loading
Loading content
loading
Vulnerabilities
Black Hat Arsenal deception layer for MCP servers, exported as a schedulable ghost-tool catalog.
overview
HoneyMCP is deception middleware that sits inside an MCP server and adds ghost tools: entries that look security sensitive, that no legitimate workflow should ever call, and whose invocation is therefore evidence. An agent that has been steered by an indirect prompt injection reaches for one of them, and the reach is the signal.
The Trickest wrapper is a catalog exporter, not a network scanner. mode=catalog reads the ghost-tool definitions, from the packaged defaults or from a honeymcp.yaml you mount on the config port, and writes them to findings.jsonl. mode=init emits the starter configuration instead. Nothing here probes a target, so the node is safe to run on a schedule against your own inventory.
That distinction is the point of running it in a workflow. The catalog is the contract between your deception layer and everything downstream, so exporting it on a schedule means a ghost tool that is quietly removed, renamed, or never deployed shows up as a diff rather than as a detection that stops firing.
source github.com/barvhaim/HoneyMCP
use cases
Turn the deception config into findings.jsonl so the tools you rely on for detection are inventoried in the same place as the rest of your evidence.
Mount a real config on the config port to record which ghost tools that server actually ships, instead of documenting the intended set.
Schedule the catalog and diff runs, so a removed or renamed ghost tool surfaces before you notice the detections went quiet.
Use the init mode to produce a starting configuration for a server that has no deception layer yet, then bring it under the same catalog check.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | --mode | catalog (default) or init |
| config | FILE | --config | Optional honeymcp.yaml to inventory |
Showing key inputs. honeymcp exposes 2 inputs in total.
example
# export the packaged ghost-tool cataloghoneymcp --mode catalog # inventory a config you actually runhoneymcp --mode catalog --config honeymcp.yaml{ "tool": "honeymcp", "mode": "catalog", "ghost_tool": "read_internal_credentials", "bait_class": "exfiltration", "trigger": "tool_call", "severity": "info", "note": "No legitimate caller; an invocation is evidence of indirect prompt injection"}guidance
Reach for honeymcp when you own the MCP server and want an instrumented tripwire plus a record of it. Use mcparasite when you need to drive an agent and test propagation across channels, and use a template scanner when the question is about the host or transport rather than the tool surface.
The active side of the same boundary. It tries to move an instruction across MCP channels; honeymcp waits for something to take the bait.
Runtime policy for AI coding agents, evaluated over agent-action events. Adjacent surface, event stream rather than tool catalog.
Template checks against a reachable host. Use it on the MCP server's transport; it does not model tool-level deception.
workflows
faq
related
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
Automates OS command injection detection and exploitation.
Parameter mining and XSS testing with headless verification.
Subdomain takeover scanner with cloud-zone intake.
Locate public CVE proof-of-concept repositories on GitHub.
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
An optional honeymcp.yaml feeds honeymcp, which exports the ghost-tool catalog as findings for a correlate or report node.
Facts on this page come from the live Trickest tool library.