loading
Inventory HoneyMCP ghost tools and MCParasite channels, then correlate MCP trust-boundary findings you can retest.
Lists ghost tools the catalog would expose, and worm-style channels between MCP servers.
Ghost tools, channels, and report.json.
Your HoneyMCP config. Replace the demo seed, or mount your honeymcp.yaml.
MCP servers widen what an agent can touch. Ghost tools, miswired channels, and scenario inventories need a smoke path that does not require SaaS tokens, plus a place to drop your own HoneyMCP config when you harden a real stack.
This is a standing check for continuous security testing. You seed a demo HoneyMCP config, run HoneyMCP for a ghost-tool catalog and MCParasite for channel or scenario inventory, then correlate findings with a retest delta when MCP configs change.
It sits next to Web AI Agent Audit (embedded web agents). This Collection unit is the MCP trust-boundary path: config and channel inventory first. Set MCParasite mode=run and LLM keys when you want a live kill-chain.
honeymcp.yaml for the smoke path.honeymcp.yaml.run needs LLM keys in vault (chips already wired) and executes a live kill-chain.Sample shape from the correlate pack on the demo config (illustrative, not a live KPI).
| kind | title | severity | note |
|---|---|---|---|
| finding | Ghost or unexpected MCP tool exposure | high | null |
| inventory | null | null | MCP channel or scenario row from the list pass |
| retest_delta | null | null | Schedule re-runs when honeymcp.yaml or channel wiring changes |
No. The default seed and list modes run without SaaS credentials.
Set mode=run on MCParasite and add OpenAI or Anthropic keys in vault (already wired on the node). Default list stays on inventory.
Correlate emits retest_delta.jsonl so scheduled re-runs can surface MCP config drift after agent and server changes.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.