AI Agent Attack Path Graph and MCP Credential Chain: Deconstructing the AgentHound Red Team Framework
「AI Agent攻击路径图谱+MCP凭证链：AgentHound红队框架拆解」
The open-source red team framework AgentHound (release 1.1.1) uses a Go static collector to collect Agent configurations, MCP/A2A services and credentials on already-controlled hosts, then imports them into Neo4j to generate a queryable attack path graph. It actively scans by default, reuses compatible credentials, performs differential reads and reversible changes, and --stealth can switch it to read-only; evidence is divided into six tiers including observed_signal, verified and hypothesis, where verified only means that this credential read succeeded. The article also lists 12 kinds of Agent client configurations, preset queries, and usage boundaries such as plaintext credentials and analysis servers without authentication.
AgentHound turns the credential chains and attack paths of Agent infrastructure into a queryable graph, and uses six evidence tiers to distinguish verified access from hypothetical paths, making it easier to check the boundaries of conclusions during red team assessments.