{"slug": "how-to-build-an-ai-agent-attack-graph-with-agenthound", "title": "How to Build an AI Agent Attack Graph with AgentHound", "summary": "AgentHound 1.1.0, an open-source tool from GitHub user adithyan-ak, builds an AI agent attack graph from a single autonomous collection workflow, modeling MCP servers, A2A agents, credentials, hosts, and AI services to reveal reachable weaknesses. The collector runs as a static binary without a database or analysis server, preserves evidence in one JSON artifact, and supports modes including --stealth for read-only operations and --deep for recursive discovery. The tool is intended for authorized security assessments of systems the operator owns.", "body_md": "Most AI agent security reviews start with a list: models, tools, servers, credentials, and policies. The list is useful, but it hides the relationships that decide whether a weakness is reachable.\n\nAn attack graph shows the relationships that a flat inventory misses. You can see which agent trusts the server that exposes a risky tool, which host runs that agent, which concrete credentials connect other services, and whether the path reaches sensitive data or an outbound channel.\n\n[AgentHound](https://github.com/adithyan-ak/agenthound) builds this graph from one autonomous collection workflow. The collector runs without a database or analysis server on the foothold, continuously preserves its evidence in one JSON artifact, and leaves ingestion under the operator's control.\n\n## What the graph represents\n\nAgentHound models MCP servers, tools, resources and prompts; A2A agents and skills; local agent instances, configuration and instruction files; credentials and identities; hosts; and supported AI services such as LiteLLM, Open WebUI, Ollama, vLLM, Qdrant, MLflow, Jupyter, and LangServe.\n\nRaw edges record observations such as an agent trusting an MCP server or a server providing a tool. Server-side processors rebuild higher-level relationships such as `CAN_REACH`\n\n, `CAN_EXECUTE`\n\n, `CAN_EXFILTRATE_VIA`\n\n, credential chains, poisoning, tainted data flow, and cross-protocol paths.\n\nThe evidence state tells you how strongly to read each result:\n\n| Evidence state | What it means |\n|---|---|\n| Observed signal | The collector directly observed the fact represented by the finding |\n| Inferred | Current graph evidence satisfies a deterministic analysis path |\n| Verified | The scan proved that one exact credential could read one exact MCP resource after the anonymous control was denied |\n| Hypothesis | A bounded correlation, such as host co-location across protocols, still needs operator validation |\n| Reference only | A masked, hashed, or unresolved value is useful context but not executable credential material |\n\nThese edges describe evidence and testable paths. They do not claim that an agent traversed each one.\n\n## Install the collector on the foothold\n\nInstall the pinned 1.1 release and verify it:\n\n```\ncurl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/1.1.0/install.sh \\\n  | AGENTHOUND_VERSION=1.1.0 sh\nexport PATH=\"$HOME/.local/bin:$PATH\"\nagenthound version\n```\n\nThe collector is a static binary. It does not need Neo4j, PostgreSQL, Node.js, or a connection to the AgentHound server.\n\nAn ordinary scan is active: when prerequisites are present, the planner can reuse compatible credentials, perform differential MCP resource reads, and run a reversible ContextForge description round trip. Use it only on systems you own or are authorized to assess. If the operation must stay read-only, use `--stealth`\n\n.\n\n## Run one autonomous scan\n\nThe fastest useful starting point is a targetless scan:\n\n```\nagenthound scan --output foothold.json\n```\n\nLocal configuration, instruction, and credential collection always runs. Without a positional target, AgentHound also seeds loopback, active local interfaces, configured MCP endpoints, and the standard ports of supported AI services.\n\nThe planner then turns new observations into more work. It fingerprints responding services, runs the applicable MCP, A2A, gateway, model, vector, MLOps, notebook, and web-interface collectors, and reuses only concrete credentials supported by the destination adapter. Newly collected targets and credentials can unlock more candidates during the same scan.\n\nUse `--deep`\n\nwhen recursive instruction discovery, Qdrant payload samples, more expensive probes, and bounded Ollama embedding verification are in scope:\n\n```\nagenthound scan --deep --output foothold-deep.json\n```\n\nFor anonymous and exact configured read-only collection:\n\n```\nagenthound scan --stealth --output foothold-stealth.json\n```\n\nStealth mode disables cross-target credential reuse, model and tool invocation, and mutation. `--stealth --deep`\n\nexpands read-only filesystem and payload collection without enabling those actions.\n\n## Add bounded network scope\n\nOne hostname, IP, CIDR, or targets file can be added without disabling local collection:\n\n```\nagenthound scan 10.20.0.0/24 \\\n  --exclude 10.20.0.15 \\\n  --output subnet.json\n\nagenthound scan @targets.txt --deep --output estate.json\n```\n\n`--exclude`\n\nis repeatable. Its contact policy applies to exact hostnames, IPs, CIDRs, DNS results, redirects, derived management and cleanup URLs, remote JWKS locations, and the final socket dial. An excluded endpoint found in local configuration can remain graph evidence without being contacted.\n\nExplicit public targets are accepted, so authorization and scope are the operator's responsibility. Avoid broad ranges when a smaller hostname, IP, or targets file answers the question.\n\n## Preserve the artifact as sensitive evidence\n\nAgentHound creates an ingest-valid artifact before collection and replaces it with a complete checkpoint after every meaningful collection result, action transition, and recovery transition. The final file contains the graph, scan mode, exclusions, action outcomes, recovery records, returned content, and concrete credential values.\n\nOn an unstable foothold, independent collector failures remain in the evidence while unrelated work continues. A lost connection does not force the operator to reconstruct the scan from a server-side session.\n\nTreat the file like credential material. The collector uses restrictive file permissions where supported, but the JSON is intentionally usable and can contain raw secrets.\n\nIf the final summary reports unresolved cleanup, preserve the same artifact and retry recovery:\n\n```\nagenthound revert foothold.json\n```\n\n`revert`\n\nprocesses unresolved records newest-first, observes current state before writing, and refuses to overwrite a conflicting third-party change.\n\n## Start the analysis stack and ingest manually\n\nDeploy the optional server on the analysis system, not the foothold:\n\n```\ncurl -sSfL \\\n  https://raw.githubusercontent.com/adithyan-ak/agenthound/1.1.0/docker/docker-compose.public.yml \\\n  -o agenthound-compose.yml\ndocker compose -f agenthound-compose.yml -p agenthound up -d --wait\n```\n\nMove the completed artifact to that system and ingest it:\n\n```\ndocker compose -f agenthound-compose.yml -p agenthound exec -T agenthound \\\n  agenthound-server ingest - < foothold.json\n```\n\nIf the server is installed directly, use `agenthound-server ingest foothold.json`\n\n. Open `http://127.0.0.1:8080`\n\nto inspect the dashboard. AgentHound is a single-user application bound to loopback by default; use an SSH tunnel, private network controls, or an authenticated reverse proxy for remote access.\n\n## Read the attack graph without fooling yourself\n\nStart with the graph lens that matches the question. The attack-surface view reduces visual noise around credentials, resources, protocols, and reachability relationships.\n\nTrace a path from a plausible attacker-controlled source toward a meaningful sink:\n\n- Identify the source and the evidence that makes it untrusted.\n- Check the raw relationships, collection scope, and timestamp supporting each composite edge.\n- Distinguish observed, inferred, verified, and hypothesis evidence.\n- Verify the sink's capability instead of trusting its name.\n- Record missing preconditions before describing the path as exploitable.\n\nFor same-scan MCP proof, AgentHound first reads an eligible resource anonymously. If that succeeds, it records `PUBLIC_ACCESS_OBSERVED`\n\nwithout presenting a credential. Otherwise, an anonymous denial followed by a successful credentialed read records `CREDENTIAL_ACCESS_OBSERVED`\n\n. During ingest, only an existing `CAN_REACH`\n\npath containing that exact credential and resource is upgraded to **Verified During Scan**.\n\n## Query findings and paths reproducibly\n\nThe server CLI exposes the same published projection used by the dashboard:\n\n```\nagenthound-server query --prebuilt agents-shell-access\nagenthound-server query --prebuilt credential-chain\nagenthound-server query --prebuilt exfiltration-routes\nagenthound-server query --prebuilt cross-protocol-paths\nagenthound-server query --findings --severity high --format json\n```\n\nFor each result, preserve four pieces of context:\n\n| Field | Question to answer |\n|---|---|\n| Scope | Which collector domains were complete, partial, failed, or absent? |\n| Provenance | Which scan and source collector produced the supporting evidence? |\n| Derivation | Which processor or rule created the finding? |\n| Validation | What authorized test would confirm or refute the remaining inference? |\n\nFinding detail includes the exact evidence subgraph captured when that revision was published. A later graph change therefore does not silently rewrite the explanation attached to an existing finding.\n\n## Repeat the scan after changes\n\n- Run the same bounded scope after agent configuration, MCP, A2A, or service changes.\n- Compare findings and high-impact paths instead of relying on node counts.\n- Treat new credential joins, verified access, and cross-protocol correlations as review triggers.\n- Keep incomplete coverage and unknown risk factors visible.\n- Validate the highest-value remaining hypothesis in a disposable or explicitly authorized environment.\n\nDo not put raw scan artifacts or revealed credential values in screenshots, tickets, or public research. A `value_hash`\n\ncan join repeated observations, but masked, hashed, and unresolved references remain non-executable evidence.\n\n## Where to go next\n\n[Prompt Injection Is a Data-Flow Problem: Mapping AI Agent Attack Paths with AgentHound](/prompt-injection-ai-agent-attack-paths-agenthound/) explains `POISONED_INSTRUCTIONS`\n\n, `POISONED_DESCRIPTION`\n\n, `TAINTS`\n\n, `IFC_VIOLATION`\n\n, and `POISONS_CONTEXT`\n\nas distinct source-to-sink claims.\n\n[MCP Tool Poisoning: Detect and Safely Validate It with AgentHound](/mcp-tool-poisoning-detect-reverse-agenthound/) covers passive detection, the eligible ContextForge round trip inside an active scan, the execution journal, and artifact-based recovery.", "url": "https://wpnews.pro/news/how-to-build-an-ai-agent-attack-graph-with-agenthound", "canonical_source": "https://adithyanak.com/build-ai-agent-attack-graph-agenthound", "published_at": "2026-08-03 16:00:00+00:00", "updated_at": "2026-08-30 22:52:18.164056+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-infrastructure"], "entities": ["AgentHound", "adithyan-ak", "GitHub", "MCP", "A2A", "LiteLLM", "Open WebUI", "Ollama"], "alternates": {"html": "https://wpnews.pro/news/how-to-build-an-ai-agent-attack-graph-with-agenthound", "markdown": "https://wpnews.pro/news/how-to-build-an-ai-agent-attack-graph-with-agenthound.md", "text": "https://wpnews.pro/news/how-to-build-an-ai-agent-attack-graph-with-agenthound.txt", "jsonld": "https://wpnews.pro/news/how-to-build-an-ai-agent-attack-graph-with-agenthound.jsonld"}}