Vulnerabilities
Plant ghost tools in an MCP server and catalog them
Black Hat Arsenal deception layer for MCP servers, exported as a schedulable ghost-tool catalog.
overview
What honeymcp does
HoneyMCP is deception middleware that sits inside an MCP server and adds ghost tools: entries that look security sensitive, that no legitimate workflow should ever call, and whose invocation is therefore evidence. An agent that has been steered by an indirect prompt injection reaches for one of them, and the reach is the signal.
The Trickest wrapper is a catalog exporter, not a network scanner. mode=catalog reads the ghost-tool definitions, from the packaged defaults or from a honeymcp.yaml you mount on the config port, and writes them to findings.jsonl. mode=init emits the starter configuration instead. Nothing here probes a target, so the node is safe to run on a schedule against your own inventory.
That distinction is the point of running it in a workflow. The catalog is the contract between your deception layer and everything downstream, so exporting it on a schedule means a ghost tool that is quietly removed, renamed, or never deployed shows up as a diff rather than as a detection that stops firing.
source github.com/barvhaim/HoneyMCP
use cases
Where honeymcp fits
Export the ghost-tool catalog as data
Turn the deception config into findings.jsonl so the tools you rely on for detection are inventoried in the same place as the rest of your evidence.
Inventory your own honeymcp.yaml
Mount a real config on the config port to record which ghost tools that server actually ships, instead of documenting the intended set.
Catch drift in a deception layer
Schedule the catalog and diff runs, so a removed or renamed ghost tool surfaces before you notice the detections went quiet.
Bootstrap a new MCP deployment
Use the init mode to produce a starting configuration for a server that has no deception layer yet, then bring it under the same catalog check.
reference
honeymcp inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | --mode | catalog (default) or init |
| config | FILE | --config | Optional honeymcp.yaml to inventory |
Showing key inputs. honeymcp exposes 2 inputs in total.
example
Run honeymcp
# export the packaged ghost-tool cataloghoneymcp --mode catalog # inventory a config you actually runhoneymcp --mode catalog --config honeymcp.yaml{ "tool": "honeymcp", "mode": "catalog", "ghost_tool": "read_internal_credentials", "bait_class": "exfiltration", "trigger": "tool_call", "severity": "info", "note": "No legitimate caller; an invocation is evidence of indirect prompt injection"}guidance
Choosing honeymcp
Reach for honeymcp when you own the MCP server and want an instrumented tripwire plus a record of it. Use mcparasite when you need to drive an agent and test propagation across channels, and use a template scanner when the question is about the host or transport rather than the tool surface.
mcparasite
The active side of the same boundary. It tries to move an instruction across MCP channels; honeymcp waits for something to take the bait.
agentsleak
Runtime policy for AI coding agents, evaluated over agent-action events. Adjacent surface, event stream rather than tool catalog.
nuclei
Template checks against a reachable host. Use it on the MCP server's transport; it does not model tool-level deception.
workflows
Workflows using honeymcp
faq
honeymcp questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run honeymcp yourself
An optional honeymcp.yaml feeds honeymcp, which exports the ghost-tool catalog as findings for a correlate or report node.
Facts on this page come from the live Trickest tool library.