Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Aug 27, 2026

Vulnerabilities

Plant ghost tools in an MCP server and catalog them

honeymcp is a Black Hat Arsenal deception layer for MCP servers that adds ghost tools with security-sensitive names no legitimate workflow should call, so an attempt to invoke one is evidence of a steered agent, and the Trickest node exports that ghost-tool catalog and starter config so the deployed layer stays in sync.

installpip install honeymcp

Python

Agent
Export the ghost-tool catalog as dataInventory your own honeymcp.yamlCatch drift in a deception layer

overview

What honeymcp does

HoneyMCP is deception middleware that sits inside an MCP server and adds ghost tools: entries that look security sensitive, that no legitimate workflow should ever call, and whose invocation is therefore evidence. An agent that has been steered by an indirect prompt injection reaches for one of them, and the reach is the signal.

The Trickest wrapper is a catalog exporter, not a network scanner. mode=catalog reads the ghost-tool definitions, from the packaged defaults or from a honeymcp.yaml you mount on the config port, and writes them to findings.jsonl. mode=init emits the starter configuration instead. Nothing here probes a target, so the node is safe to run on a schedule against your own inventory.

That distinction is the point of running it in a workflow. The catalog is the contract between your deception layer and everything downstream, so exporting it on a schedule means a ghost tool that is quietly removed, renamed, or never deployed shows up as a diff rather than as a detection that stops firing.

source github.com/barvhaim/HoneyMCP

use cases

Where honeymcp fits

Export the ghost-tool catalog as data

Turn the deception config into findings.jsonl so the tools you rely on for detection are inventoried in the same place as the rest of your evidence.

Inventory your own honeymcp.yaml

Mount a real config on the config port to record which ghost tools that server actually ships, instead of documenting the intended set.

Catch drift in a deception layer

Schedule the catalog and diff runs, so a removed or renamed ghost tool surfaces before you notice the detections went quiet.

Bootstrap a new MCP deployment

Use the init mode to produce a starting configuration for a server that has no deception layer yet, then bring it under the same catalog check.

reference

honeymcp inputs and flags

2 inputs
NameTypeFlagDescription
modeSTRING--modecatalog (default) or init
configFILE--configOptional honeymcp.yaml to inventory

Showing key inputs. honeymcp exposes 2 inputs in total.

example

Run honeymcp

honeymcp · command
# export the packaged ghost-tool catalog
honeymcp --mode catalog

# inventory a config you actually run
honeymcp --mode catalog --config honeymcp.yaml
sample output
{
  "tool": "honeymcp",
  "mode": "catalog",
  "ghost_tool": "read_internal_credentials",
  "bait_class": "exfiltration",
  "trigger": "tool_call",
  "severity": "info",
  "note": "No legitimate caller; an invocation is evidence of indirect prompt injection"
}

guidance

Choosing honeymcp

Reach for honeymcp when you own the MCP server and want an instrumented tripwire plus a record of it. Use mcparasite when you need to drive an agent and test propagation across channels, and use a template scanner when the question is about the host or transport rather than the tool surface.

mcparasite

The active side of the same boundary. It tries to move an instruction across MCP channels; honeymcp waits for something to take the bait.

agentsleak

Runtime policy for AI coding agents, evaluated over agent-action events. Adjacent surface, event stream rather than tool catalog.

nuclei

Template checks against a reachable host. Use it on the MCP server's transport; it does not model tool-level deception.

workflows

Workflows using honeymcp

1 workflow

  1. MCP Trust Boundary Suite

    Inventory HoneyMCP ghost tools and MCParasite channels, then correlate MCP trust-boundary findings you can retest.

faq

honeymcp questions

An MCP tool entry that exists only to be tempting. It advertises something security sensitive, no legitimate workflow calls it, so an invocation is strong evidence that the agent is following instructions it should not be following.

No. The wrapper exports the ghost-tool catalog, and optionally an init config, as findings.jsonl. It sends no traffic to a target, which is why it can run on a schedule against your own estate.

No. Without a config the node catalogs the packaged defaults. Mount your own file on the config port when you want the inventory to reflect a server you actually operate.

catalog reads existing ghost-tool definitions and emits them as findings. init produces starter configuration for a server that has no deception layer yet.

Indirectly and by design. The middleware does not classify text. It records which tool an agent called, and a call to a ghost tool means the agent acted on instructions that did not come from its operator.

HoneyMCP is published at github.com/barvhaim/HoneyMCP and was presented at the Black Hat USA 2026 Arsenal. Trickest packages the fleet wrapper as the library node documented here.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run honeymcp yourself

An optional honeymcp.yaml feeds honeymcp, which exports the ghost-tool catalog as findings for a correlate or report node.

Open honeymcp in the libraryView the workflow

Facts on this page come from the live Trickest tool library.