Drop one static collector on a compromised host. One active scan captures configs and raw credentials, discovers MCP, A2A and AI services, reuses compatible secrets, proves concrete access, and checkpoints the evidence before the foothold disappears. Ingest later for full graph analysis.
curl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/1.1.0/install.sh | AGENTHOUND_VERSION=1.1.0 sh
Collects and connects evidence across MCP servers, A2A agents, LiteLLM, Ollama, vLLM, Qdrant, MLflow, Jupyter, Open WebUI, and LangServe.
AgentHound treats the compromised host, agent clients, protocols and reachable AI services as one expanding target set. Local secrets and network observations feed the same planner and the same artifact.
The local planner turns every new endpoint, credential and capability into the next useful candidate. The operator chooses scope and mode—not a sequence of internal modules.
Capture supported configs, instruction sources, concrete credentials, local interfaces and configured endpoints.
Find MCP, A2A and AI services; fingerprint them and inventory useful data anonymously or with exact configured auth.
Reuse compatible secrets, prove exact MCP resource access, and run eligible bounded active validations in the same scan.
Checkpoint every result and recovery transition locally. Ingest the artifact later for complete graph analysis and triage.
The collector can verify exact credential-to-resource access without a database on the foothold. Manual ingestion later adds full-graph reachability, execution, exfiltration, impersonation, poisoning and data-flow analysis.
AgentHound 1.1 prioritizes what a red-team operator can collect and prove during a short-lived foothold. Every capability feeds the same planner, artifact and graph.
Concrete bearer tokens, API keys, master keys and Jupyter tokens are stored as usable material, deduplicated by value hash and associated with every source. The planner re-indexes new credentials as they appear and presents them only through compatible service adapters.
Compare an anonymous control read with an authenticated read of the exact resource. Denied without the credential and allowed with it becomes Verified During Scan evidence—not a reachability guess.
For an eligible managed tool, write a scan-specific marker, observe it through MCP, immediately restore the original and independently confirm restoration before planning continues.
Inventory Ollama models, modelfiles, templates and system prompts; LiteLLM gateway context; MLflow registries; Jupyter files; and Qdrant collections. Deep mode adds recursive instructions, vector payload samples and bounded Ollama embedding invocation.
--stealth disables credential reuse, compute, tool invocation and mutation. Repeatable exclusions guard hostnames, addresses, CIDRs, DNS results, redirects, derived URLs, cleanup calls and final dials.
The collector creates an ingest-valid artifact before network work and checkpoints each meaningful result and action transition. Recovery state is persisted before mutation; unresolved cleanup can be retried with agenthound revert.
Manual ingestion turns the artifact into published findings and paths across reachability, credential chains, execution, exfiltration, impersonation, shadowing, poisoned context and untrusted data flow. Risk scoring, scan history, diffing and triage remain on the optional analysis system.
Active verification is the default. Add depth when the foothold and time budget allow it, or switch to stealth when the operation must remain read-only.
agenthound scanagenthound scan --deepagenthound scan --stealthagenthound scan --stealth --deepThe collector is a static binary with no database or server dependency. It writes one local JSON artifact; move that artifact to the optional analysis system when the operation allows.
curl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/1.1.0/install.sh | AGENTHOUND_VERSION=1.1.0 shbrew install adithyan-ak/agenthound/agenthoundagenthound scan --output scan.jsonagenthound scan 10.20.0.0/24 --deep --exclude 10.20.0.15 --output scan.jsoncurl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/1.1.0/docker/docker-compose.public.yml -o agenthound-compose.ymldocker compose -f agenthound-compose.yml -p agenthound up -d --waitdocker compose -f agenthound-compose.yml -p agenthound exec -T agenthound agenthound-server ingest - < scan.json