One open-source tool runs the full offensive lifecycle (recon, credential looting, modelfile / system-prompt / fine-tune inventory, inversion, tool/instruction poisoning, config implants) across every layer of the agentic stack: MCP, A2A, gateways, inference servers, vector stores and notebooks. Then proves the attack paths in one Neo4j graph.
curl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/main/install.sh | sh
Maps and attacks every layer across MCP servers, A2A agents, LiteLLM, Ollama, vLLM, Qdrant, MLflow, Jupyter, Open WebUI, and LangServe.
AgentHound treats the entire agentic estate as one target set: client configs, protocols, gateways, inference, vector stores, MLOps, notebooks, frontends. No single-protocol scanner, A2A scanner, or LLM-gateway tool covers this surface.
AgentHound sweeps, harvests, exploits, analyzes and cleans up. Recon and loot land structured evidence in one Neo4j graph; dry-run-first exploit, campaign and recovery workflows carry the engagement through without manual stitching.
Scan local configs and MCP/A2A targets, or fingerprint AI/ML services across networks.
JSON-RPC initialize probes + A2A agent-card fetches over the wire.
Read-only credential, model and service inventory across LiteLLM, Ollama, Open WebUI, MLflow, Qdrant and Jupyter.
Mutate tool descriptions or instruction files. --commit required.
Plant persistence in .cursor/mcp.json & friends.
Idempotent rollback by engagement-id. Receipts gate every mutation.
Embedding inversion on locally obtained GGUF weights. Detect fine-tune training signals.
Verify predicted credential reach and reversible MCP poisoning with bounded live probes.
19 prebuilt attack-path queries, crosswalked to OWASP MCP & Agentic Top 10 and 7 MITRE ATLAS techniques. Findings snapshot to Postgres for retest-as-diff, proving a path is gone, not just re-reported.
Modelfile, system-prompt and fine-tune inventory, local model inversion, credential looting across gateways, tool and instruction poisoning, config implants, RAG enumeration, and the cross-protocol graph analysis that ties the loot together at the end.
The Ollama looter inventories model names, digests, sizes, modelfiles, templates and system prompts, and flags likely fine-tunes through the HTTP API. Raw model weights are not available through Ollama's HTTP API; obtaining them requires authorized filesystem access to the Ollama model store.
One LiteLLM master key → observed master-key exposure, masked provider references and hashed virtual-key inventory. Observed credential material correlates across collectors by value_hash.
A pure-Go GGUF parser runs statistical inversion on the embedding matrix to recover likely fine-tune vocabulary tokens. Provide a GGUF copied through authorized filesystem access, then invert locally.
Rewrite an MCP tool description, or inject a sentinel block into CLAUDE.md / .cursorrules. Reversible, --commit-gated.
Add a malicious MCP server to .cursor/mcp.json; the IDE auto-trusts the attacker's server on every future launch.
Inventory Qdrant collections and Jupyter sessions/notebook trees; AgentHound records anonymous access only after a credential-free probe succeeds.
15 post-processors compute 12 composite edges. CAN_REACH ties the loot together: the last-mile join, up to 6 hops, not the headline.
Every poison and implant persists a Receipt before mutation. revert is idempotent, Reverters are compile-time mandatory, and unsafe target-state conflicts fail closed.
22 self-registering modules, the protoscan discovery engine and 2 campaign scenarios converge on one queryable, pathfindable graph, crosswalked to OWASP MCP & Agentic Top 10 and 7 MITRE ATLAS techniques.
Prerequisites: Docker + Compose v2 — no Go, no Node.js, no git clone. The server runs from a prebuilt image and binds 127.0.0.1:8080; the collector is a single static binary, offline by default and sends no product telemetry.
curl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/main/docker/docker-compose.public.yml | docker compose -f - -p agenthound up -d --waitcurl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/main/install.sh | shexport PATH="$HOME/.local/bin:$PATH"agenthound scan --config --output - | curl -sSf --data-binary @- -H "Content-Type: application/json" http://127.0.0.1:8080/api/v1/ingest(command -v open >/dev/null && open http://127.0.0.1:8080) || xdg-open http://127.0.0.1:8080