sso_provider_id)
ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
role_idNo
user_idNo
info_typeNoself
permission_idNo
sso_provider_idNo
saml_provider_idNo

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explicitly states 'read-only,' which is a key behavioral trait, especially with no annotations provided. It also lists parameter requirements for each info_type (e.g., 'needs: permission_id'). However, it does not describe pagination behavior (skip/limit), response formats, or potential errors. This is adequate but not rich, given the lack of annotations and output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is effectively structured as a bullet-like list of info_type options, front-loaded with a one-sentence purpose. It is concise for the number of options it covers, with each line adding specific value. It avoids unnecessary prose and is easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters, no annotations, and no output schema, the description provides a functional overview and explains most ID parameters. However, it lacks details on pagination (skip/limit) application, return values, and any nuances like default info_type='self'. This is sufficient for basic selection and invocation but leaves some gaps for an agent to fully understand behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates well by mapping info_type options to the required ID parameters (permission_id, role_id, user_id, saml_provider_id, sso_provider_id). This gives meaning beyond the raw schema. It does not explain skip/limit, but these are common pagination parameters and less critical for the tool's core functionality.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Query read-only BloodHound Enterprise administrative metadata.' This is a specific verb (query), resource (administrative metadata), and mentions read-only. It distinguishes from siblings like user_info or domain_info by focusing on admin-level metadata, and the info_type options further clarify the scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context on available info_type options, implying when to use this tool (for admin metadata queries). However, it does not explicitly state when to use this tool over alternatives like enterprise_info or provide exclusions. The guidance is implied rather than explicit, so it meets the minimum but lacks comparative direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

enterprise_infoA

Query read-only BloodHound Enterprise service information.

info_type options:
    version - get API version metadata
    spec - get the OpenAPI specification
    audit - list audit logs
    config - list application configuration parameters
    features - list feature flags

args:
    info_type: what to retrieve (default: version)
    skip: audit pagination offset
    limit: audit pagination limit
    sort_by: optional audit sort field
    status: optional audit status filter
ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
statusNo
sort_byNo
info_typeNoversion

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the read-only nature upfront and explains behavior for each info_type (e.g., 'get API version metadata', 'list audit logs'). It does not mention authentication requirements, error behavior, or rate limits, which would be valuable given no annotations exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with a clear opening line, a list of options, and a list of args. No redundant information; each line adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the full scope of the tool: multiple info_type variants and all parameters. It does not specify return formats in detail, but since no output schema exists, the description's per-type descriptions (e.g., 'get the OpenAPI specification') provide adequate expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All five parameters are described in the description (e.g., 'skip: audit pagination offset', 'limit: audit pagination limit'), adding meaning beyond the bare schema which has no descriptions. The descriptions are concise but sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Query read-only BloodHound Enterprise service information' and enumerates distinct info_type sub-operations, distinguishing it from sibling entity-specific info tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context that this tool is for service-level information (version, spec, audit, config, features) and not for entity-specific data. However, it does not explicitly name alternatives or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

entity_infoA

Query generic BHE entity endpoints not covered by a specific composite tool.

info_type options:
    base_info - AD base entity info (needs: object_id)
    base_controllables - controllable objects for a base entity (needs: object_id)
    base_controllers - controllers of a base entity (needs: object_id)
    container_info - container entity info (needs: object_id)
    container_controllers - controllers of a container entity (needs: object_id)
    azure_entity - generic Azure entity lookup by entity type (needs: entity_type)

args:
    info_type: what to retrieve
    object_id: AD object ID for base/container endpoints
    entity_type: Azure entity type path segment
    limit: max results for list endpoints
    skip: pagination offset for list endpoints
ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
info_typeYes
object_idNo
entity_typeNo

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses operation variants and argument requirements but does not explicitly state whether the tool is read-only, the return format, or any side effects. Since this is a query-style tool, the risk is low, but behavioral transparency is only partially addressed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently organized with a bulleted list of info_type options and a compact args section. The only minor redundancy is restating parameters in the args list after already describing them in the options, but overall the structure aids scanning and comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (5 params, multiple endpoint types, no output schema), the description covers all required inputs and use cases. It lacks expected return shapes or examples, but the endpoint enumeration and parameter guidance make the tool usable. A slightly higher score would require additional context on response structures or error behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully compensate. It explains each info_type option and which parameters each requires, and it defines the roles of object_id, entity_type, limit, and skip. This exceeds the bare schema by providing meaningful operational semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'Query generic BHE entity endpoints' and explicitly distinguishes it from 'a specific composite tool,' signaling it's for cases not covered elsewhere. It enumerates the exact info_type sub-operations, making the tool's scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'not covered by a specific composite tool' gives clear contextual guidance for when to use this tool versus the many sibling info tools. It does not explicitly list alternative tool names or exclusion conditions, but the sibling set and per-option prerequisites (e.g., 'needs: object_id') provide implied usage direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_uploadA

Upload SharpHound/AzureHound collection files to BloodHound for ingest. Accepts .zip (SharpHound ZIP archive) or .json (individual collection file).

info_type options:
    upload        - full workflow for a single file: start -> upload -> end
                    (requires: file_path)
    start_job     - start a new upload job, returns job_id for multi-file uploads
    upload_to_job - upload a file to an existing job (requires: job_id, file_path)
    end_job       - finalize an upload job and trigger ingest (requires: job_id)
    list_jobs     - list file upload jobs
    completed_tasks - get completed tasks for an upload job (requires: job_id)
    accepted_types - list accepted upload content types

Args:
    info_type: operation to perform (default: upload)
    file_path: absolute path to collection file (.zip or .json)
    job_id: upload job ID (required for upload_to_job and end_job)
    skip: pagination offset for list_jobs
    limit: pagination limit for list_jobs
ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
job_idNo
file_pathNo
info_typeNoupload

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It effectively describes the workflow stages (start -> upload -> end), states that end_job 'triggers ingest', and lists requirements for each operation. It doesn't cover error handling or side effects like file retention, but for a file upload tool, it provides substantial behavioral context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized: a clear one-sentence purpose, a formatted list of info_type options with requirements, and an Args section. Each bullet and line adds value, no redundancy. Despite its length, it's front-loaded with the core purpose and structured for quick scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, multiple operations, no output schema), the description is highly complete. It explains all operation modes, their prerequisites, and the overall upload workflow. It also clarifies pagination for list_jobs via skip/limit. The agent has enough to use this tool correctly without further probing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate entirely. It does so thoroughly: every parameter (info_type, file_path, job_id, skip, limit) is explained, with details on when each is required. The description of info_type values adds semantic meaning that the schema (which only shows a default of 'upload') completely lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Upload SharpHound/AzureHound collection files to BloodHound for ingest.' This clearly distinguishes it from sibling tools which are all read/info-oriented. It also specifies accepted file formats (.zip/.json), leaving no ambiguity about the tool's core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage context for each info_type operation, including required parameters (e.g., 'upload_to_job - upload a file to an existing job (requires: job_id, file_path)'). This effectively tells the agent which operation to use under what circumstances. It lacks an explicit 'use this instead of X' statement, but the sibling tools are clearly different, so the when-to-use is implied strongly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gpo_infoA

Query GPO data from BloodHound. info_type options: info - general GPO properties and attributes computers - computers this GPO is applied to controllers - principals that can modify this GPO ous - OUs this GPO is linked to tier_zeros - tier-zero principals associated with this GPO users - users this GPO is applied to args: gpo_id: BloodHound object ID of the GPO (required) info_type: what to retrieve (default: info) limit: Max Results (default 100, useful in large environments) skip: Pagination offset (default 0)

ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
gpo_idYes
info_typeNoinfo

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It honestly discloses the configurable behaviors via info_type and pagination parameters, and notes limit is 'useful in large environments.' However, it does not explicitly state read-only nature, authentication requirements, or return format, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized into info_type options and args, with each line providing necessary detail. It is verbose but every piece contributes value; no fluff or repetition of schema defaults beyond adding context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given four parameters, no output schema, and no annotations, the description does a solid job covering parameter semantics and the behavior variations. It could be more complete by describing the structure of returned data or typical use cases, but the info_type list partially compensates.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description is the sole source of parameter meaning. It explains gpo_id as a BloodHound object ID, gives concrete semantics for each info_type value, and clarifies limit and skip as pagination controls. This adds substantial meaning beyond the bare schema names and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Query GPO data from BloodHound' with a specific verb and resource, and enumerates distinct info types. It distinguishes from sibling _info tools by focusing on GPO, though it does not explicitly contrast with alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving GPO-related information (computers, controllers, OUs, tier-zero principals, users) but does not explicitly state when to choose this over sibling tools. It provides no exclusion criteria or alternatives, though the info_type list helps clarify sub-scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

graph_analysisA

Perform graph analysis operations in BloodHound

info_type options:
    kinds - list graph node and edge kinds
    search - search for nodes by name (needs: query; optional: search_type)
    shortest_path - find shortest attack path between two nodes (needs: start_node, end_node; optional relationship_kinds)
    edge_composition - decompose a complex edge into underlying relationships (needs: source_node, target_node, edge_type)
    relay_targets - find valid NTLM relay targets for a given node (needs: source_node, target_node, edge_type)
    pathfinding - get pathfinding result (optional: start_node, end_node, relationship_kinds)
    acl_inheritance - get ACL inheritance path (needs: source_node, target_node)

args:
    info_type: what type of graph operation to perform (required)
    query: search text (for search)
    search_type: type of search - fuzzy (default) or exact (for search)
    start_node: Object ID of source node (for shortest_path)
    end_node: Object ID of target node (for shortest_path)
    source_node: Object ID of source node (for edge_composition and relay_targets)
    target_node: Object ID of target node (for edge_composition and relay_targets)
    edge_type: Realtionship type like "MemberOf", "AdminTo", (for edge_composition and relay_targets)
    relationship_kinds: Comma-separated relationship filter (for shortest_path, optional)
ParametersJSON Schema
NameRequiredDescriptionDefault
queryNo
end_nodeNo
edge_typeNo
info_typeYes
start_nodeNo
search_typeNofuzzy
source_nodeNo
target_nodeNo
relationship_kindsNo

TDQS

A3.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does not state whether the tool is read-only, what permissions are required, whether operations can be expensive, or what side effects might occur. It only describes operation logic and parameters, leaving the agent to guess about safety and operational traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a structured, front-loaded list where each operation and parameter has its own line. It is long but packs in necessary detail without redundancy. The minor typo 'Realtionship' is the only blemish, but the structure is effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter tool with no output schema, the description thoroughly covers operation variants and parameter requirements. It is missing explicit return-value descriptions (e.g., what shortest_path returns), which an agent would need for downstream reasoning, but the input-side coverage is strong enough to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description is the sole documentation for parameters. It maps each parameter to specific info_types (e.g., 'start_node: Object ID of source node (for shortest_path)') and adds naming conventions and formats ('Comma-separated relationship filter', 'fuzzy or exact'), going well beyond the bare schema titles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states it 'Perform[s] graph analysis operations in BloodHound' and lists seven specific operation types (kinds, search, shortest_path, edge_composition, relay_targets, pathfinding, acl_inheritance). This is a specific, actionable verb-resource pairing that clearly distinguishes it from sibling tools like user_info or cypher_query.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for selecting the appropriate info_type by pairing each operation with a one-line purpose and its required/optional parameters (e.g., 'search - search for nodes by name (needs: query; optional: search_type)'). It does not explicitly mention when NOT to use the tool or compare to alternatives, but the context is sufficient for correct selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

group_infoA

Query group data from BloodHound. info_type options: info - general group properties and attributes admin_rights - machine/objects this group has admin rights on controllables - objects this group can control controllers - principals that have control over this group dcom_rights - machines this group can execute DCOM on members - users and groups that are members of this group memberships - groups this group belongs to (nested membership) ps_remote_rights - machines this group can PSRemote to rdp_rights - machines this group can RDP to sessions - machines this group has active sessions on args: group_id: BloodHound object ID of the group (required) info_type: what to retrieve (default: info) limit: Max Results (default 100, useful in large environments) skip: Pagination offset (default 0)

ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
group_idYes
info_typeNoinfo

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden of behavioral disclosure. It indicates a read-only query operation and discloses pagination via limit and skip parameters. However, it does not mention permissions, error behavior, or return format, which are relevant for an agent to understand what will happen.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with a clear opening sentence, a bulleted list of info_type options, and a labeled args section. Every line is informative and there is no redundant or vague content. It remains concise despite covering many options.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers all parameters and enumerates the full set of info_type options, giving a complete picture of the tool's capabilities. It lacks explicit details about return structure or error handling, but for a simple query tool with no output schema, this is a minor gap. Overall it is sufficiently complete for an agent to use effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so thoroughly: each parameter is explained with its purpose, default value, and additional context (e.g., limit is 'useful in large environments'). This adds significant meaning beyond the bare schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb and resource, 'Query group data from BloodHound,' and then enumerates the exact info_type options, making it unambiguous what the tool does. It clearly distinguishes itself from sibling tools that target other entity types like user_info or domain_info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool by listing all retrievable group-related info types (info, members, sessions, etc.). It implies it is the go-to for group data, but it does not explicitly name alternatives or state when not to use it. The context is sufficient, but exclusions are not mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

operations_infoA

Query read-only BloodHound Enterprise operational status and meta data.

info_type options:
    datapipe_status - get datapipe status
    analysis - get analysis request information
    meta_nodes - get latest tier zero combo node for a domain (requires: domain_id)
    meta_tree - get the meta tree graph for a domain (requires: domain_id)
    meta_entity - get meta entity info (requires: object_id)

args:
    info_type: what to retrieve (default: datapipe_status)
    domain_id: domain ID for meta_nodes/meta_tree
    object_id: object ID for meta_entity
ParametersJSON Schema
NameRequiredDescriptionDefault
domain_idNo
info_typeNodatapipe_status
object_idNo

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explicitly states 'read-only,' which reveals the non-mutating nature of the tool, and it notes parameter prerequisites for specific info types. However, it does not disclose output structure, error behavior, response format, or any rate limits or permission requirements. Since annotations are absent, the description carries the full burden, and this level of detail is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a one-sentence purpose, then uses compact bullet-like lines to list info_type options and args. Each line earns its place, and there is minimal fluff. Some redundancy exists (e.g., 'get' repeated), but overall it is well-structured and not overly long.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers all parameters and options, but it lacks details on return values or error handling. Since there is no output schema, the description would need to describe what each info_type returns to be fully complete. As it stands, an agent knows what to query but not what response to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides no descriptions (0% coverage), but the description fully explains every parameter: info_type lists valid options and default, domain_id is tied to meta_nodes/meta_tree, and object_id to meta_entity. This goes well beyond the schema and gives the agent all the needed semantic information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Query read-only BloodHound Enterprise operational status and meta data.' It then enumerates distinct info_type options, each with a clear purpose, making it obvious what the tool does and differentiating it from sibling tools that focus on entity information (e.g., domain_info, entity_info).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The tool provides clear context for when to use it—'read-only operational status and meta data'—and details the available info_type options with their required parameters (e.g., 'requires: domain_id' for meta_nodes). It does not mention exclusions or alternative tools, but the context is sufficient for an agent to decide when to invoke it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ou_infoA

Query OU data from BloodHound. info_type options: info - general OU Properties and attributes computers - computers in this OU groups - groups in this OU gpos - GPOs linked to this OU users - users in this OU args: ou_id: BloodHound object ID of the OU (required) info_type: what to retrieve (default: info) limit: Max Results (default 100, useful in large environments) skip: Pagination offset (default 0)

ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
ou_idYes
info_typeNoinfo

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description partially discloses behavior: it is a query operation, includes pagination via limit and skip with defaults, and lists info_type options. However, it does not describe the return format or any potential side effects, which leaves a gap in transparency for an unannotated tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with an initial summary, a list of info_type options, and a parameter list. It is slightly verbose but every section adds value; the argument explanations are not redundant with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter tool with no output schema, the description covers purpose, parameters, and pagination but lacks any mention of return structure or error handling. It is adequate for basic invocation but not fully complete for an agent expecting response details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fully compensates by explaining each parameter: ou_id is a required BloodHound object ID, info_type lists all valid options, limit is described as max results useful in large environments, and skip is a pagination offset. This adds significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool queries OU data from BloodHound, with a specific verb and resource. It enumerates distinct info_type options (info, computers, groups, gpos, users) that clarify the scope and distinguish it from sibling tools targeting other entity types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied: use when you need OU-specific data. However, there is no explicit comparison to alternatives like entity_info or domain_info, nor any 'when not to use' guidance. The description relies on the tool name and info_type options to convey applicability.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

risk_postureA

Query BloodHound Enterprise risk posture data.

info_type options:
    stats - get current posture statistics
    history - get posture history for a data type (needs: data_type)

args:
    info_type: what to retrieve (default: stats)
    data_type: posture history data type for history queries
ParametersJSON Schema
NameRequiredDescriptionDefault
data_typeNo
info_typeNostats

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the two behavioral modes (stats and history) and the prerequisite for history, but does not mention read-only nature explicitly, error handling, or response format. The behavioral info is present but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is succinct, with a clear opening sentence followed by an organized list of options. Every sentence adds informative value, and it's front-loaded with the purpose. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description should cover return values, but it doesn't specify what the statistics or history response contains. It adequately explains parameters and query types, but for a standalone tool, key details about output shape are missing. It's sufficient for basic usage but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must add meaning. It does explain info_type values ('stats' and 'history') and that data_type is needed for history queries, which goes beyond the plain schema. However, data_type remains vague, without listing valid data types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Query BloodHound Enterprise risk posture data' with a specific verb and resource. It further breaks down info_type options (stats and history), making the tool's purpose unmistakable. While it doesn't explicitly contrast with sibling tools, the resource name is distinct enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides usage context by explaining the info_type options and that history requires data_type. However, it does not mention when to use this tool over related siblings like data_quality or enterprise_info, nor any exclusions. This is implied usage rather than explicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

user_infoA

Query user data from BloodHound info_type options: info - General user properties and attributes admin_rights - machine/objects this user has admin rights on constrained_delegation - services this use can delegate to via kerberos controllables - objects this use can control (WriteOwner, GenericAll, etc.) controllers - principals that have control over this user dcom_rights - machines this user can execute DCOM on memberships - groups this user belongs to ps_remote_rights - machines this user can PSRemote to rdp_rights - machines this user can RDP to sessions - machines this user has active sessions sql_admin_rights - SQL servers this user is admin on

Args:
    user_id: BloodHound object ID of the user (required)
    info_type: what to retrieve (default: info)
    limit: Max Results (default 100, useful in large environments)
    skip: Pagination offset (default 0)
ParametersJSON Schema
NameRequiredDescriptionDefault
skipNo
limitNo
user_idYes
info_typeNoinfo

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full transparency burden. It discloses what each info_type returns (e.g., 'admin_rights - machine/objects this user has admin rights on') and describes pagination via limit/skip parameters. It stops short of stating side effects (none expected for a query) or auth requirements, but the read-only nature is implicitly clear from 'Query'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a concise opening, a bulleted list of info_type options, and a clear Args section. It is longer than average, but each line adds unique value for a tool with many retrieval modes. No redundant filler, though the typos ('delegate to via kerberos') are minor flaws.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (12 info types plus pagination) and the absence of an output schema, the description covers all parameter semantics and usage context adequately. It does not describe the format of returned results, but the instruction states this isn't necessary without an output schema. The pagination guidance is a useful extra for large environments.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions are entirely absent (0% coverage), so the description fully compensates by documenting every parameter: user_id is required, info_type has a default and enumerates all valid values, and limit/skip are explained with defaults and use cases ('useful in large environments'). This is exemplary parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb + resource ('Query user data from BloodHound') and enumerates 12 distinct info_type options, making the tool's purpose unmistakable and distinguishing it from siblings like computer_info or entity_info. The list of retrievable data types adds precision beyond the generic tool name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly frames the tool for querying user data and provides an exhaustive list of info_type options, guiding an agent on what can be retrieved. It does not explicitly name alternative tools or state when not to use this tool, but the user-specific scope is evident from the name and context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 20 tool updatesv0.1.0
    • First observedadcs_info
    • First observedasset_groups
    • First observedattack_paths
    • First observedcollection_info
    • First observedcomputer_info
    • First observedcustom_nodes
    • First observedcypher_query
    • First observeddata_quality
    • First observeddomain_info
    • First observedenterprise_admin
    • First observedenterprise_info
    • First observedentity_info
    • First observedfile_upload
    • First observedgpo_info
    • First observedgraph_analysis
    • First observedgroup_info
    • First observedoperations_info
    • First observedou_info
    • First observedrisk_posture
    • First observeduser_info

TDQS

A3.9/5.0

Scored across 20 tools

Disambiguation4/5

Most tools target distinct entity types or domains (group, user, computer, domain, GPO, OU, ADCS, etc.), but there is some potential confusion between graph_analysis and cypher_query (both can explore paths) and between enterprise_info, operations_info, and collection_info which all deal with BHE system metadata. Descriptions are detailed enough to disambiguate in most cases.

Naming Consistency3/5

Tool names are all snake_case and readable, but there is no consistent verb_noun pattern. Many use an '_info' suffix (group_info, user_info, computer_info), while others are noun phrases (asset_groups, attack_paths, cypher_query) or verb phrases (file_upload). This mix is acceptable but not a uniform convention.

Tool Count4/5

20 tools is on the higher end but appropriate given the breadth of the BloodHound Enterprise API. Each tool covers a distinct functional area, and many pack multiple sub-operations via info_type, so the count is justified without being excessive.

Completeness4/5

The tool set covers major BloodHound domains: entity queries, graph analysis, cypher execution, attack paths, enterprise admin, file upload, collection status, and data quality. Minor gaps exist, such as limited Azure entity support and missing some niche BHE endpoints, but the surface is generally comprehensive for common workflows.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    C
    quality
    D
    maintenance
    An extension that allows Large Language Models to interact with and analyze Active Directory environments through natural language queries instead of manual Cypher queries.
    100
    160
    -
  • A
    license
    C
    quality
    D
    maintenance
    Enables LLMs to perform Active Directory penetration testing using tools like NetExec, Bloodhound, Nmap, Certipy, and John the Ripper. Automates vulnerability discovery, attack path analysis, and documentation generation for security assessments.
    26
    6
    MIT
  • A
    license
    B
    quality
    B
    maintenance
    Enables security professionals to query and analyze Active Directory attack paths from BloodHound Community Edition data using natural language through Claude Desktop's Model Context Protocol interface.
    79
    132
    GPL 3.0
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables natural language threat hunting and incident response by connecting LLMs to enterprise security data sources like Elasticsearch, EVTX logs, PCAP files, and Velociraptor.
    206
    GPL 3.0