How adithyan-ak/agenthound works
AgentHound is an offensive security framework for agentic infrastructure. Its main workflow starts from a foothold: the collector discovers local agent configuration and reachable services, inventories targets, reuses credentials, and performs eligible validation before writing an ingest artifact. The optional server ingests that artifact, builds and analyzes an attack graph, and exposes findings and graph data through its API and UI; the CLI also supports querying. README statements document the broad workflow and service capabilities; sampled source confirms selected module, ingest, API, and UI links, while unsampled implementation details are not assumed.
Main entry points: scan_unified.go Collector CLI · pipeline.go Ingest pipeline · server.go Server API · ingest.go Server CLI
Components 21
Collection
- Collector CLI
collector/cli/scan_unified.go - Config discovery
modules/config - Service discovery
modules/networkscan/scanner.go - MCP inventory
modules/mcp/enumerate.go - A2A assessment
modules/a2a/auth_probe.go - Service collection
modules - Service fingerprinting
modules - Active validation
modules/mcppoison/contextforge.go
Collector framework
- Collector runtime
sdk/module/registry.go - Scan artifact
sdk/ingest/ingest.go
Analysis server
- Server CLI
server/cli/ingest.go - Ingest pipeline
server/internal/ingest/pipeline.go - Attack graph
server/internal/graph - Application store
server/internal/appdb - Graph analysis
server/internal/analysis - Server API
server/internal/api/server.go - Query CLI
server/cli/query.go
Operator interface
- Scan management UI
server/ui/src/features/scans/ui/ScanManager.tsx - Analysis UI
server/ui/src/features
Other components
- Operator
- Operator
Connections 23
- Operator → Collector CLI: starts scan
- Collector CLI → Config discovery: collects config
- Collector CLI → Service discovery: discovers services
- Collector CLI → MCP inventory: enumerates MCP
- Collector CLI → A2A assessment: assesses A2A
- Collector CLI → Service collection: collects services
- Collector CLI → Service fingerprinting: fingerprints targets
- Collector CLI → Active validation: validates access
- Collector CLI → Collector runtime: loads modules
- Collector runtime → Scan artifact: records results
- Operator → Server CLI: submits artifact
- Server CLI → Ingest pipeline: ingests artifact
server/cli/ingest.go - Ingest pipeline → Attack graph: writes graph
server/internal/ingest/pipeline.go - Ingest pipeline → Graph analysis: runs processors
server/internal/ingest/pipeline.go - Ingest pipeline → Application store: publishes state
server/internal/ingest/pipeline.go - Graph analysis → Attack graph: queries graph
server/internal/analysis/riskscore/server.go - Server API → Ingest pipeline: routes ingest
server/internal/api/server.go - Server CLI → Graph analysis: queries findings
- Server API → Operator: serves data
server/internal/api/server.go - Operator → Scan management UI: manages scans
server/ui/src/features/scans/ui/ScanManager.tsx - Operator → Analysis UI: explores findings
- Scan management UI → Server API: requests scans
- Analysis UI → Server API: requests analysis