AgentHound
Offensive security framework for AI agent infrastructure - recon, credential looting, model exfiltration, poisoning, and attack-path analysis across MCP, A2A, gateways, and AI services. BloodHound for the agentic stack.
File Explorer
Download Latest Version (.zip)- cli.md
- docs-site.md
- graph-schema.md
- modules.md
- server.md
- testing.md
- ci.yml
- docs.yml
- release.yml
- version-check.yml
- dependabot.yml
- collect_helpers.go
- collect_helpers_test.go
- contextforge_action.go
- identity_test.go
- instruction_recursion_test.go
- origin_test.go
- planner.go
- planner_actions.go
- planner_test.go
- probe_contract.go
- probe_contract_test.go
- progress.go
- progress_test.go
- revert.go
- root.go
- root_test.go
- scan.go
- scan_unified.go
- scan_unified_test.go
- signal.go
- signal_test.go
- stubs_test.go
- unknown.go
- version.go
- main.go
- config.go
- config_test.go
- identity.go
- identity_test.go
- platform_darwin.go
- platform_darwin_test.go
- platform_linux.go
- platform_linux_test.go
- platform_other.go
- platform_windows.go
- routes.go
- routes_test.go
- .gitignore
- main.go
- settings.json
- mcp.json
- AGENTS.md
- compose.yml
- Dockerfile.mcp
- Dockerfile.workstation
- README.md
- neo4j
- postgres
- run
- type
- base
- type
- up
- init-db
- finish
- run
- type
- init-db
- finish
- run
- type
- agenthound
- init-db
- neo4j
- postgres
- docker-compose.public.yml
- docker-compose.yml
- Dockerfile.agenthound
- Dockerfile.agenthound-server
- Dockerfile.standard
- init-db.sh
- neo4j.conf
- server-analysis.md
- system-design.md
- authoring-rules.md
- dev-setup.md
- modules.md
- install.md
- quickstart.md
- attack-paths.md
- deployment.md
- scanner.md
- security.md
- agenthound-attack-surface.png
- agenthound-banner.png
- agenthound-dashboard.png
- agenthound-logo.png
- api.md
- cli.md
- configuration.md
- detection-rules.md
- graph-model.md
- risk-scoring.md
- README.md
- requirements.txt
- robots.txt
- auth_probe.go
- auth_probe_test.go
- collector.go
- collector_test.go
- conformance.go
- fetch.go
- fetch_test.go
- jws.go
- jws_protocol_test.go
- parse.go
- parse_test.go
- protocol_correctness_test.go
- register.go
- security.go
- signals.go
- signals_test.go
- instruction_classifier_corpus.jsonl
- collector.go
- collector_test.go
- credential.go
- credential_rules_test.go
- credential_test.go
- discovery.go
- discovery_test.go
- instruction.go
- instruction_classifier.go
- instruction_classifier_test.go
- instruction_deep_test.go
- instruction_fifo_unix_test.go
- instruction_performance_test.go
- instruction_semantics.go
- instruction_test.go
- parser.go
- parser_amazon_q.go
- parser_augment.go
- parser_claude_code.go
- parser_claude_desktop.go
- parser_cline.go
- parser_continue.go
- parser_cursor.go
- parser_jetbrains.go
- parser_kiro.go
- parser_test.go
- parser_vscode.go
- parser_windsurf.go
- parser_zed.go
- parsers_test.go
- pincheck.go
- pincheck_test.go
- register.go
- access.go
- prober.go
- prober_test.go
- types.go
- collector.go
- collector_test.go
- get_only_test.go
- ownership_test.go
- register.go
- fingerprinter.go
- fingerprinter_test.go
- register.go
- fingerprinter.go
- fingerprinter_test.go
- register.go
- collector.go
- collector_test.go
- get_only_test.go
- register.go
- fingerprinter.go
- fingerprinter_test.go
- register.go
- collector.go
- collector_test.go
- enumerate.go
- enumerate_test.go
- initialize_observer.go
- initialize_observer_test.go
- observer.go
- observer_test.go
- register.go
- resolve.go
- resolve_test.go
- signals.go
- signals_rules_test.go
- signals_test.go
- transport.go
- transport_test.go
- contextforge.go
- contextforge_test.go
- poisoner.go
- register.go
- collector.go
- collector_test.go
- get_only_test.go
- register.go
- fingerprinter.go
- fingerprinter_test.go
- register.go
- coverage.go
- coverage_test.go
- expand.go
- expand_test.go
- register.go
- scanner.go
- scanner_test.go
- collector.go
- collector_test.go
- get_only_test.go
- helpers_test.go
- redaction_test.go
- register.go
- fingerprinter.go
- fingerprinter_test.go
- register.go
- canonicalize.go
- collector.go
- collector_test.go
- get_only_test.go
- register.go
- fingerprinter.go
- fingerprinter_test.go
- register.go
- scanner.go
- scanner_test.go
- collector.go
- collector_test.go
- get_only_test.go
- register.go
- fingerprinter.go
- fingerprinter_test.go
- register.go
- fingerprinter.go
- fingerprinter_test.go
- register.go
- README.md
- registry_smoke_test.go
- collector-allowlist.txt
- deps-check.sh
- docs-check.sh
- install-atomic-test.sh
- preflight.sh
- release-notes.sh
- release-process-test.sh
- release-tag-check.sh
- seed-test-data.sh
- size-check.sh
- sync-version.sh
- verify-homebrew-formula.sh
- version-check.sh
- action.go
- doc.go
- enumerator.go
- fingerprinter.go
- poisoner.go
- receipt.go
- receipt_test.go
- reverter.go
- scanner.go
- service_collector.go
- target.go
- target_test.go
- checkpoint.go
- checkpoint_test.go
- replace_posix.go
- replace_windows.go
- collector.go
- doc.go
- a2a_url.go
- a2a_url_test.go
- auth.go
- auth_test.go
- capability.go
- entropy.go
- entropy_test.go
- evidence.go
- evidence_test.go
- hasher.go
- hasher_test.go
- host.go
- host_test.go
- http_origin.go
- httpget.go
- httpget_test.go
- json.go
- json_test.go
- network_error.go
- network_error_test.go
- network_error_windows_test.go
- output.go
- output_test.go
- patterns.go
- redact.go
- redact_test.go
- sensitivity.go
- policy.go
- policy_test.go
- decode.go
- decode_test.go
- doc.go
- edge.go
- endpoint.go
- endpoint_test.go
- exposes_credential.go
- exposes_credential_test.go
- fuzz_test.go
- ids.go
- ids_test.go
- ingest.go
- kinds.go
- metadata.go
- metadata_test.go
- model_test.go
- node.go
- observation.go
- observation_test.go
- origin.go
- origin_test.go
- probe_outcome_test.go
- registry_contract.go
- registry_contract_test.go
- resolve_test.go
- result.go
- result_test.go
- scan_execution.go
- scan_execution_test.go
- scoping.go
- scoping_test.go
- evidence.go
- evidence_test.go
- module.go
- registry.go
- registry_test.go
- langserve.yaml
- litellm.yaml
- mlflow.yaml
- ollama.yaml
- openwebui.yaml
- qdrant.yaml
- vllm.yaml
- capability-allowlisted-proxy.yaml
- capability-auto-fetch-render.yaml
- capability-code-execution.yaml
- capability-credential-access.yaml
- capability-database-access.yaml
- capability-email-send.yaml
- capability-file-read.yaml
- capability-file-write.yaml
- capability-network-outbound.yaml
- capability-shell-access.yaml
- credential-format-detect.yaml
- credential-high-entropy-base64.yaml
- credential-high-entropy-hex.yaml
- credential-name-keywords.yaml
- credential-vault-ref.yaml
- injection-always-use.yaml
- injection-base64-payload.yaml
- injection-embedded-url.yaml
- injection-exfil-url.yaml
- injection-hidden-unicode.yaml
- injection-ignore-previous.yaml
- injection-imperative-override.yaml
- injection-important-tag.yaml
- injection-instead-of.yaml
- injection-instructions-tag.yaml
- injection-never-use-other.yaml
- injection-system-tag.yaml
- instruction-curl-wget.yaml
- instruction-override-expanded.yaml
- sensitivity-critical.yaml
- sensitivity-high.yaml
- sensitivity-medium.yaml
- source-untrusted-email.yaml
- source-untrusted-fileshare.yaml
- source-untrusted-web.yaml
- capability-allowlisted-proxy.yaml
- capability-auto-fetch-render.yaml
- capability-code-execution.yaml
- capability-credential-access.yaml
- capability-database-access.yaml
- capability-email-send.yaml
- capability-file-read.yaml
- capability-file-write.yaml
- capability-network-outbound.yaml
- capability-shell-access.yaml
- credential-format-detect.yaml
- credential-high-entropy-base64.yaml
- credential-high-entropy-hex.yaml
- credential-name-keywords.yaml
- credential-vault-ref.yaml
- injection-always-use.yaml
- injection-base64-payload.yaml
- injection-embedded-url.yaml
- injection-exfil-url.yaml
- injection-hidden-unicode.yaml
- injection-ignore-previous.yaml
- injection-imperative-override.yaml
- injection-important-tag.yaml
- injection-instead-of.yaml
- injection-instructions-tag.yaml
- injection-never-use-other.yaml
- injection-system-tag.yaml
- instruction-curl-wget.yaml
- instruction-encoded-exfil.yaml
- instruction-override-expanded.yaml
- sensitivity-critical.yaml
- sensitivity-high.yaml
- sensitivity-medium.yaml
- source-untrusted-email.yaml
- source-untrusted-fileshare.yaml
- source-untrusted-web.yaml
- builtin_tests_helper_test.go
- bundle.go
- bundle_test.go
- engine.go
- engine_test.go
- fingerprint.go
- fingerprint_test.go
- instruction_canonical.go
- instruction_canonical_benchmark_test.go
- instruction_canonical_engine_test.go
- instruction_canonical_fuzz_test.go
- instruction_canonical_test.go
- loader.go
- loader_test.go
- manifest.go
- manifest_test.go
- matcher_spans_test.go
- matchers.go
- matchers_test.go
- rule.go
- rule_test.go
- shadow_exclude_fix_test.go
- validate.go
- validate_test.go
- bootstrap.go
- bootstrap_binding_test.go
- ingest.go
- ingest_test.go
- preflight.go
- preflight_test.go
- query.go
- query_helpers_test.go
- root.go
- serve.go
- serve_test.go
- unknown.go
- version.go
- main.go
- auth_effective_integration_test.go
- cypher.go
- cypher_truth_test.go
- litellm_producer_integration_test.go
- main_test.go
- prebuilt_test.go
- queries.go
- auth_strength.go
- auth_strength_integration_test.go
- auth_strength_test.go
- can_execute.go
- can_execute_test.go
- can_exfiltrate.go
- can_exfiltrate_test.go
- can_impersonate.go
- can_impersonate_test.go
- can_reach.go
- can_reach_test.go
- confused_deputy.go
- confused_deputy_integration_test.go
- confused_deputy_test.go
- cross_protocol.go
- cross_protocol_test.go
- cross_service_credential_chain.go
- cross_service_credential_chain_integration_test.go
- cross_service_credential_chain_test.go
- effective_auth_consumers_integration_test.go
- exact_evidence_test.go
- has_access_to.go
- has_access_to_test.go
- ifc_violation.go
- ifc_violation_integration_test.go
- ifc_violation_test.go
- main_test.go
- poisoned_description.go
- poisoned_description_test.go
- poisoned_instructions.go
- poisoned_instructions_test.go
- poisons_context_perf_integration_test.go
- property_test_helpers_test.go
- risk_score.go
- risk_score_test.go
- scope_policy.go
- scope_policy_integration_test.go
- scope_policy_test.go
- shadows.go
- shadows_integration_test.go
- shadows_test.go
- taints.go
- taints_integration_test.go
- taints_test.go
- writer_test_helpers_test.go
- a2a_agent.go
- a2a_agent_test.go
- a2a_import_test.go
- agent.go
- agent_test.go
- assessment.go
- effective_auth_integration_test.go
- main_test.go
- server.go
- server_test.go
- tool.go
- tool_test.go
- weights.go
- tfidf.go
- tfidf_test.go
- moat_detectors_scan.json
- atlas.go
- atlas_test.go
- evidence_graph.go
- evidence_graph_test.go
- finding_detail.go
- finding_detail_test.go
- findings.go
- findings_test.go
- main_test.go
- moat_e2e_integration_test.go
- postprocessor.go
- postprocessor_test.go
- registry.go
- remediation.go
- remediation_test.go
- traversal.go
- traversal_test.go
- analysis.go
- analysis_security_test.go
- analysis_test.go
- docs.go
- docs_test.go
- graph.go
- graph_test.go
- health.go
- health_test.go
- ingest.go
- ingest_binding_test.go
- ingest_security_test.go
- openapi.yaml
- posture.go
- posture_test.go
- projection.go
- query.go
- query_test.go
- response.go
- rules.go
- rules_test.go
- scans.go
- scans_handler_test.go
- testutil_test.go
- triage.go
- triage_test.go
- cors.go
- cors_test.go
- logging.go
- logging_test.go
- originguard.go
- originguard_test.go
- .gitkeep
- index.html
- server.go
- server_test.go
- 001_initial_v1.sql
- 002_remove_campaign_verification.sql
- 003_instruction_evidence.sql
- coverage_limitations.go
- coverage_state.go
- coverage_state_test.go
- driver.go
- findings_store.go
- findings_store_test.go
- integration_test.go
- migrate.go
- migrate_test.go
- publication_store.go
- publication_store_test.go
- scans.go
- scans_test.go
- storage_binding.go
- binding.go
- binding_test.go
- lock.go
- config_alias_test.go
- driver.go
- fingerprint_test.go
- graphdb.go
- integration_test.go
- main_test.go
- mock_graphdb.go
- reader.go
- reader_test.go
- reconciler.go
- reconciler_test.go
- schema.go
- schema_helpers_test.go
- storage_binding.go
- writer.go
- writer_helpers_test.go
- writer_prepare.go
- writer_test.go
- a2a_signature_test.go
- config_alias_test.go
- lifecycle.go
- lifecycle_test.go
- main_test.go
- mcp_cli_contract_test.go
- normalizer.go
- normalizer_test.go
- pipeline.go
- pipeline_race_test.go
- pipeline_test.go
- property_test_helpers_test.go
- publication_integration_test.go
- validator.go
- validator_test.go
- guard.go
- guard_test.go
- config.go
- config_test.go
- finding.go
- posture.go
- scan.go
- scan_test.go
- apple-touch-icon.png
- favicon-16x16.png
- favicon-32x32.png
- favicon.ico
- logo-192.png
- logo-512.png
- site.webmanifest
- Dashboard.test.tsx
- FindingReport.test.ts
- FindingTriageApi.test.ts
- QueryLibrary.test.tsx
- ScanManager.test.tsx
- AppLayout.tsx
- index.ts
- NavBar.test.tsx
- NavBar.tsx
- AppProviders.tsx
- index.ts
- index.ts
- main.tsx
- routes.test.tsx
- routes.tsx
- jetbrains-mono-latin-400.woff2
- jetbrains-mono-latin-500.woff2
- jetbrains-mono-latin-700.woff2
- api.test.ts
- api.ts
- index.ts
- semantics.test.ts
- semantics.ts
- styles.ts
- api.test.ts
- api.ts
- errors.test.ts
- errors.ts
- index.ts
- model.ts
- queries.ts
- dto.ts
- index.ts
- parity.test.ts
- api.test.ts
- api.ts
- index.ts
- api.test.ts
- api.ts
- index.ts
- api.test.ts
- api.ts
- index.ts
- model.test.ts
- model.ts
- queries.ts
- api.test.ts
- api.ts
- index.ts
- api.test.ts
- api.ts
- index.ts
- queries.ts
- api.ts
- index.ts
- api.test.ts
- api.ts
- index.ts
- model.test.ts
- model.ts
- queries.test.ts
- queries.ts
- exposure.ts
- index.ts
- remediation.test.ts
- remediation.ts
- index.ts
- projection.ts
- AuthCoverage.tsx
- AuthEvidence.test.tsx
- CategoryBreakdown.test.tsx
- CategoryBreakdown.tsx
- Chokepoints.tsx
- CrossProtocol.test.tsx
- CrossProtocol.tsx
- Dashboard.tsx
- DashboardHeader.tsx
- ExposureGauge.tsx
- InventoryTrend.tsx
- RecentScans.tsx
- SeverityRings.tsx
- StatCards.tsx
- TopFindings.test.tsx
- TopFindings.tsx
- TopRiskyEntities.tsx
- index.ts
- export-markdown.test.ts
- export-markdown.ts
- chokepoints.test.ts
- click-neighbors.test.ts
- critical-chains.test.ts
- graph-builder.test.ts
- lens-config.test.ts
- useExplorerGraph.test.ts
- useExplorerViewModel.test.ts
- view-model.test.ts
- build-edges.ts
- build-graph.ts
- build-nodes.ts
- clustering.ts
- edge-key.ts
- index.ts
- metrics.ts
- protocol.ts
- to-react-flow.ts
- types.ts
- chokepoints.ts
- click-neighbors.ts
- critical-chains.ts
- layout.ts
- lens-config.ts
- store.ts
- useBlastRadius.ts
- useExplorerGraph.ts
- useExplorerViewModel.ts
- view-model.ts
- ConnectionsTab.tsx
- EvidenceTab.test.tsx
- EvidenceTab.tsx
- FindingsTab.tsx
- PropertiesTab.test.tsx
- PropertiesTab.tsx
- RemediationTab.tsx
- LensEdge.tsx
- SelfLoopEdge.tsx
- HexNode.tsx
- NodeHandles.tsx
- OrphanClusterNode.test.tsx
- OrphanClusterNode.tsx
- BlastRadiusRings.tsx
- ChainRibbon.tsx
- EdgeDetailDrawer.test.tsx
- EdgeDetailDrawer.tsx
- EdgeTooltip.test.tsx
- EdgeTooltip.tsx
- ExplorerCanvas.tsx
- ExplorerDeepLink.tsx
- ExplorerEmptyState.tsx
- ExplorerNodeContextMenu.tsx
- InfoCard.tsx
- Legend.test.tsx
- Legend.tsx
- LensBar.test.tsx
- LensBar.tsx
- NodeDetailDrawer.tsx
- StatusStrip.tsx
- ExplorerPage.tsx
- index.ts
- copy-report.test.ts
- copy-report.ts
- edge-exploits.ts
- evidence-label.ts
- owasp-titles.ts
- property-chips.test.ts
- property-chips.ts
- grouping.test.ts
- grouping.ts
- useFindingsNavigation.ts
- AttackCostMeter.test.tsx
- AttackCostMeter.tsx
- AttackPathDiagram.test.ts
- AttackPathDiagram.tsx
- CopyableCodeBlock.tsx
- FindingDetailPage.tsx
- FindingHeader.tsx
- FindingImpact.tsx
- FindingProof.test.tsx
- FindingProof.tsx
- FindingReferences.tsx
- FindingRemediation.tsx
- FindingsListPage.test.tsx
- FindingsListPage.tsx
- HopEvidenceTimeline.tsx
- InstructionEvidencePanel.test.tsx
- InstructionEvidencePanel.tsx
- MiniHexIcon.tsx
- PathEdgeArrow.tsx
- PathHexNode.tsx
- TriageControl.tsx
- index.ts
- QueryLibrary.tsx
- QueryResult.test.tsx
- QueryResult.tsx
- index.ts
- provenance.test.ts
- provenance.ts
- RuleCard.tsx
- RuleDetail.tsx
- RuleFilters.tsx
- RulesLibrary.test.tsx
- RulesLibrary.tsx
- index.ts
- NewScan.tsx
- ScanHistory.tsx
- ScanImport.test.tsx
- ScanImport.tsx
- ScanManager.tsx
- index.ts
- index.ts
- client.ts
- conflicts.ts
- index.ts
- pagination.ts
- query-client.ts
- query-keys.ts
- traverse.ts
- format.ts
- hex-config.ts
- index.ts
- is-editable-target.ts
- useCountUp.ts
- useEscapeKey.ts
- utils.ts
- index.ts
- marks.ts
- triage.ts
- globals.css
- index.ts
- index.ts
- parity.test.ts
- tokens.ts
- AsyncBoundary.tsx
- DataStateNotice.tsx
- ErrorBoundary.tsx
- index.ts
- Center.tsx
- Cluster.tsx
- Grid.tsx
- index.ts
- Sidebar.tsx
- Stack.tsx
- Switcher.tsx
- badge.tsx
- button.tsx
- card.tsx
- dialog.tsx
- index.ts
- input.tsx
- scroll-area.tsx
- select.tsx
- separator.tsx
- severity-badge.tsx
- skeleton.tsx
- table.tsx
- tabs.tsx
- tooltip.tsx
- AreaTrend.tsx
- DeltaBadge.tsx
- index.ts
- InfoTip.tsx
- MeterBar.tsx
- MiniSankey.tsx
- RadialGauge.tsx
- Sparkline.tsx
- StatTile.tsx
- StatusPill.tsx
- WidgetCard.tsx
- index.ts
- index.ts
- test-setup.ts
- vite-env.d.ts
- .gitkeep
- ARCHITECTURE.md
- components.json
- eslint.config.js
- index.html
- package-lock.json
- package.json
- postcss.config.js
- tailwind.config.ts
- tsconfig.json
- tsconfig.node.json
- vite.config.ts
- claude_desktop_config.json
- assertions.sh
- seed-services.sh
- verify-upstreams.sh
- wait-ready.sh
- agent.py
- Dockerfile
- requirements.lock
- requirements.txt
- Dockerfile
- nginx.conf
- requirements.lock
- requirements.txt
- sign_card.py
- Dockerfile
- requirements.lock
- requirements.txt
- serve.py
- config-decoy.yaml
- config.yaml
- bearer-gate.mjs
- credential-gate.mjs
- Dockerfile
- package-lock.json
- package.json
- support-context.md
- agenthound-fixture.ipynb
- contextforge-seed.sh
- cross-service-config-seed.sh
- litellm-seed.py
- mlflow-seed.py
- ollama-seed.sh
- openwebui-seed.sh
- qdrant-seed.sh
- settings.json
- default.json
- CLAUDE.md
- settings.json
- mcp_config.json
- mcp.json
- settings.json
- config.yaml
- mcp.json
- mcp.json
- mcp.json
- default.json
- mcp.json
- agenthound-harness.mdc
- mcp.json
- copilot-instructions.md
- mcp.json
- mcp.json
- mcp.json
- .mcp.json
- AGENTS.md
- CLAUDE.md
- .keep
- .claude.json
- .claude.json
- Dockerfile
- entrypoint.sh
- package-lock.json
- package.json
- .gitignore
- docker-compose.smoke.yml
- docker-compose.yml
- README.md
- run-smoke.sh
- run-tests.sh
- UPSTREAMS.md
- agent_card_no_auth.json
- agent_card_signed.json
- agent_card_v030.json
- agent_card_v10.json
- amazon_q.json
- augment_settings.json
- augment_settings_array.json
- augment_settings_nested.json
- claude_code.json
- claude_desktop.json
- cline_mcp_settings.json
- continue.yaml
- cursor.json
- jetbrains.json
- kiro.json
- vscode_mcp.json
- vscode_settings.json
- vscode_settings_dotted.json
- windsurf.json
- zed_settings.json
- gen_fixture.go
- gen_q8_fixture.go
- gen_upstream_fixture.py
- gguf-py-0.17.1.gguf
- synthetic.gguf
- synthetic_q8.gguf
- invalid_scan.json
- merged_scan.json
- valid_a2a_scan.json
- valid_config_scan.json
- valid_mcp_scan.json
- .dockerignore
- .gitignore
- .golangci.yml
- .goreleaser.yml
- CHANGELOG.md
- CLAUDE.md
- CONTRIBUTING.md
- go.mod
- go.sum
- install.sh
- LICENSE
- Makefile
- mkdocs.yml
- README.md
- SECURITY.md
// repository documentation
Was this content helpful?
(0 ratings)