AgentHound - Offensive security framework for AI agent infrastr

项目说明

<di="center">

<img src="docs/readme-assets/agenthound-banner.png" alt="AgentHound" width="100%">

The offensi framework for agentic infrastructure

MCP · A2A · agent clients · model gateways · inference servers · stores · MLOps · notebooks

<a href=" src=" alt="DEF CON 34 · Red Team " height="28"></a> <a href=" target="_blank" rel="noopener noreferrer"><img src=" alt="adithyan-ak/AgentHound | Trendshift" height="28"></a>

Quickstart ·
Capabilities ·
Attack surface ·
Attack paths ·
Docs ·
Safety

![CI]()
![Release]()

</div>

> Authorized use only. AgentHound performs acti , model in, and re mutation when their prerequisites are present. Run it only against systems you own or are authorized to assess.

AgentHound is an open-source offensi framework for agentic infrastructure. Drop one static collector onto a compromised host and run one scan. AgentHound captures local credentials and agent configuration, discovers reachable AI services, fingerprints and in them, reuses compatible credentials, concrete access, and preser in one continuously checkpointed JSON artifact.

The default scan is acti foothold access may disappear at any moment. --stealth switches the same workflow to read-only collection when OPSEC requires it.

The optional analysis ser the artifact into a queryable attack graph with credential chains, execution and exfiltration paths, cross-protocol pivots, e findings, risk scoring, history, and triage.

⚡ Offensi

<p align="center">
<img src="docs/readme-assets/agenthound-attack-surface.png" alt="AgentHound attack-surface graph showing exfiltration paths" width="900">
</p>

<table>
<tr>
<td width="50%" ="top">

🎯 Foothold-first autonomous collection<br/>
Local agent configs, instruction files, en secrets, loopback services, acti, configured endpoints, and optional network scope all feed the same scan. No database or ser is required on the compromised host.

</td>
<td width="50%" ="top">

🔑 Raw credential capture and reuse<br/>
Concrete secrets are saved as usable material, deduplicated by value hash, and associated with every obser. Newly discovered bearer tokens, API keys, master keys, and Jupyter tokens immediately unlock compatible same-scan collection and candidates.

</td>
</tr>
<tr>
<td width="50%" ="top">

🧪 Proof instead of reachability guesses<br/>
For an eligible MCP resource, AgentHound first performs an anonymous control read. If that exact read succeeds, it records public access without presenting a credential. Otherwise, it follows with an authenticated read; a denied control plus an allowed credentialed read becomes During Scan e tied to that credential and resource.

</td>
<td width="50%" ="top">

☠️ Re acti<br/>
Against eligible ContextForge-managed tools, the planner writes a scan-specific description marker, observes it through MCP, restores the original immediately, and independently confirms restoration before any other work continues.

</td>
</tr>
<tr>
<td width="50%" ="top">

🌐 Full-spectrum agentic attack surface<br/>
AgentHound maps MCP, A2A, twel configuration formats, model gateways, inference servers, stores, model registries, notebooks, and web interfaces as one connected target set.

</td>
<td width="50%" ="top">

🧬 Deep service and model intelligence<br/>
In Ollama ser, modelfiles, templates, and system prompts; LiteLLM credential references and context; MLflow experiments and model registries; Jupyter sessions and files; and Qdrant collections. Deep mode adds recursi discovery, bounded point references, and Ollama compute .

</td>
</tr>
<tr>
<td width="50%" ="top">

🕸️ Graph-nati analysis<br/>
The ser trust, authentication, credential reuse, tool capabilities, sensiti, protocol boundaries, and obser into paths a red-team operator can query: reachability, execution, exfiltration, impersonation, shadowing, poisoning, and tainted data flow.

</td>
<td width="50%" ="top">

💾 Built for loss of access<br/>
The collector writes an ingest-valid artifact before collection and checkpoints every meaningful result and action transition. Recovery state is persisted before mutation, cleanup runs e cancellation, and unresol can be retried from the same artifact.

</td>
</tr>
</table>

🎯 Every plane of the agentic stack

| Surface | Discovery and collection | Autonomous and analysis |
|---|---|---|
| Agent clients | Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, Cline, Continue, Zed, JetBrains, Kiro, Amazon Q, and Augment configs; CLAUDE.md, AGENTS.md, Cursor rules, and Copilot instructions | Captures concrete config credentials; detects exposed secrets, suspicious instructions, poisoned context, and unpinned ser |
| MCP | Configured stdio and network servers; tools, resources, prompts, transport, authentication, and ser | Differential credential-to-resource proof; public-access e; re ContextForge description round trip |
| A2A | Agent cards, skills, delegation, authentication schemes, signatures, and remote JWKS e | Authenticated agent-card enrichment, impersonation and confused-deputy analysis, and cross-protocol pathing |
| LiteLLM | Gateway posture, obser keys, upstream-provider references, hashes, models, aliases, and spend context | Compatible credential reuse, credential-chain correlation, and exposed-master-key findings |
| Ollama / vLLM | Ollama model in, digests, modelfiles, templates, system prompts, and fine-tune signals; vLLM fingerprinting | Deep active mode invokes a bounded embedding request to pro access |
| Qdrant | Typed collections, point counts, schema context, and bounded point references in deep mode | Anonymous exposure and sensiti analysis without retaining payloads |
| MLflow | Experiment/run counts, typed model , sanitized storage URIs, and safely identified artifact-store roots | Anonymous tracking and registry exposure analysis without treating persisted artifacts as ser |
| Jupyter | Sessions and typed workspace files from bounded notebook/content trees, first anonymously and then with a compatible token | Distinguishes public from credential-gated notebook access; incomplete walks preser files |
| Open WebUI / LangServe | Open WebUI authentication posture, explicit configured Ollama/Qdrant backends, and authenticated upstream/RAG credential in; LangSer | Credential expansion and exposed-service analysis; configured backend links do not o reachability |

🚀 Quick start

1. Install the collector

Install the 1.1.1 static binary to ~/.local/bin:

Or install with Homebrew:

The collector has no Neo4j, PostgreSQL, Node.js, or ser.
The shell installer supports macOS and Linux on amd64 or arm64. Windows builds
are a from GitHub Releases.

2. Run one scan

Start with the compromised host and e it can immediately reveal:

Add a host, CIDR, or targets file without disabling local collection:

Choose the mode that matches the operation:

| Command | Behavior |
|---|---|
| agenthound scan | Acti, compatible credential reuse, MCP access proof, and eligible re ContextForge |
| agenthound scan --deep | Adds recursi discovery, bounded Qdrant point references, expensi probes, and bounded Ollama embedding in |
| agenthound scan --stealth | Anonymous and exact configured read-only collection; no cross-target credential reuse, model in, tool in, or mutation |
| agenthound scan --stealth --deep | Adds deep filesystem and payload reads while retaining stealth restrictions |

These commands are alternatives and write scan.json. Without --output, the result is scan-<scan_id>.json. An explicit output path replaces an existing file, so use a new name for each scan. Concrete credentials and collected content are stored directly in the artifact; treat it as operationally sensitive.

If the final summary reports unresol, preserve the artifact and retry safely:

3. Analyze the attack graph

The server is optional during collection. Start it on the analysis system when you are ready to ingest:

Open to inspect findings, attack paths, credentials, risk, queries, scan history, and triage.

Use the collector and server from the same release. Releases after 1.1.1 pin
the exact ser in Compose; older Compose files retain their historical
latest reference. A current ser supported older V1 artifacts. If
ingest reports an unsupported contract, upgrade the ser of editing
the artifact.

<p align="center">
<img src="docs/readme-assets/agenthound-dashboard.png" alt="AgentHound attack-surface dashboard" width="900">
</p>

🔪 One autonomous offensi

agenthound scan drives the operational loop without requiring the operator to choose a module for every discovered service:

1. Map the foothold — parse supported agent configs and instruction sources; capture concrete credentials and configured endpoints.
2. Discover the reachable estate — seed local interfaces and explicit targets, scan standard AI-service ports, and fingerprint responding services.
3. Collect useful data — enumerate MCP and A2A, then in applicable gateways, inference servers, stores, MLOps services, notebooks, and web interfaces.
4. Expand with credentials — present newly obser only to compatible service adapters and generate new candidates as access grows.
5. Pro — perform differential MCP resource reads, eligible re ContextForge round trips, and deep Ollama compute .
6. Preser — merge every obser, action outcome, proof, and recovery transition into the continuously checkpointed artifact.
7. Pathfind — ingest later to build full-graph reachability, execution, exfiltration, credential-chain, and cross-protocol findings.

Independent collection failures do not block unrelated work. A checkpoint failure or unresol cleanup stops new forward work so the artifact remains the source of truth.

🔎 What AgentHound finds

| Finding | What it answers |
|---|---|
| credential access | Which exact credential pro to which exact MCP resource during this scan? |
| Credential-chain paths | Where does the same concrete secret connect agent configuration, gateways, identities, and services? |
| Reachability | What can an agent reach by following current trust, authentication, capability, and host e? |
| Execution paths | Which agents can reach tools capable of shell, code, database, or network execution? |
| Exfiltration paths | Where can sensiti access combine with an outbound-capable tool? |
| Cross-protocol pivots | Where can MCP, A2A, host context, and AI-service infrastructure bridge trust boundaries? |
| Instruction poisoning with proof | Which instruction files contain review signals or strong compound poisoning e, and what exact lines triggered the ? |
| Tool shadowing and rug pulls | Which lookalike tools or changed descriptions can hijack an expected capability? |
| Unauthenticated surfaces | Which MCP, A2A, notebook, registry, , or model services exposed useful data without a credential? |
| Risk hotspots | Which nodes and paths deser operator attention based on impact, exposure, and graph position? |

Core graph primiti CAN_REACH, CAN_EXECUTE, CAN_EXFILTRATE_VIA, CAN_IMPERSONATE, SHADOWS, POISONED_DESCRIPTION, INSTRUCTION_SIGNAL, POISONED_INSTRUCTIONS, TAINTS, and IFC_. Instruction findings retain bounded matched excerpts with paths and line numbers; the hash remains secondary integrity metadata. See the Attack Paths guide and Graph Model for their e semantics.

🛡️ Safety & OPSEC

AgentHound is designed for authorized operation from a compromised host:

Read Security and OPSEC before using active mode in a constrained en.

📚 Documentation and de

Install ·
Quickstart ·
Scanner ·
CLI ·
Attack Paths ·
Deployment ·
Security

The collector remains a static binary with no database or ser. New service intelligence and autonomous actions are registered as modules and participate in the same artifact, planner, contact-policy, and e contracts. See CONTRIBUTING.md and Writing Modules.

AgentHound is licensed under the Apache License 2.0. To report a in AgentHound itself, see SECURITY.md.

项目信息

开发语言：Go

Star 数：442

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。