BloodHound MCP, One Year Later: What I Learned About MCPs, Models, and Context

TL;DR: The author describes rearchitecting the BloodHound MCP from a large, per-endpoint tool catalog to a smaller set of composite tools and domain resources to reduce token overhead, improve tool-selection reliability, and provide recoverable errors. Key changes include consolidating many endpoint-specific tools into composite tools (e.g., user_info with an info_type parameter), shared dispatcher-based error handling, offloading detailed Cypher and AD guidance into on-demand resources, file upload support for controlled agent-driven ingestion, and better prompt/resource design; these changes cut fixed-context token usage substantially and improve practical analyst workflows.