KubeHound is a security analysis tool for Kubernetes clusters that automatically models and computes attack paths. It collects Kubernetes resources (pods, roles, bindings, endpoints, nodes) via a live API or offline dump, transforms them into a property graph stored in JanusGraph (with MongoDB as an intermediate store), and computes privilege escalation and lateral movement paths mapped to MITRE ATT&CK techniques. The system exposes a CLI for local analysis and a gRPC API (KHaaS) for service-oriented deployments, with optional Jupyter notebooks for querying the graph using a custom Gremlin DSL. The architecture is modular: a collector abstraction handles rate-limited streaming from the Kubernetes API; an ingestion pipeline converts raw objects into normalized store models and graph vertices/edges; an edge registry defines over 20 attack types (e.g., PodExec, TokenSteal, ContainerEscape); and a graph builder executes Gremlin traversals to connect vertices into paths. Storage layers use asynchronous writers with micro-batching for high throughput, and an in-memory cache deduplicates identities and roles. Telemetry (Datadog APM, metrics, logs) is integrated throughout. While primarily an application, the repository includes experimental research components (exp/khaudit) for audit reports and MITRE Attack Flow conversion, plus Jupyter notebooks for interactive graph queries, giving it a hybrid character. The codebase demonstrates strong engineering practices: provider interfaces, test mocking, worker pools, retry logic, and comprehensive system tests against real Kind clusters. However, some areas (large cluster optimizations, experimental code, deprecated flags) indicate ongoing evolution and minor technical debt.