BloodHound Legacy: what a deprecated v4 AD graph tree still tells you

Where the README says to get it, and the install steps it does not give

Every functional line in the README points away from itself. BloodHound Legacy, version 4, "was last updated in 2023 and is no longer maintained", and the notice goes on to say it "will be archived in the near future". What follows is three links, and those links are the whole installation story: the BloodHound Community Edition GitHub repository, a community edition quickstart, and the full documentation site. A fourth link keeps the old manual reachable at bloodhound.readthedocs.io, labeled in the README as the deprecated BloodHound Legacy documentation.

So there is nothing to copy into a terminal, and the reason matters for anyone who still wants version 4. What is left to read is the source tree. The top level holds main.js, renderer.js and server.js next to webpack.config.development.js and webpack.config.production.js, which makes the desktop half of the project a JavaScript and Electron application. A Collectors/ directory sits alongside those files while the repository's primary language is recorded as PowerShell, so the collection side and the client side are one repository with two toolchains.

A March 2026 push sitting on top of a May 2023 tag

The version field in package.json reads 4.3.1, the same number as the newest tag, v4.3.1, cut on 2023-05-23. Ahead of it sit v4.3.0 from 2023-04-18 and 4.2.0, named "BloodHound 4.2.0 - Azure Refactor", from 2022-08-03. The repository is not archived, and its last push landed on 2026-03-02.

Set those facts next to each other and the picture is uneven. A commit from March 2026 tells you something was committed. It does not tell you a release was cut, and the version string never moved past the number the 2023 tag already carried. No changelog in the tree explains what that commit changed, because the README answers only the question of where to go next. For anyone judging whether this branch still receives fixes, the release list is the more useful of the two signals, and the keywords in package.json are worth reading too: alongside Graph, Active Directory and Security they list Azure, which matches the Azure refactor in the 4.2.0 release name without explaining what that refactor changed for an operator.

package.json still points at BloodHoundAD, the README points at SpecterOps

The metadata addresses a different organization than the deprecation notice does. The homepage field is https://github.com/BloodHoundAD/Bloodhound, the repository url is https://github.com/BloodHoundAD/Bloodhound.git, and the bugs field is https://github.com/BloodHoundAD/Bloodhound/issues. Not one of those three points at the SpecterOps/BloodHound-Legacy tree the README asks you to abandon.

That split matters the moment a tool trusts the metadata instead of the notice. A clone URL copied out of the package file lands in a different organization path, and the issues address in it is not a tracker for this repository, so a bug report filed there goes somewhere this README never mentions. Credits line up on both sides, with the README naming the three people who created BloodHound and the package file naming Rohan Vazarkar as author with Andy Robbins, Will Schroeder and Ryan Hausknecht as contributors. Description fields are where an aging project hides its history, and none of these three has been brought in line with the notice sitting above them.

The engines field pins Node to ~16 and names no Electron version

Two lines decide whether this tree still builds on your machine. The version is 4.3.1, the entry point is main.js, and the runtime is pinned rather than ranged wide:

    "version": "4.3.1",
    "main": "main.js",
    "engines": {
        "node": "~16"
    }

The engines field asks for the Node 16 line and nothing else. No Node version, no Electron version and no build prerequisite appear anywhere in the README. A machine carrying a current Node release does not satisfy the pin. The start:client script, whose value is cross-env NODE_ENV=development electron ., shows the shape of the intended entry point but not the version behind it.

The electron-packager script drops Ingestors, docs and the example database

Packaging is the one place where the shape of the product is spelled out, and it spells it out by exclusion:

        "package": "electron-packager . BloodHound --overwrite --prune --ignore=./*.zip --ignore=./BloodHound.* --ignore=BloodHoundExampleDB.db --ignore=docs --ignore=Ingestors --ignore=node_modules/\\.bin",

Read that ignore list in order. Zipped build output, anything already named BloodHound.*, the file BloodHoundExampleDB.db, the docs tree and a directory called Ingestors all go out. A packaged Legacy build therefore ships neither its documentation, nor the ingestor directory, nor a sample database, which leaves the graphical half of the project with nothing on screen until data arrives from somewhere the build deliberately left out. The repository's top level has no Ingestors directory at all, so part of that list belongs to an earlier layout. Collectors/ does exist, and no flag in the script covers it, which leaves the one question a new user has, where collection code ends up in a packaged build, unanswered by the only file in the tree that shapes a build.

Three platform variants hang off the same script. package:linux targets linux with arch=x64,armv7l,arm64, package:macos targets darwin with arch=all and icon=src/img/icon.icns, and package:win32 targets win32 with arch=all and icon=src/img/icon.ico. Legacy can be packaged for all three, and none of the three is documented anywhere beyond these flags.

No documented path from an empty install to a populated graph

The functional documentation for this project is not thin, it is relocated, and the relocation carries a warning label. Nothing in the README explains how data reaches the interface. There is no description of running anything inside Collectors/, no statement of how the client connects to a graph database, and no mention of BloodHoundExampleDB.db in the README; the file name appears only in the packaging script that strips it out of the build.

The consequences for a reader are concrete. Anyone who wants the legacy interface populated has to assemble the data path from a documentation site the README itself calls deprecated. Anyone who wants to know what the tool does with the data finds only the package description, Graph Theory for Active Directory, and the repository description, Six Degrees of Domain Admin. The one place where attack path behaviour is described at length is the section about the commercial BloodHound Enterprise product, where the claim about eliminating millions, even billions, of attack paths is a vendor statement with no counterpart in this code. Treat the first line of the README as the real spec: deprecated, last updated in 2023, archived soon.

Community Edition arrives with a quickstart, Legacy arrives with a readthedocs snapshot

The replacement named in the README is the free BloodHound Community Edition, and the difference between the two is not a feature count. It is documentation. The README hands a reader a repository, an installation instructions page and a full documentation site, three separate things to read. BloodHound Legacy offers one: a deprecated readthedocs index and a source tree.

That gap changes the work, not the goal. With Community Edition the quickstart is the first stop, and the reader arrives with a supported install path. With Legacy the first stop is deciding whether you can accept a runtime pinned to Node 16, a version string frozen at the 2023 tag, metadata pointing at another organization, and a readthedocs snapshot whose relationship to this branch nobody states.

GPL-3.0, a third party notice, and a copyright line ending in 2025

Two licence files sit at the top level, LICENSE.md and LICENSE-3RD-PARTY.md, and the package.json licence field reads GPL-3.0. The README reproduces the standard grant, allowing redistribution and modification under version 3 of the licence or any later version, and the paragraph after it is the standard statement that the program comes with no warranty at all.

Two practical consequences follow for anyone who builds this. A modified Legacy binary that you distribute stays under GPL-3.0, so your changes travel with your build. And a file given over to third party notices exists because a packaged app bundles components carrying licences of their own, Electron among them, since the start:client script is what runs the client. The copyright line in the README reads 2016 to 2025 SpecterOps Inc., which is the most recent year the project claimed authorship for this code.

Editorial conclusion

Take BloodHound Community Edition unless you are reading old BloodHound 4 documentation or maintaining an existing v4 install, because the legacy tree hands you a Node 16 pin, a version string frozen at the 2023 tag and no instructions for getting data into the interface. Before anything else, check the version field in package.json against the tag you actually need: it still reads 4.3.1, the number cut on 2023-05-23, while the last push on record is 2026-03-02.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. README
4. Releases
5. SpecterOps/BloodHound-Legacy on GitHub