AgentHound is an open-source offensive security framework that consolidates credential capture, AI service discovery, and attack-path analysis across MCP, A2A, and agent-client infrastructure into a single checkpointed artifact for authorized assessments.
| Tool | adithyan-ak/AgentHound — offensive security framework for agentic infrastructure: recon, credential capture, service fingerprinting, and graph-based attack-path analysis |
| Category | Post-exploitation collection and attack-path analysis for AI/agentic infrastructure |
| Primary Use | Running a single scan from an authorized foothold to inventory agent configs, secrets, MCP/A2A services, model gateways, inference servers, and vector stores, then analyzing the resulting artifact as a queryable attack graph |
| Safe Use | Explicitly intended for authorized use only — assessments of systems you own or are contracted to test, red-team lab environments, and defensive research into agentic attack surfaces. The README states this restriction verbatim. |
| Telemetry Note | The default scan is active: it presents credentials to discovered services, invokes bounded model requests, and (for ContextForge-managed tools) writes and reverts a scan-specific description marker — all observable in target service logs. --stealth provides a strictly read-only footprint, and the output scan.json artifact itself stores raw secrets, making it a sensitive indicator on any host where it is left behind. |
Agentic AI stacks have quietly become one of the messiest trust environments in modern enterprises, and adithyan-ak/AgentHound is an early serious attempt to give offensive professionals a unified toolchain for that terrain. Written in Go, Apache-2.0 licensed, and sitting at roughly 452 stars with a DEF CON 34 Red Team Village badge on the README, the project frames itself as "the offensive security framework for agentic infrastructure" — covering MCP, A2A, agent clients, model gateways, inference servers, vector stores, MLOps platforms, and notebooks as one connected target set. The core pitch is operational compression: drop one static collector binary onto an authorized foothold, run one scan, and end up with a single JSON artifact containing secrets, services, and proof of access.
The architectural split is worth noting before anything else. The collector is deliberately dependency-free — no Neo4j, no PostgreSQL, no Node.js, no server connection required on the scanned host — which is the right call for post-exploitation contexts where the foothold may be short-lived. Analysis happens on a separate, optional server component, started via docker compose on the operator's own system, which ingests the artifact and turns it into a queryable attack graph. This separation means the noisy, data-heavy reasoning work never touches the target network, and the collector itself stays a small static binary installable via install.sh, Homebrew, or GitHub Releases for Windows.
What the collector actually does follows a clear operational loop. First it maps the foothold itself: parsing local agent configurations across an impressively broad list of clients — Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, Cline, Continue, Zed, JetBrains, Kiro, Amazon Q, and Augment — plus instruction files like CLAUDE.md, AGENTS.md, Cursor rules, and Copilot instructions. Concrete credentials harvested here (API keys, bearer tokens, master keys, Jupyter tokens) are deduplicated by value hash and immediately fed back into the same scan as validation candidates for newly discovered services. This credential chaining is the mechanism that turns a pile of config files into demonstrated access.
Discovery then extends outward from local interfaces and explicitly supplied targets (agenthound scan 10.20.0.0/24 or @targets.txt), scanning standard AI-service ports and fingerprinting whatever responds. The fingerprinting layer is where the tool's depth shows: it recognizes and inventories Ollama served models with digests, modelfiles, templates, and system prompts; LiteLLM gateway posture including master keys and virtual-key hashes; MLflow experiments and model registries; Jupyter sessions and workspace files; Qdrant vector collections with schema context; Open WebUI authentication posture; and vLLM and LangServe services. That is a genuinely comprehensive coverage map of the current agentic stack, and it reflects real familiarity with how these services leak information.
The evidence model is more disciplined than most tools in this category. For eligible MCP resources, AgentHound performs an anonymous control read first; if that succeeds, it records public access without ever presenting a credential. If denied, it follows with an authenticated read, producing what the README calls "Verified During Scan" evidence — a specific credential tied to a specific resource. This differential approach avoids the classic recon-tool failure of conflating reachability with actual access, and it gives report writers concrete, per-credential proof rather than port-scan assertions.
The most operationally interesting — and most OPSEC-relevant — capability is reversible active validation against ContextForge-managed tools. The planner writes a scan-specific description marker, observes it through MCP, restores the original immediately, and independently confirms restoration before continuing. Mutations on a target system are a serious liability in any engagement, and the design acknowledges this directly: recovery state is persisted before mutation, cleanup runs even after cancellation, and agenthound revert scan.json can retry unresolved restoration from the same artifact. That said, any write-then-revert pattern on a live target is something an authorized operator should clear with the client in scope documentation beforehand.
Mode selection is where the tool's awareness of operational tradeoffs becomes explicit. The default scan is active — credential reuse, model invocation, eligible mutations — on the theory that foothold access may disappear at any moment. --stealth switches the identical workflow to strictly read-only collection: anonymous and exact configured reads only, no cross-target credential reuse, no model or tool invocation, no mutation. --deep layers on recursive instruction discovery, bounded Qdrant point references, expensive service probes, and a bounded Ollama embedding request to prove model-compute access. The modes compose, so --stealth --deep is available when you want filesystem depth without active touches.
The optional analysis server is conceptually the child of BloodHound — one of the repo's own topics — applied to agentic trust relationships. It joins trust, authentication, credential reuse, tool capabilities, sensitive resources, protocol boundaries, and observed proof into queryable paths: reachability, execution, exfiltration, impersonation, confused-deputy and shadowing analysis, context poisoning, and tainted data flow. The A2A support in particular goes after delegation and authentication-scheme analysis, including remote JWKS evidence and authenticated agent-card enrichment — territory that almost no other open tool covers. For a red-team lead, this is the difference between a spreadsheet of found keys and a defensible narrative of how an attacker chains them across protocol boundaries.
Engineering hygiene is notably strong for a young offensive project. There is a CI badge, versioned releases pinned to exact server images in Compose for anything after 1.1.1, a documented artifact-versioning contract, and a checkpoint-before-collect design that writes an ingest-valid artifact before collection even begins. The README's instruction to treat scan.json as operationally sensitive deserves emphasis: the artifact stores concrete credentials and collected content directly, so it is simultaneously your deliverable and a liability if left on an intermediate host.
From a defensive perspective, AgentHound is equally valuable as a catalog of what your agentic infrastructure exposes. Every capability it enumerates — unpinned MCP server packages in agent configs, exposed LiteLLM master keys, anonymous Qdrant collections, publicly readable MLflow registries, credential-gated versus public Jupyter trees — is a concrete hardening checklist item. Defenders can run it against their own staging environments to find exactly the misconfigurations an adversary would chain, and the differential public-versus-authenticated evidence model maps cleanly onto detection engineering: anonymous control reads followed by authenticated reads against AI services are a fingerprint worth alerting on in service logs.
The limitations are honest and documented rather than hidden. Configured backend links in Open WebUI explicitly do not overclaim reachability; MLflow artifacts are not treated as served models; Qdrant analysis references points without retaining vector payloads. These constraints suggest the author has been burned by, or at least thought carefully about, tools that inflate findings. Combined with the revert safety workflow and the --stealth mode, the overall posture is that of a tool built by someone who expects it to be used in real engagements with real rules of engagement.
For authorized professionals — pentest teams with agentic infrastructure in scope, purple teams building detection content for MCP and A2A abuse, and security engineers hardening AI platforms — AgentHound is currently one of the most complete open-source answers to the question of what an attacker actually sees when they land on a developer workstation or CI host in 2026. It is emphatically not a scanning toy: it captures real secrets, performs real authenticated actions, and mutates eligible targets. Used inside a signed scope, it replaces hours of manual config archaeology with one reproducible artifact; used carelessly, it is exactly the kind of tool that can end an engagement badly. The README's own warning is the correct operating assumption: run it only against systems you own or are authorized to assess.
adithyan-ak/AgentHound.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.