bhe_mcp
Provides tools for running Cypher queries on the BloodHound Enterprise Neo4j graph database, enabling attack path analysis, risk posture assessment, and exploration of Active Directory, Azure/Entra ID, and OpenGraph environments.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@bhe_mcpFind the shortest path from user 'alice' to Domain Admins."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
BloodHound Enterprise MCP
A Model Context Protocol (MCP) server that connects LLMs to BloodHound Enterprise. Ask questions in natural language, get attack path analysis, run Cypher queries, and explore Active Directory, Azure/Entra ID, and OpenGraph environments — all from your AI assistant.
Fork Attribution
This project is a fork of mwnickerson/bloodhound_mcp. The original project and its contributors created the BloodHound MCP foundation this fork builds on.
This fork modifies the original BloodHound Community Edition-focused implementation for BloodHound Enterprise API coverage, multi-tenant MCP configuration, expanded endpoint wrappers, Enterprise attack path/risk posture workflows, and BHE-specific documentation. The project remains licensed under GPL-3.0; see LICENSE and NOTICE.
Related MCP server: PentestMCP
How It Works
The server exposes BloodHound Enterprise's REST API and Neo4j graph through a set of composite MCP tools, reference resources, and a system prompt tuned for offensive security analysis.
Composite Tools
Each tool uses an info_type parameter to select what data is returned, keeping the tool surface small and token-efficient:
Tool |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Resources
Reference material the LLM loads on demand — no extra API calls:
Resource URI | Contents |
| Cypher syntax, schema, property names, patterns |
| Quick query-building syntax patterns |
| Supported BloodHound Cypher syntax, caveats, and unsupported constructs |
| Battle-tested templates: DCSync, Kerberoasting, GPO abuse, delegation, ADCS, shadow credentials, NTLM relay, and more |
| AD node types and relationships quick reference |
| Full AD attack methodology and workflow |
| Azure/Entra ID analysis quick reference |
| Full Azure attack chains |
| ADCS ESC1–ESC13 quick reference |
| Detailed ESC analysis and exploitation |
| Custom node schema design and best practices |
| SQL Server and Web App OpenGraph examples |
System Prompt
The bloodhound_assistant prompt includes behavioral rules that guide the LLM:
Load the offensive query library before writing Cypher for any attack scenario
Never draw privilege conclusions without checking group memberships and
admincountRespect BloodHound's property naming conventions (
hasspn,enabled,admincount— all lowercase)Handle uppercase name storage (
DOMAIN ADMINS@CORP.LOCAL) correctly in filtersFollow proper DCSync and GPO edge traversal patterns
Prerequisites
Python 3.11+
BloodHound Enterprise instance with data loaded
BloodHound API credentials (Token ID + Token Key)
Installation
git clone https://github.com/mwnickerson/bloodhound_mcp.git ~/git/bhe_mcp
cd ~/git/bhe_mcp
uv syncCreate a .env file in the project root:
BLOODHOUND_DOMAIN=your-bloodhound-instance.domain.com
BLOODHOUND_TOKEN_ID=your-token-id
BLOODHOUND_TOKEN_KEY=your-token-keyThe server defaults to https on port 443. Override if needed:
BLOODHOUND_PORT=8080
BLOODHOUND_SCHEME=httpConfiguration
Claude Desktop
Add to claude_desktop_config.json:
{
"mcpServers": {
"bhe_mcp": {
"command": "uv",
"args": [
"--directory",
"/path/to/bhe_mcp",
"run",
"main.py"
]
}
}
}Claude Code
Add to ~/.claude/mcp.json:
{
"mcpServers": {
"bhe_mcp": {
"type": "stdio",
"command": "uv",
"args": [
"--directory",
"/path/to/bhe_mcp",
"run",
"main.py"
]
}
}
}OpenAI Codex CLI
Add to ~/.codex/config.toml (or .codex/config.toml for project-scoped config):
[mcp_servers.bhe_mcp]
command = "uv"
args = ["--directory", "/path/to/bhe_mcp", "run", "main.py"]Since the server loads credentials from .env automatically, no env block is needed. If you prefer to pass them explicitly:
[mcp_servers.bhe_mcp]
command = "uv"
args = ["--directory", "/path/to/bhe_mcp", "run", "main.py"]
[mcp_servers.bhe_mcp.env]
BLOODHOUND_DOMAIN = "your-bloodhound-instance.domain.com"
BLOODHOUND_TOKEN_ID = "your-token-id"
BLOODHOUND_TOKEN_KEY = "your-token-key"For multiple BHE tenants, point each MCP server at the same checkout and give each one its own env file. This keeps demo and maplesyrup distinct by server name and by the codename in the env file path:
[mcp_servers.bloodhound_demo]
command = "uv"
args = ["--directory", "/path/to/bhe_mcp", "run", "main.py"]
[mcp_servers.bloodhound_demo.env]
UV_CACHE_DIR = "/path/to/uv-cache"
BLOODHOUND_ENV_FILE = "/path/to/bloodhound_demo.env"
[mcp_servers.bloodhound_maplesyrup]
command = "uv"
args = ["--directory", "/path/to/bhe_mcp", "run", "main.py"]
[mcp_servers.bloodhound_maplesyrup.env]
UV_CACHE_DIR = "/path/to/uv-cache"
BLOODHOUND_ENV_FILE = "/path/to/bloodhound_maplesyrup.env"MCP Inspector
Command:
uvArgs:
--directory /path/to/bhe_mcp run main.py
BloodHound API Token
Log into BloodHound Enterprise
Navigate to Administration → API Tokens
Create a new token and copy the Token ID and Token Key into your
.env
Usage
Example Queries
Reconnaissance:
What domains are in BloodHound?
Show me all Domain Admins in CORP.LOCAL
Find all kerberoastable users
Which computers have unconstrained delegation?User and Group Analysis:
What admin rights does jsmith@corp.local have?
Show me all sessions for the administrator account
What groups is this user a member of?
Who controls the IT ADMINS group?Attack Path Analysis:
Find the shortest path from jsmith@corp.local to Domain Admins
Who has DCSync rights in the domain?
Show me all GPO abuse paths
Find ADCS ESC1 paths in the domainCustom Cypher:
Run a Cypher query to find all users with SPN set and admincount=1
Find all computers where DOMAIN USERS can RDPOpenGraph Support
BloodHound 8.0+ supports custom node types via OpenGraph, letting you model non-AD infrastructure (cloud resources, databases, custom assets) in the same graph as Active Directory.
The custom_nodes tool handles legacy CRUD operations on node type display configurations through /api/v2/custom-nodes. For BloodHound v9.0.0+ instances with OpenGraph extension management enabled, the same composite tool also supports /api/v2/extensions and /api/v2/extensions-edges via extension_list, extension_upsert, extension_delete, and extension_edges.
Use the bloodhound://opengraph/guide and bloodhound://opengraph/examples resources for schema design and Cypher patterns. For structured OpenGraph schemas, upsert the extension schema first, then ingest collection data with file_upload.
Requires BloodHound 8.0 or later. OpenGraph extension management requires BloodHound 9.0.0+ and the corresponding feature flag to be enabled.
Security Considerations
BloodHound data processed through this tool is transmitted to your LLM provider's servers. Do not use this with production AD data unless you have assessed that risk.
Recommended use cases:
Lab environments (GOAD, DetectionLab, custom ranges)
Training and certification prep
Research and tool development
Non-production domain analysis
Best practices:
Rotate BloodHound API tokens regularly
Use a read-only API token where possible
Consider a local LLM bridge for sensitive environments
Testing
# Full test suite
uv run pytest
# Specific modules
uv run pytest tests/test_main_mcp_tools.py -v
uv run pytest tests/test_bloodhound_api.py -v
# Integration tests (requires a live BloodHound instance)
BLOODHOUND_INTEGRATION_TESTS=1 uv run pytest tests/test_integration.py -vContributing
Contributions are welcome. Open an issue to discuss significant changes before submitting a PR.
Fork the repo
Create a feature branch
Add tests for new functionality
Run
uv run pytestand confirm everything passesSubmit a pull request
Acknowledgments
SpecterOps for BloodHound
Orange Cyberdefense for GOAD (used for testing)
@jlowin for FastMCP
@xpn for MCP inspiration via the Mythic MCP project
License
GNU General Public License v3.0 — see LICENSE for details.
Available Tools
20 toolsadcs_infoA
QUery AD Certificate Services data from BloodHound object_id is the template_id or the ca_id depending on the info_type info_type options: cert_template_info - certificate template properties (object_id = template ID) cert_template_controllers - who can modify this template - key for ESC1/ESC2 (object_id = template ID) cert_template_published_to_cas - Enterprise CAs publishing this template root_ca_info - root ca properties (object_id = CA ID) root_ca_controllers - who controls the root ca - key for ESC4/ESC5 (object_id = CA ID) root_ca_pki_hierarchy - PKI hierarchy for a root CA enterprise_ca_info - enterprise CA properties (object_id = CA ID) enterprise_ca_controllers - who controls the enterprise CA - key for ESC3/ESC6 (object_id = CA ID) enterprise_ca_pki_hierarchy - PKI hierarchy for an enterprise CA enterprise_ca_published_templates - templates published to this enterprise CA aia_ca_info - AIA CA properties aia_ca_controllers - who controls the AIA CA (object_id = CA ID) aia_ca_pki_hierarchy - PKI hierarchy for an AIA CA nt_auth_store_info - NT Auth Store properties nt_auth_store_controllers - controllers of an NT Auth Store nt_auth_store_trusted_cas - trusted Enterprise CAs for an NT Auth Store
args:
object_id: Template ID or CA ID depending on info_type (required)
info_type: what to retrieve (required)
limit: Max Results (default 100, useful in large environments)
skip: Pagination offset (default 0)
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| info_type | Yes | ||
| object_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the burden. It states it is a query operation and mentions pagination parameters, but does not explicitly disclose side effects, authentication needs, or return format. The read-only nature is implied but not stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but well-structured with a purpose statement up front and a clear bulleted list of info_type options. Every line adds necessary detail; it is not padded, though it could be slightly more concise by grouping similar options.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description compensates by explaining what each info_type returns (properties, controllers, hierarchy, etc.) and the pagination parameters. It lacks explicit return structure, but for a query tool with many options, this is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description significantly enriches the parameter definitions by explaining exactly what object_id means (template ID or CA ID depending on info_type), listing all possible info_type values, and defining limit and skip for pagination. This far exceeds the sparse schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool queries AD Certificate Services data from BloodHound, with a specific resource and action. It distinguishes itself from sibling tools by focusing on ADCS-specific info types rather than general entity info.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on how object_id relates to info_type and enumerates all valid info_type values with explanations. Does not explicitly mention alternatives or when to avoid, but the exhaustive list gives strong usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
asset_groupsA
Manage Asset isolation groups and tages in BloodHound
info_type options:
list - list all asset groups (optional filters: name, tag, sort_by, system_group)
get - get a specific asset group (requires: asset_group_id)
create - create a new asset group (requires: name, tag)
update - update an existing asset group (requires: asset_group_id)
delete - delete an asset group (requires: asset_group_id)
collections - list historical membership snapshots (requires: asset_group_id)
custom_selectors - get custom selector/member count (requires: asset_group_id)
members - list asset group members (requires: asset_group_id)
member_counts - get member counts by object type (requires: asset_group_id)
combo_node - get the combo tree for an asset group (requires: asset_group_id)
create_selectors - add auto membership selectors (requires: asset_group_id, selectors_json)
update_selectors - set auto membership selectors (requires: asset_group_id, selectors_json)
delete_selector - delete an asset group selector (requires: asset_group_id, asset_group_selector_id)
list_tags - list asset group tags (optional: name, tag, sort_by)
create_tag - create a new asset group tag (requires: name, tag)
tag_members - list members of a tag (requires: asset_group_tag_id)
tag_member_selectors - get selectors for a tag member (requires: asset_group_tag_id, asset_group_member_id)
tag_member_counts - get tag member counts (requires: asset_group_tag_id)
tag_selectors - list tag selectors (requires: asset_group_tag_id)
tag_selector_members - list members for a tag selector (requires: asset_group_tag_id, asset_group_tag_selector_id)
tag_selector_member_counts - count members for a tag selector (requires: asset_group_tag_id, asset_group_tag_selector_id)
preview_tag_selectors - preview selectors (requires: request_json)
search_tags - search asset group tags (requires: request_json)
tag_history - list tag history records
search_tag_history - search tag history records (requires: request_json)
certifications - get certifications for privilege zones
update_certifications - certify or revoke objects (requires: request_json)
args:
info_type: operation to perform (default: list)
asset_group_id: Asset group ID (for get, update, delete, collections, member_counts, update_selectors)
asset_group_tag_id: Tag ID (for tag_members)
name: Group/tag name (for create, update, create_tag, or filters)
tag: Tag value (for create, update, create_tag, or filters)
sort_by: Sort field (for list, list tags)
system_group: Filter by system group (for list)
selectors_json: JSON array of selector specs (for update_selectors)
request_json: JSON request body for preview/search/certification actions
skip: Pagination offset (default 0)
limit: Max results (default 100)
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | ||
| name | No | ||
| skip | No | ||
| limit | No | ||
| sort_by | No | ||
| info_type | No | list | |
| request_json | No | ||
| system_group | No | ||
| asset_group_id | No | ||
| selectors_json | No | ||
| asset_group_tag_id | No | ||
| asset_group_member_id | No | ||
| asset_group_selector_id | No | ||
| asset_group_tag_selector_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It lists mutating operations (create, update, delete) and parameter requirements, but it does not describe side effects, permission needs, reversibility, or response formats. For a mutation-heavy tool, omitting such details leaves the agent without knowledge of consequences or preconditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but well-structured: a one-line summary, a categorized list of 24 operations, and an arg listing. It front-loads the purpose and uses a consistent, scannable format. While every line is informative, the sheer volume and repetition of parameter lists prevent a perfect score for conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 14 parameters, no annotations, no output schema, and 24 operations, the description is remarkably thorough on operation semantics and parameter requirements. It falls short on describing return values, error behavior, or output formats, which would be necessary for an agent to interpret results. Given the complexity, the coverage is strong but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description fully compensates. Each of the 14 parameters is described with its purpose and the specific info_types it applies to (e.g., 'asset_group_tag_id: Tag ID (for tag_members)'). It also documents defaults for skip/limit and explains JSON request parameters (selectors_json, request_json), providing all necessary semantics beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Manage Asset isolation groups and tages in BloodHound,' providing a clear verb+resource pair. It enumerates 24 distinct info_type sub-operations, which distinguishes it from sibling tools like group_info or domain_info by focusing on the asset-groups feature. However, the verb 'Manage' is generic and could be more specific (e.g., 'List, create, update, and delete'), preventing a top score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives detailed guidance on required parameters for each info_type (e.g., 'get - get a specific asset group (requires: asset_group_id)'), which helps an agent select the correct operation. It does not, however, reference sibling tools or state when this tool should be used instead of another, nor does it provide exclusions. Usage context is implied by the resource (asset groups and tags) but not explicitly framed against alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
attack_pathsA
Query BloodHound Enterprise attack path data.
info_type options:
domain_findings - export attack path findings for a domain (needs: domain_id)
finding_trends - list attack path finding trends
types - list all attack path types
start_analysis - start attack path analysis
details - get all attack path findings with details
domain_available_types - list attack path types available in a domain (needs: domain_id)
domain_details - list attack path details for a domain (needs: domain_id)
domain_sparkline - list attack path sparkline values for a domain (needs: domain_id)
acceptance - update attack path risk acceptance (needs: attack_path_id, acceptance_json)
args:
info_type: what to retrieve or update (default: details)
domain_id: Domain object ID for domain-scoped attack path endpoints
attack_path_id: Attack path finding ID for risk acceptance
acceptance_json: JSON string or object accepted by the BHE risk acceptance API
finding_name: Case-insensitive filter for finding/type/name fields
source_name: Case-insensitive filter for source fields
target_name: Case-insensitive filter for target fields
environment_id: Case-insensitive filter for environment/domain fields
accepted: Filter findings by accepted/risk acceptance state
| Name | Required | Description | Default |
|---|---|---|---|
| accepted | No | ||
| domain_id | No | ||
| info_type | No | details | |
| source_name | No | ||
| target_name | No | ||
| finding_name | No | ||
| attack_path_id | No | ||
| environment_id | No | ||
| acceptance_json | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations available, the description carries the full burden. It does disclose that 'acceptance' updates risk acceptance and 'start_analysis' initiates analysis, indicating non-read operations, but it doesn't discuss side effects, permissions, reversibility, or return behavior. This is moderate disclosure but leaves important behavioral unknowns for a tool with mutation capabilities.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured, starting with a clear purpose and then using organized lists for info_type options and arguments. It is dense but not bloated, and every line serves to explain a mode or parameter. It's slightly lengthy due to the tool's complexity, but the structure makes it easy to navigate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with no output schema and no annotations, the description covers all operation modes and parameter semantics, which is sufficient for correct selection and invocation of most options. However, it lacks details on the shape of returned data, pagination, error handling, or authentication requirements, leaving some gaps for a fully complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Since schema description coverage is 0%, the description compensates by explaining all 9 parameters, including their purpose, required associations (e.g., domain_id for domain-scoped endpoints), filter case-insensitivity, and type for acceptance_json. It adds significant meaning beyond the bare schema titles, though some parameter descriptions remain terse.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Query BloodHound Enterprise attack path data' and then enumerates nine specific operation types via info_type, covering finding export, trends, analysis, and risk acceptance. This makes the tool's purpose and scope unambiguous, and distinguishes it from general graph analysis or Cypher query tools among the siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context for each info_type, indicating required parameters per mode (e.g., 'domain_findings - needs: domain_id') and noting the default value for info_type (details). It does not explicitly contrast with sibling tools or state when NOT to use this tool, so it falls slightly short of full guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
collection_infoA
Query BloodHound Enterprise collection infrastructure status.
info_type options:
collector_manifest - get collector manifest (needs: collector_type)
collector_checksum - get collector checksum (needs: collector_type, release_tag)
kennel_manifest - get kennel manifest
kennel_enterprise_manifest - get kennel enterprise manifest
clients - list clients
client - get a client (needs: client_id)
client_completed_tasks - list completed tasks for a client (needs: client_id)
client_completed_jobs - list completed jobs for a client (needs: client_id)
jobs_available - list available jobs
jobs_finished - list finished jobs
jobs - list jobs
job_current - get current job
job - get a job (needs: job_id)
job_log - get job log (needs: job_id)
tasks_available - list available tasks
tasks_finished - list finished tasks
tasks - list tasks
task_current - get current task
task - get a task (needs: task_id)
task_log - get task log (needs: task_id)
events - list scheduled events
event - get scheduled event (needs: event_id)
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| job_id | No | ||
| task_id | No | ||
| event_id | No | ||
| client_id | No | ||
| info_type | No | clients | |
| asset_name | No | ||
| release_tag | No | ||
| collector_type | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It clearly states 'Query' (read-only) and details all operations and their parameter dependencies. It does not discuss authorization, rate limits, or error behavior, but for a status query tool, the disclosed information is substantial and accurate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with its purpose and then organized as a clean list of options with dependencies. Every line earns its place; the length is justified by the number of sub-operations. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (10 parameters, many info_type variants), the description covers all operation-specific requirements. It does not describe return values or error handling, but with no output schema and the read-only nature, the provided information is largely sufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does so admirably by listing each info_type and explicitly stating which parameters are required for each, effectively providing a full usage map. This adds critical meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear, specific verb+resource statement: 'Query BloodHound Enterprise collection infrastructure status.' It then enumerates all info_type options, which precisely distinguishes this from sibling tools like user_info or domain_info. The scope is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an extensive list of info_type values with their required parameters, giving clear context on when to use each subtype. It does not explicitly mention alternatives or when not to use the tool, but the sibling tool names and the focused scope make the intended usage obvious.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
computer_infoA
Query computer data from BloodHound. info_type options: info - general computer properties and attributes admin_rights - objects this computer has admin rights on admin_users - users/groups that have admin rights on this computer constrained_delegation - services this computer can delegate to via kerberos constrained_users - users with contained delegation TO this computer controllables - objects this computer can control controllers - principals that have control over this computer dcom_rights - machines this computer can execute DCOM on dcom_users - users/groups with DCOM rights ON this computer group_membership - groups this computer belongs to ps_remote_rights - machines this computer can PSRemote to ps_remote_users - users/groups with PSRemote rights ON this computer rdp_rights - machines this computer can RDP to rdp_users - users/groups with RDP rights ON this computer sessions - users with active sessions on this computer sql_admins - SQL servers this computer is admin on
args:
computer_id: BloodHound object ID of the computer (required)
info_type: what to retrieve (default: info)
limit: Max Results (default 100, useful in large environments)
skip: Pagination offset (default 0)
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| info_type | No | info | |
| computer_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It explains defaults and parameter effects but does not disclose output format, pagination behavior beyond skip/limit, or potential side effects (though it is a query tool). This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured with clear bullet points for info_type and args. Every line provides necessary information without redundancy, making it dense and effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's purpose, all parameters, all info_type behaviors, defaults, and required fields. Given no output schema, it is as complete as expected for a query tool, leaving little ambiguity for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description fully compensates by explaining every parameter, listing all info_type options with their meanings, and providing defaults for limit, skip, and info_type. This adds significant meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Query computer data from BloodHound' with a specific verb and resource, and enumerates distinct info_type options. This distinguishes it from sibling tools like user_info and group_info by focusing on computer-specific data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides detailed context for each info_type, making it clear what to use for various retrieval needs. However, it does not explicitly mention alternative tools or scenarios where this tool should not be used, which would strengthen the guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
custom_nodesA
Manage OpenGraph custom node display configs and v9 extension schemas. info_type options: list - list all custom node configs get - get details for a specific node kind (needs: kind_name) create - create new node kind with display metadata (needs: custom_types_json) update - update a node kind's display config (needs: kind_name, config_json) delete - delete a node kind (needs: kind_name) validate_icon - validate icon config before creating/updating (needs: icon_config_json) extension_list - list OpenGraph extensions (BloodHound v9+) extension_upsert - create/update extension schema (needs: extension_json or extension_file_path) extension_delete - delete extension schema by ID (needs: extension_id) extension_edges - list extension edge kinds (optional: schemas, is_traversable)
args:
info_type: what to retrieve (default: list)
kind_name: Custom node kind name (for get,update, delete)
custom_types_json: JSON string or object for creating a new node kind (for create)
config_json: JSON string or object for updating a node kind's display config (for update)
icon_config_json: JSON string or object for validating icon config (for validate_icon)
extension_json: JSON string or object for BloodHound v9 OpenGraph extension upsert
extension_file_path: local JSON file path for BloodHound v9 OpenGraph extension upsert
extension_id: OpenGraph extension ID for delete
schemas: schema name or list of schema names for extension edge filtering
is_traversable: bool or BloodHound filter string (for example: eq:true)
| Name | Required | Description | Default |
|---|---|---|---|
| schemas | No | ||
| info_type | No | list | |
| kind_name | No | ||
| config_json | No | ||
| extension_id | No | ||
| extension_json | No | ||
| is_traversable | No | ||
| icon_config_json | No | ||
| custom_types_json | No | ||
| extension_file_path | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does state that validate_icon is used 'before creating/updating', giving a workflow hint, and the operation names (delete, update) are relatively self-explanatory. However, it does not mention side effects such as permanence of delete, whether updates are immediate, or any permission/authorization requirements. This is a moderate gap for a management tool with destructive operations, so a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Although the description is relatively long, it is well-organized into a summary line, an info_type list, and an args list. Each line conveys necessary information without redundancy. The structure front-loads the core purpose then details each operation and its parameters, making it easy for an agent to scan and extract relevant details. It is appropriately sized for a tool with 10 parameters and 9 operation modes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description thoroughly covers the operations and their required parameters, which addresses the main selection and invocation concerns. However, since there is no output schema, it does not describe what the tool returns for each info_type (e.g., whether list returns an array, whether get returns a config object). This would be valuable for an agent to know the outcome. The description is otherwise complete for the tool's complexity, so this is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides no descriptions (0% coverage), so the description fully compensates. It explains each of the 10 parameters, including their purpose and the info_type operations they are needed for (e.g., 'kind_name: Custom node kind name (for get, update, delete)'). This adds substantial meaning beyond the schema's bare titles and defaults, giving the agent all required context for invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb phrase 'Manage OpenGraph custom node display configs and v9 extension schemas', identifying both the resource and action. It also enumerates all info_type operations (list, get, create, update, delete, etc.), making the tool's scope unmistakable and distinguishing it from sibling tools that focus on other entity types (e.g., group_info, computer_info).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly explains the usage by listing each info_type and the required arguments for each operation, which serves as a mini-guide for when to use which sub-operation. However, it does not explicitly state when not to use this tool or mention alternatives, nor does it contrast with sibling tools. The context of being the tool for custom node/extension configuration is implied but not spelled out in comparison form.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cypher_queryA
Execute and manage Cypher queries in BloodHound.
info_type options:
run - execute a cypher query (needs: query; optional: include_properties)
interpret - interpret a natural language query into cypher (needs: query, result_json)
list_saved - list saved queries (optional: name, skip, limit)
create_saved - save a new query (needs: name, query)
get_saved - get details of a saved query (needs: query_id)
update_saved - update an existing saved query (needs: query_id; optional: name, query, description)
delete_saved - delete a saved query (needs: query_id)
share_saved - share a saved query with other users (needs: query_id; optional: user_ids, public)
saved_permissions - get saved query permissions (needs: query_id)
export_saved - export a saved query (needs: query_id)
import_saved - import saved queries (needs: payload_json)
export_saved_many - export saved queries (optional: query_ids)
validate - validate a cypher query for syntax and semantics (needs: query)
args:
info_type: Operation to perform
query: Cypher query string (for run, create_saved, update_saved, validate)
include_properties: Include node/edge properties in results (for run, default: True)
name: Query name (for create_saved, update_saved, list_saved filter)
query_id: Saved query ID (for get_saved, update_saved, delete_saved, share_saved)
result_json: JSON result string from a previous run (for interpret)
description: Query description (for update_saved)
user_ids: Comma-separated user IDs to share with (for share_saved)
query_ids: Comma-separated saved query IDs to export
payload_json: JSON string/object for saved query import
public: Make query public (for share_saved, default: False)
limit: Max results (default 100)
skip: Pagination offset (default 0)
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| skip | No | ||
| limit | No | ||
| query | No | ||
| public | No | ||
| query_id | No | ||
| user_ids | No | ||
| info_type | Yes | ||
| query_ids | No | ||
| description | No | ||
| result_json | No | ||
| payload_json | No | ||
| include_properties | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It names operations like 'delete_saved' and 'update_saved' but does not mention side effects, permanence, permission requirements, or return behavior. The destructive nature of delete is only implicit through the operation name, leaving significant transparency gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Despite being long, the description is logically structured into 'info_type options' and 'args', with each item earning its place. It is front-loaded with a clear purpose statement and uses a consistent needs/optional format. No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (13 params, 13 operation modes, no output schema), the description covers operations and parameters well. However, it omits return value formats, error handling, and any examples, leaving the agent to guess what outputs to expect from actions like 'run' or 'interpret'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must fully compensate. It does so by listing all 13 parameters and explaining each one's purpose and applicable operations. This adds substantial meaning beyond the bare schema fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes and manages Cypher queries in BloodHound. The verb 'Execute and manage' plus the resource 'Cypher queries' distinguishes it from sibling info tools like domain_info or graph_analysis. The enumerated info_type operations further clarify its scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides detailed per-operation guidance (needs vs optional parameters), giving clear context for each action. However, it does not explicitly state when to choose this tool over siblings or provide exclusion criteria, so it falls short of a perfect 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
data_qualityA
Query data quality and collection statistics from BloodHound info_type options: completeness - overall database completeness stats (no params needed) ad_domain - collection quality over time for an AD domain (needs: domain_id) azure_tenant - collection quality over time for an azure tenant (needs: tenant_id) platform - aggregate quality stats for a platform (needs: platform_id - "ad" or "azure")
args:
info_type: what to retrieve (default: completeness)
domain_id: AD domain ID
platform_id: "ad" or "azure"
start: Start datetime in RFC-3339 format
end: end datetime in RFC-3339 format
sort_by: Sort field - "created_at" or "updated_at" (optional)
skip: Pagination offset (default 0)
limit: max results (default 100)
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | ||
| skip | No | ||
| limit | No | ||
| start | No | ||
| sort_by | No | ||
| domain_id | No | ||
| info_type | No | completeness | |
| tenant_id | No | ||
| platform_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It details the varying behavior for each info_type, parameter dependencies, and optional pagination/sorting. It implies a read-only query operation, which is appropriate for the tool's purpose. While it does not mention authentication or rate limits, the description provides substantive behavioral context beyond mere schema fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a brief purpose statement, a clear bulleted list of info_type options, and a separate args list. It is appropriately sized for the tool's complexity, with every line providing actionable information and no redundant filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (four modes, nine parameters) and lack of output schema/annotations, the description is largely complete. It covers all input semantics and mode-specific requirements. However, it does not describe the return value or response structure, which would be useful but is not critical for a query tool. The description overall is strong and sufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must fully compensate. It does so by documenting all nine parameters, including their purpose and required formats (e.g., 'start: Start datetime in RFC-3339 format', 'platform_id: "ad" or "azure"'). This is a complete and high-quality parameter explanation, exceeding what the minimal schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pair: 'Query data quality and collection statistics from BloodHound.' It then enumerates distinct info_type variants (completeness, ad_domain, azure_tenant, platform), which clearly delineates the tool's scope and differentiates each mode. This is specific and distinguishes from sibling tools like collection_info or risk_posture.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage guidance for each info_type, including which parameters are required for each (e.g., ad_domain needs domain_id, azure_tenant needs tenant_id). It does not explicitly mention alternatives or when not to use this tool, but the provided context strongly implies the appropriate use cases, making it clear enough for an agent to select this tool correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
domain_infoA
Query domain level data from BloodHound info_type options: list - list all domains (no domain_id needed) info - domain entity info (needs domain_id) search - search objects by name/ID (needs query param, domain_id not needed) users - users in the domain groups - groups in the domain computers - computers in the domain controllers - security prinicpals with control relationships gpos - Group Policy Objects ous - Organizational unites dc_syncers - Principals with DCSync rights foreign_admins - admins from other domains foreign_gpo_controllers - GPO controllers from other domains foreign_groups - groups with cross domain members foreign_users - users referenced across domains inbound_trusts - domains that trust this domain outbound_trusts - domains this domain trusts linked_gpos - linked GPOs in this domain adcs_escalations - ADCS escalation findings in this domain Args: info_type: what to retrieve (default: list) domain_id: Domain object ID (required for most info_types) query: Search text (for info_type=search only) object_type: Filter by type - User, computer, Group, GPO, OU, Domain, AZUer, etc. (search only) limit: Max Results (default 100, useful in large environments) skip: Pagination offset (default 0)
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| query | No | ||
| domain_id | No | ||
| info_type | No | list | |
| object_type | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the exact behavior of each info_type, parameter dependencies, and defaults (limit=100, skip=0). It highlights that search is limited to name/ID and object_type filtering, providing concrete behavioral specifics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear opening and organized list of info_type options. While long, every line adds necessary detail for a multi-mode tool; no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema or annotations, the description explains the tool's modes and parameters comprehensively. It lacks explicit output format or error details, but for a query tool, the return types are largely inferable from the info_type names.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description fully compensates by explaining every parameter: info_type options, domain_id necessity, query's purpose, object_type filter, and pagination controls. This goes far beyond the schema's bare titles and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool queries domain level data from BloodHound, and the extensive list of info_type options (list, info, search, users, groups, etc.) precisely defines its scope. This distinguishes it from sibling tools focused on specific entity types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for each info_type, noting when domain_id is required (e.g., info) and when query is needed (search). It implies domain-level queries are the tool's focus, but it does not explicitly name alternative tools for when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
enterprise_adminA
Query read-only BloodHound Enterprise administrative metadata.
info_type options:
self - get authenticated requester info
permissions - list permissions
permission - get a permission (needs: permission_id)
roles - list roles
role - get a role (needs: role_id)
users - list BloodHound users
users_minimal - list minimal user records
user - get a user (needs: user_id)
saml - list SAML providers
saml_sso - list SAML sign-on endpoints
saml_provider - get SAML provider (needs: saml_provider_id)
sso_providers - list SSO providers
sso_signing_certificate - get SSO signing certificate (needs: sso_provider_id)
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| role_id | No | ||
| user_id | No | ||
| info_type | No | self | |
| permission_id | No | ||
| sso_provider_id | No | ||
| saml_provider_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly states 'read-only,' which is a key behavioral trait, especially with no annotations provided. It also lists parameter requirements for each info_type (e.g., 'needs: permission_id'). However, it does not describe pagination behavior (skip/limit), response formats, or potential errors. This is adequate but not rich, given the lack of annotations and output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is effectively structured as a bullet-like list of info_type options, front-loaded with a one-sentence purpose. It is concise for the number of options it covers, with each line adding specific value. It avoids unnecessary prose and is easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters, no annotations, and no output schema, the description provides a functional overview and explains most ID parameters. However, it lacks details on pagination (skip/limit) application, return values, and any nuances like default info_type='self'. This is sufficient for basic selection and invocation but leaves some gaps for an agent to fully understand behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates well by mapping info_type options to the required ID parameters (permission_id, role_id, user_id, saml_provider_id, sso_provider_id). This gives meaning beyond the raw schema. It does not explain skip/limit, but these are common pagination parameters and less critical for the tool's core functionality.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Query read-only BloodHound Enterprise administrative metadata.' This is a specific verb (query), resource (administrative metadata), and mentions read-only. It distinguishes from siblings like user_info or domain_info by focusing on admin-level metadata, and the info_type options further clarify the scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context on available info_type options, implying when to use this tool (for admin metadata queries). However, it does not explicitly state when to use this tool over alternatives like enterprise_info or provide exclusions. The guidance is implied rather than explicit, so it meets the minimum but lacks comparative direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
enterprise_infoA
Query read-only BloodHound Enterprise service information.
info_type options:
version - get API version metadata
spec - get the OpenAPI specification
audit - list audit logs
config - list application configuration parameters
features - list feature flags
args:
info_type: what to retrieve (default: version)
skip: audit pagination offset
limit: audit pagination limit
sort_by: optional audit sort field
status: optional audit status filter
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| status | No | ||
| sort_by | No | ||
| info_type | No | version |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the read-only nature upfront and explains behavior for each info_type (e.g., 'get API version metadata', 'list audit logs'). It does not mention authentication requirements, error behavior, or rate limits, which would be valuable given no annotations exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized with a clear opening line, a list of options, and a list of args. No redundant information; each line adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the full scope of the tool: multiple info_type variants and all parameters. It does not specify return formats in detail, but since no output schema exists, the description's per-type descriptions (e.g., 'get the OpenAPI specification') provide adequate expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All five parameters are described in the description (e.g., 'skip: audit pagination offset', 'limit: audit pagination limit'), adding meaning beyond the bare schema which has no descriptions. The descriptions are concise but sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Query read-only BloodHound Enterprise service information' and enumerates distinct info_type sub-operations, distinguishing it from sibling entity-specific info tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context that this tool is for service-level information (version, spec, audit, config, features) and not for entity-specific data. However, it does not explicitly name alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
entity_infoA
Query generic BHE entity endpoints not covered by a specific composite tool.
info_type options:
base_info - AD base entity info (needs: object_id)
base_controllables - controllable objects for a base entity (needs: object_id)
base_controllers - controllers of a base entity (needs: object_id)
container_info - container entity info (needs: object_id)
container_controllers - controllers of a container entity (needs: object_id)
azure_entity - generic Azure entity lookup by entity type (needs: entity_type)
args:
info_type: what to retrieve
object_id: AD object ID for base/container endpoints
entity_type: Azure entity type path segment
limit: max results for list endpoints
skip: pagination offset for list endpoints
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| info_type | Yes | ||
| object_id | No | ||
| entity_type | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses operation variants and argument requirements but does not explicitly state whether the tool is read-only, the return format, or any side effects. Since this is a query-style tool, the risk is low, but behavioral transparency is only partially addressed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently organized with a bulleted list of info_type options and a compact args section. The only minor redundancy is restating parameters in the args list after already describing them in the options, but overall the structure aids scanning and comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (5 params, multiple endpoint types, no output schema), the description covers all required inputs and use cases. It lacks expected return shapes or examples, but the endpoint enumeration and parameter guidance make the tool usable. A slightly higher score would require additional context on response structures or error behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must fully compensate. It explains each info_type option and which parameters each requires, and it defines the roles of object_id, entity_type, limit, and skip. This exceeds the bare schema by providing meaningful operational semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Query generic BHE entity endpoints' and explicitly distinguishes it from 'a specific composite tool,' signaling it's for cases not covered elsewhere. It enumerates the exact info_type sub-operations, making the tool's scope unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'not covered by a specific composite tool' gives clear contextual guidance for when to use this tool versus the many sibling info tools. It does not explicitly list alternative tool names or exclusion conditions, but the sibling set and per-option prerequisites (e.g., 'needs: object_id') provide implied usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_uploadA
Upload SharpHound/AzureHound collection files to BloodHound for ingest. Accepts .zip (SharpHound ZIP archive) or .json (individual collection file).
info_type options:
upload - full workflow for a single file: start -> upload -> end
(requires: file_path)
start_job - start a new upload job, returns job_id for multi-file uploads
upload_to_job - upload a file to an existing job (requires: job_id, file_path)
end_job - finalize an upload job and trigger ingest (requires: job_id)
list_jobs - list file upload jobs
completed_tasks - get completed tasks for an upload job (requires: job_id)
accepted_types - list accepted upload content types
Args:
info_type: operation to perform (default: upload)
file_path: absolute path to collection file (.zip or .json)
job_id: upload job ID (required for upload_to_job and end_job)
skip: pagination offset for list_jobs
limit: pagination limit for list_jobs
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| job_id | No | ||
| file_path | No | ||
| info_type | No | upload |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It effectively describes the workflow stages (start -> upload -> end), states that end_job 'triggers ingest', and lists requirements for each operation. It doesn't cover error handling or side effects like file retention, but for a file upload tool, it provides substantial behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized: a clear one-sentence purpose, a formatted list of info_type options with requirements, and an Args section. Each bullet and line adds value, no redundancy. Despite its length, it's front-loaded with the core purpose and structured for quick scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, multiple operations, no output schema), the description is highly complete. It explains all operation modes, their prerequisites, and the overall upload workflow. It also clarifies pagination for list_jobs via skip/limit. The agent has enough to use this tool correctly without further probing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate entirely. It does so thoroughly: every parameter (info_type, file_path, job_id, skip, limit) is explained, with details on when each is required. The description of info_type values adds semantic meaning that the schema (which only shows a default of 'upload') completely lacks.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Upload SharpHound/AzureHound collection files to BloodHound for ingest.' This clearly distinguishes it from sibling tools which are all read/info-oriented. It also specifies accepted file formats (.zip/.json), leaving no ambiguity about the tool's core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage context for each info_type operation, including required parameters (e.g., 'upload_to_job - upload a file to an existing job (requires: job_id, file_path)'). This effectively tells the agent which operation to use under what circumstances. It lacks an explicit 'use this instead of X' statement, but the sibling tools are clearly different, so the when-to-use is implied strongly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gpo_infoA
Query GPO data from BloodHound. info_type options: info - general GPO properties and attributes computers - computers this GPO is applied to controllers - principals that can modify this GPO ous - OUs this GPO is linked to tier_zeros - tier-zero principals associated with this GPO users - users this GPO is applied to args: gpo_id: BloodHound object ID of the GPO (required) info_type: what to retrieve (default: info) limit: Max Results (default 100, useful in large environments) skip: Pagination offset (default 0)
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| gpo_id | Yes | ||
| info_type | No | info |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It honestly discloses the configurable behaviors via info_type and pagination parameters, and notes limit is 'useful in large environments.' However, it does not explicitly state read-only nature, authentication requirements, or return format, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized into info_type options and args, with each line providing necessary detail. It is verbose but every piece contributes value; no fluff or repetition of schema defaults beyond adding context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given four parameters, no output schema, and no annotations, the description does a solid job covering parameter semantics and the behavior variations. It could be more complete by describing the structure of returned data or typical use cases, but the info_type list partially compensates.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description is the sole source of parameter meaning. It explains gpo_id as a BloodHound object ID, gives concrete semantics for each info_type value, and clarifies limit and skip as pagination controls. This adds substantial meaning beyond the bare schema names and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Query GPO data from BloodHound' with a specific verb and resource, and enumerates distinct info types. It distinguishes from sibling _info tools by focusing on GPO, though it does not explicitly contrast with alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving GPO-related information (computers, controllers, OUs, tier-zero principals, users) but does not explicitly state when to choose this over sibling tools. It provides no exclusion criteria or alternatives, though the info_type list helps clarify sub-scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
graph_analysisA
Perform graph analysis operations in BloodHound
info_type options:
kinds - list graph node and edge kinds
search - search for nodes by name (needs: query; optional: search_type)
shortest_path - find shortest attack path between two nodes (needs: start_node, end_node; optional relationship_kinds)
edge_composition - decompose a complex edge into underlying relationships (needs: source_node, target_node, edge_type)
relay_targets - find valid NTLM relay targets for a given node (needs: source_node, target_node, edge_type)
pathfinding - get pathfinding result (optional: start_node, end_node, relationship_kinds)
acl_inheritance - get ACL inheritance path (needs: source_node, target_node)
args:
info_type: what type of graph operation to perform (required)
query: search text (for search)
search_type: type of search - fuzzy (default) or exact (for search)
start_node: Object ID of source node (for shortest_path)
end_node: Object ID of target node (for shortest_path)
source_node: Object ID of source node (for edge_composition and relay_targets)
target_node: Object ID of target node (for edge_composition and relay_targets)
edge_type: Realtionship type like "MemberOf", "AdminTo", (for edge_composition and relay_targets)
relationship_kinds: Comma-separated relationship filter (for shortest_path, optional)
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| end_node | No | ||
| edge_type | No | ||
| info_type | Yes | ||
| start_node | No | ||
| search_type | No | fuzzy | |
| source_node | No | ||
| target_node | No | ||
| relationship_kinds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does not state whether the tool is read-only, what permissions are required, whether operations can be expensive, or what side effects might occur. It only describes operation logic and parameters, leaving the agent to guess about safety and operational traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a structured, front-loaded list where each operation and parameter has its own line. It is long but packs in necessary detail without redundancy. The minor typo 'Realtionship' is the only blemish, but the structure is effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter tool with no output schema, the description thoroughly covers operation variants and parameter requirements. It is missing explicit return-value descriptions (e.g., what shortest_path returns), which an agent would need for downstream reasoning, but the input-side coverage is strong enough to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description is the sole documentation for parameters. It maps each parameter to specific info_types (e.g., 'start_node: Object ID of source node (for shortest_path)') and adds naming conventions and formats ('Comma-separated relationship filter', 'fuzzy or exact'), going well beyond the bare schema titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it 'Perform[s] graph analysis operations in BloodHound' and lists seven specific operation types (kinds, search, shortest_path, edge_composition, relay_targets, pathfinding, acl_inheritance). This is a specific, actionable verb-resource pairing that clearly distinguishes it from sibling tools like user_info or cypher_query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for selecting the appropriate info_type by pairing each operation with a one-line purpose and its required/optional parameters (e.g., 'search - search for nodes by name (needs: query; optional: search_type)'). It does not explicitly mention when NOT to use the tool or compare to alternatives, but the context is sufficient for correct selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
group_infoA
Query group data from BloodHound. info_type options: info - general group properties and attributes admin_rights - machine/objects this group has admin rights on controllables - objects this group can control controllers - principals that have control over this group dcom_rights - machines this group can execute DCOM on members - users and groups that are members of this group memberships - groups this group belongs to (nested membership) ps_remote_rights - machines this group can PSRemote to rdp_rights - machines this group can RDP to sessions - machines this group has active sessions on args: group_id: BloodHound object ID of the group (required) info_type: what to retrieve (default: info) limit: Max Results (default 100, useful in large environments) skip: Pagination offset (default 0)
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| group_id | Yes | ||
| info_type | No | info |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It indicates a read-only query operation and discloses pagination via limit and skip parameters. However, it does not mention permissions, error behavior, or return format, which are relevant for an agent to understand what will happen.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized with a clear opening sentence, a bulleted list of info_type options, and a labeled args section. Every line is informative and there is no redundant or vague content. It remains concise despite covering many options.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all parameters and enumerates the full set of info_type options, giving a complete picture of the tool's capabilities. It lacks explicit details about return structure or error handling, but for a simple query tool with no output schema, this is a minor gap. Overall it is sufficiently complete for an agent to use effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does so thoroughly: each parameter is explained with its purpose, default value, and additional context (e.g., limit is 'useful in large environments'). This adds significant meaning beyond the bare schema types and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb and resource, 'Query group data from BloodHound,' and then enumerates the exact info_type options, making it unambiguous what the tool does. It clearly distinguishes itself from sibling tools that target other entity types like user_info or domain_info.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool by listing all retrievable group-related info types (info, members, sessions, etc.). It implies it is the go-to for group data, but it does not explicitly name alternatives or state when not to use it. The context is sufficient, but exclusions are not mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
operations_infoA
Query read-only BloodHound Enterprise operational status and meta data.
info_type options:
datapipe_status - get datapipe status
analysis - get analysis request information
meta_nodes - get latest tier zero combo node for a domain (requires: domain_id)
meta_tree - get the meta tree graph for a domain (requires: domain_id)
meta_entity - get meta entity info (requires: object_id)
args:
info_type: what to retrieve (default: datapipe_status)
domain_id: domain ID for meta_nodes/meta_tree
object_id: object ID for meta_entity
| Name | Required | Description | Default |
|---|---|---|---|
| domain_id | No | ||
| info_type | No | datapipe_status | |
| object_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly states 'read-only,' which reveals the non-mutating nature of the tool, and it notes parameter prerequisites for specific info types. However, it does not disclose output structure, error behavior, response format, or any rate limits or permission requirements. Since annotations are absent, the description carries the full burden, and this level of detail is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with a one-sentence purpose, then uses compact bullet-like lines to list info_type options and args. Each line earns its place, and there is minimal fluff. Some redundancy exists (e.g., 'get' repeated), but overall it is well-structured and not overly long.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all parameters and options, but it lacks details on return values or error handling. Since there is no output schema, the description would need to describe what each info_type returns to be fully complete. As it stands, an agent knows what to query but not what response to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides no descriptions (0% coverage), but the description fully explains every parameter: info_type lists valid options and default, domain_id is tied to meta_nodes/meta_tree, and object_id to meta_entity. This goes well beyond the schema and gives the agent all the needed semantic information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Query read-only BloodHound Enterprise operational status and meta data.' It then enumerates distinct info_type options, each with a clear purpose, making it obvious what the tool does and differentiating it from sibling tools that focus on entity information (e.g., domain_info, entity_info).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The tool provides clear context for when to use it—'read-only operational status and meta data'—and details the available info_type options with their required parameters (e.g., 'requires: domain_id' for meta_nodes). It does not mention exclusions or alternative tools, but the context is sufficient for an agent to decide when to invoke it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ou_infoA
Query OU data from BloodHound. info_type options: info - general OU Properties and attributes computers - computers in this OU groups - groups in this OU gpos - GPOs linked to this OU users - users in this OU args: ou_id: BloodHound object ID of the OU (required) info_type: what to retrieve (default: info) limit: Max Results (default 100, useful in large environments) skip: Pagination offset (default 0)
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| ou_id | Yes | ||
| info_type | No | info |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description partially discloses behavior: it is a query operation, includes pagination via limit and skip with defaults, and lists info_type options. However, it does not describe the return format or any potential side effects, which leaves a gap in transparency for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with an initial summary, a list of info_type options, and a parameter list. It is slightly verbose but every section adds value; the argument explanations are not redundant with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter tool with no output schema, the description covers purpose, parameters, and pagination but lacks any mention of return structure or error handling. It is adequate for basic invocation but not fully complete for an agent expecting response details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description fully compensates by explaining each parameter: ou_id is a required BloodHound object ID, info_type lists all valid options, limit is described as max results useful in large environments, and skip is a pagination offset. This adds significant meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool queries OU data from BloodHound, with a specific verb and resource. It enumerates distinct info_type options (info, computers, groups, gpos, users) that clarify the scope and distinguish it from sibling tools targeting other entity types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied: use when you need OU-specific data. However, there is no explicit comparison to alternatives like entity_info or domain_info, nor any 'when not to use' guidance. The description relies on the tool name and info_type options to convey applicability.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
risk_postureA
Query BloodHound Enterprise risk posture data.
info_type options:
stats - get current posture statistics
history - get posture history for a data type (needs: data_type)
args:
info_type: what to retrieve (default: stats)
data_type: posture history data type for history queries
| Name | Required | Description | Default |
|---|---|---|---|
| data_type | No | ||
| info_type | No | stats |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the two behavioral modes (stats and history) and the prerequisite for history, but does not mention read-only nature explicitly, error handling, or response format. The behavioral info is present but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is succinct, with a clear opening sentence followed by an organized list of options. Every sentence adds informative value, and it's front-loaded with the purpose. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description should cover return values, but it doesn't specify what the statistics or history response contains. It adequately explains parameters and query types, but for a standalone tool, key details about output shape are missing. It's sufficient for basic usage but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must add meaning. It does explain info_type values ('stats' and 'history') and that data_type is needed for history queries, which goes beyond the plain schema. However, data_type remains vague, without listing valid data types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Query BloodHound Enterprise risk posture data' with a specific verb and resource. It further breaks down info_type options (stats and history), making the tool's purpose unmistakable. While it doesn't explicitly contrast with sibling tools, the resource name is distinct enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides usage context by explaining the info_type options and that history requires data_type. However, it does not mention when to use this tool over related siblings like data_quality or enterprise_info, nor any exclusions. This is implied usage rather than explicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
user_infoA
Query user data from BloodHound info_type options: info - General user properties and attributes admin_rights - machine/objects this user has admin rights on constrained_delegation - services this use can delegate to via kerberos controllables - objects this use can control (WriteOwner, GenericAll, etc.) controllers - principals that have control over this user dcom_rights - machines this user can execute DCOM on memberships - groups this user belongs to ps_remote_rights - machines this user can PSRemote to rdp_rights - machines this user can RDP to sessions - machines this user has active sessions sql_admin_rights - SQL servers this user is admin on
Args:
user_id: BloodHound object ID of the user (required)
info_type: what to retrieve (default: info)
limit: Max Results (default 100, useful in large environments)
skip: Pagination offset (default 0)
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | ||
| limit | No | ||
| user_id | Yes | ||
| info_type | No | info |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full transparency burden. It discloses what each info_type returns (e.g., 'admin_rights - machine/objects this user has admin rights on') and describes pagination via limit/skip parameters. It stops short of stating side effects (none expected for a query) or auth requirements, but the read-only nature is implicitly clear from 'Query'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a concise opening, a bulleted list of info_type options, and a clear Args section. It is longer than average, but each line adds unique value for a tool with many retrieval modes. No redundant filler, though the typos ('delegate to via kerberos') are minor flaws.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (12 info types plus pagination) and the absence of an output schema, the description covers all parameter semantics and usage context adequately. It does not describe the format of returned results, but the instruction states this isn't necessary without an output schema. The pagination guidance is a useful extra for large environments.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions are entirely absent (0% coverage), so the description fully compensates by documenting every parameter: user_id is required, info_type has a default and enumerates all valid values, and limit/skip are explained with defaults and use cases ('useful in large environments'). This is exemplary parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb + resource ('Query user data from BloodHound') and enumerates 12 distinct info_type options, making the tool's purpose unmistakable and distinguishing it from siblings like computer_info or entity_info. The list of retrievable data types adds precision beyond the generic tool name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly frames the tool for querying user data and provides an exhaustive list of info_type options, guiding an agent on what can be retrieved. It does not explicitly name alternative tools or state when not to use this tool, but the user-specific scope is evident from the name and context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
20 tool updates
v0.1.0- First observed
adcs_info - First observed
asset_groups - First observed
attack_paths - First observed
collection_info - First observed
computer_info - First observed
custom_nodes - First observed
cypher_query - First observed
data_quality - First observed
domain_info - First observed
enterprise_admin - First observed
enterprise_info - First observed
entity_info - First observed
file_upload - First observed
gpo_info - First observed
graph_analysis - First observed
group_info - First observed
operations_info - First observed
ou_info - First observed
risk_posture - First observed
user_info
TDQS
Scored across 20 tools
Most tools target distinct entity types or domains (group, user, computer, domain, GPO, OU, ADCS, etc.), but there is some potential confusion between graph_analysis and cypher_query (both can explore paths) and between enterprise_info, operations_info, and collection_info which all deal with BHE system metadata. Descriptions are detailed enough to disambiguate in most cases.
Tool names are all snake_case and readable, but there is no consistent verb_noun pattern. Many use an '_info' suffix (group_info, user_info, computer_info), while others are noun phrases (asset_groups, attack_paths, cypher_query) or verb phrases (file_upload). This mix is acceptable but not a uniform convention.
20 tools is on the higher end but appropriate given the breadth of the BloodHound Enterprise API. Each tool covers a distinct functional area, and many pack multiple sub-operations via info_type, so the count is justified without being excessive.
The tool set covers major BloodHound domains: entity queries, graph analysis, cypher execution, attack paths, enterprise admin, file upload, collection status, and data quality. Minor gaps exist, such as limited Azure entity support and missing some niche BHE endpoints, but the surface is generally comprehensive for common workflows.
Maintenance
Related MCP Connectors
Code intelligence for LLMs. Analyze, search, and retrieve code from any public git repository.
Authenticated LLM Agent (Bcrypt)
Connect LLM tools to your Algolia account with user-scoped access for internal workflows.
Related MCP Servers
- FlicenseCqualityDmaintenanceAn extension that allows Large Language Models to interact with and analyze Active Directory environments through natural language queries instead of manual Cypher queries.100160-
- AlicenseCqualityDmaintenanceEnables LLMs to perform Active Directory penetration testing using tools like NetExec, Bloodhound, Nmap, Certipy, and John the Ripper. Automates vulnerability discovery, attack path analysis, and documentation generation for security assessments.266MIT
- AlicenseBqualityBmaintenanceEnables security professionals to query and analyze Active Directory attack paths from BloodHound Community Edition data using natural language through Claude Desktop's Model Context Protocol interface.79132GPL 3.0
- AlicenseNot gradedqualityAmaintenanceEnables natural language threat hunting and incident response by connecting LLMs to enterprise security data sources like Elasticsearch, EVTX logs, PCAP files, and Velociraptor.206GPL 3.0