Bloodhound MCP AI

🚀 BloodHound-MCP

BloodHound-MCP is a powerful integration that brings the capabilities of the Model Context Protocol (MCP) Server to BloodHound, enabling natural language analysis of BloodHound data for easier Active Directory security assessment.

🚀 Quick Start

BloodHound-MCP is a powerful integration that brings the functionality of the Model Context Protocol (MCP) Server to BloodHound, an industry-standard tool for analyzing Active Directory security. This integration allows users to analyze BloodHound data through natural language, making complex Active Directory attack path analysis accessible to everyone.

🥇 First BloodHound AI Integration!
This is the first integration of BloodHound with AI, originally announced here.

🔍 What is BloodHound-MCP?

BloodHound-MCP combines the following capabilities:

• BloodHound: An industry-standard tool for visualizing and analyzing Active Directory attack paths.
• Model Context Protocol (MCP): An open protocol for creating custom AI tools, compatible with multiple AI models.
• Neo4j: The graph database used by BloodHound to store AD relationship data.

With 75 professional tools based on the original BloodHound CE Cypher queries, BloodHound-MCP allows security professionals to:

• Query BloodHound data using natural language.
• Discover complex attack paths in the Active Directory environment.
• Evaluate the Active Directory security status more efficiently.
• Generate detailed reports for the security department.

🌱 Community

Join our Telegram channel for updates, tips, and discussions:

• Telegram: root_sec

🌟 Star History

✨ Features

• Natural Language Interface: Query BloodHound data using plain English.
• Comprehensive Analysis Categories:
  • Domain structure mapping.
  • Privilege escalation paths.
  • Kerberos security issues (Kerberoasting, AS-REP Roasting).
  • Certificate service vulnerabilities.
  • Active Directory hygiene assessment.
  • NTLM relay attack vectors.
  • Agent abuse opportunities.
  • And more!

📦 Installation

Prerequisites

• BloodHound version 4.x+ with data collected from the Active Directory environment.
• A Neo4j database loaded with BloodHound data.
• Python 3.8 or higher.
• MCP client.

Steps

1. Clone this repository:

   git clone https://github.com/your-username/MCP-BloodHound.git
   cd MCP-BloodHound
   

2. Install dependencies:

   pip install -r requirements.txt
   

3. Configure the MCP server:

   "mcpServers": {
       "BloodHound-MCP": {
           "command": "python",
           "args": [
               "<Your_Path>\\BloodHound-MCP.py"
           ],
           "env": {
               "BLOODHOUND_URI": "bolt://localhost:7687",
               "BLOODHOUND_USERNAME": "neo4j",
               "BLOODHOUND_PASSWORD": "bloodhound"
           }
       }
   }
   

💻 Usage Examples

Basic Usage

• Step 1: Configure the MCP server

  • Edit the mcp.json file and add the BloodHound-MCP server configuration.

• Step 2: Start the MCP service

  mcp-service start
  

• Step 3: Start analysis

  # Example query
  bloodhound query --server http://localhost:9091 -q "SELECT * FROM process"
  

📋 Important Note

• Ensure that the MCP service is running.
• Make sure the configuration file path is correct.

💡 Usage Tip

When using BloodHound-MCP, please comply with relevant security and legal regulations to ensure legal compliance.

With BloodHound-MCP, you can conduct Active Directory security analysis more efficiently and intuitively.