// MCP TOOL REFERENCE

BLOODHOUND MCP TOOLS

75 tools from the BloodHound MCP MCP Server, categorised by risk level.

View the BloodHound MCP policy →
// ALL 75 BLOODHOUND MCP TOOLS
READ 73 tools
Read find_all_domain_admins find_all_domain_admins Read find_all_kerberoastable_users find_all_kerberoastable_users Read find_asreproast_users find_asreproast_users Read find_ca_administrators find_ca_administrators Read find_certificate_enrollment_rights find_certificate_enrollment_rights Read find_computers_in_protected_users find_computers_in_protected_users Read find_computers_no_smb_signing find_computers_no_smb_signing Read find_computers_outbound_ntlm_deny find_computers_outbound_ntlm_deny Read find_computers_webclient_running find_computers_webclient_running Read find_dcs_vulnerable_ntlm_relay find_dcs_vulnerable_ntlm_relay Read find_dcs_weak_certificate_binding find_dcs_weak_certificate_binding Read find_dcsync_privileges find_dcsync_privileges Read find_devices_unsupported_os find_devices_unsupported_os Read find_disabled_azure_tier_zero_principals find_disabled_azure_tier_zero_principals Read find_disabled_tier_zero_principals find_disabled_tier_zero_principals Read find_domain_admin_non_dc_logons find_domain_admin_non_dc_logons Read find_domain_users_high_value_paths find_domain_users_high_value_paths Read find_domain_users_laps_readers find_domain_users_laps_readers Read find_domain_users_local_admins find_domain_users_local_admins Read find_domain_users_privileges find_domain_users_privileges Read find_domain_users_server_rdp find_domain_users_server_rdp Read find_domain_users_workstation_rdp find_domain_users_workstation_rdp Read find_domains_with_machine_quota find_domains_with_machine_quota Read find_enrollment_agent_templates find_enrollment_agent_templates Read find_entra_users_in_domain_admins find_entra_users_in_domain_admins Read find_esc1_vulnerable_templates find_esc1_vulnerable_templates Read find_esc2_vulnerable_templates find_esc2_vulnerable_templates Read find_esc8_vulnerable_cas find_esc8_vulnerable_cas Read find_external_tier_zero_users find_external_tier_zero_users Read find_foreign_group_memberships find_foreign_group_memberships Read find_foreign_tier_zero_principals find_foreign_tier_zero_principals Read find_global_administrators find_global_administrators Read find_high_privileged_role_members find_high_privileged_role_members Read find_inactive_tier_zero_principals find_inactive_tier_zero_principals Read find_kerberoastable_most_admin find_kerberoastable_most_admin Read find_kerberoastable_tier_zero find_kerberoastable_tier_zero Read find_nested_tier_zero_groups find_nested_tier_zero_groups Read find_ntlm_relay_edges find_ntlm_relay_edges Read find_onprem_users_in_entra_groups find_onprem_users_in_entra_groups Read find_onprem_users_owning_entra_objects find_onprem_users_owning_entra_objects Read find_paths_from_azure_apps_to_tier_zero find_paths_from_azure_apps_to_tier_zero Read find_paths_from_domain_users_to_tier_zero find_paths_from_domain_users_to_tier_zero Read find_paths_from_entra_to_tier_zero find_paths_from_entra_to_tier_zero Read find_paths_from_kerberoastable_to_da find_paths_from_kerberoastable_to_da Read find_paths_from_owned_objects find_paths_from_owned_objects Read find_paths_to_azure_subscriptions find_paths_to_azure_subscriptions Read find_paths_to_privileged_roles find_paths_to_privileged_roles Read find_pki_hierarchy find_pki_hierarchy Read find_principals_des_only_kerberos find_principals_des_only_kerberos Read find_principals_reversible_encryption find_principals_reversible_encryption Read find_principals_weak_kerberos_encryption find_principals_weak_kerberos_encryption Read find_public_key_services find_public_key_services Read find_shortest_paths_to_domain_admins find_shortest_paths_to_domain_admins Read find_shortest_paths_to_tier_zero find_shortest_paths_to_tier_zero Read find_shortest_paths_unconstrained_delegation find_shortest_paths_unconstrained_delegation Read find_smartcard_dont_expire_domains find_smartcard_dont_expire_domains Read find_sp_graph_assignments find_sp_graph_assignments Read find_synced_tier_zero_principals find_synced_tier_zero_principals Read find_tier_zero_locations find_tier_zero_locations Read find_tier_zero_non_expiring_passwords find_tier_zero_non_expiring_passwords Read find_tier_zero_without_smartcard find_tier_zero_without_smartcard Read find_two_way_forest_trust_delegation find_two_way_forest_trust_delegation Read find_unsupported_operating_systems find_unsupported_operating_systems Read find_users_password_not_rotated find_users_password_not_rotated Read find_users_with_no_password_required find_users_with_no_password_required Read map_domain_trusts map_domain_trusts Read map_ou_structure map_ou_structure Read onprem_users_direct_azure_roles onprem_users_direct_azure_roles Read onprem_users_direct_entra_roles onprem_users_direct_entra_roles Read onprem_users_group_azure_roles onprem_users_group_azure_roles Read onprem_users_group_entra_roles onprem_users_group_entra_roles Read templates_no_security_ext templates_no_security_ext Read templates_with_user_san templates_with_user_san
EXECUTE 1 tools
Execute query_bloodhound query_bloodhound
OTHER 1 tools
Other sp_app_role_grant sp_app_role_grant

Route BloodHound MCP through PolicyLayer and every one of its 75 tools is checked against your policy before it runs.

CHECK YOUR STACK →

See every tool, the dangerous ones, and the token cost across your stack.

// FAQ
How many tools does the BloodHound MCP MCP server have? +

The BloodHound MCP MCP server exposes 75 tools across 3 categories: Read, Execute, Other.

How do I enforce policies on BloodHound MCP tools? +

Route the BloodHound MCP server through the PolicyLayer gateway. Define allow, deny, or approval rules per tool in the dashboard; they are enforced on every call before it reaches the server.

What risk categories do BloodHound MCP tools fall into? +

BloodHound MCP tools are categorised as Read (73), Execute (1), Other (1). Each category has a recommended default policy.

Enforce policy on every BloodHound MCP tool call.

Start from BloodHound MCP, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.

CHECK YOUR STACK →

Free to start. No card required.

43,000+ MCP servers and 220,000+ tools scanned and risk-classified.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.