Updated Aug 27, 2026

Vulnerabilities

Plant ghost tools in an MCP server and catalog them

Black Hat Arsenal deception layer for MCP servers, exported as a schedulable ghost-tool catalog.

Agent

overview

What honeymcp does

HoneyMCP is deception middleware that sits inside an MCP server and adds ghost tools: entries that look security sensitive, that no legitimate workflow should ever call, and whose invocation is therefore evidence. An agent that has been steered by an indirect prompt injection reaches for one of them, and the reach is the signal.

The Trickest wrapper is a catalog exporter, not a network scanner. mode=catalog reads the ghost-tool definitions, from the packaged defaults or from a honeymcp.yaml you mount on the config port, and writes them to findings.jsonl. mode=init emits the starter configuration instead. Nothing here probes a target, so the node is safe to run on a schedule against your own inventory.

That distinction is the point of running it in a workflow. The catalog is the contract between your deception layer and everything downstream, so exporting it on a schedule means a ghost tool that is quietly removed, renamed, or never deployed shows up as a diff rather than as a detection that stops firing.

source github.com/barvhaim/HoneyMCP

use cases

Where honeymcp fits

Export the ghost-tool catalog as data

Turn the deception config into findings.jsonl so the tools you rely on for detection are inventoried in the same place as the rest of your evidence.

Inventory your own honeymcp.yaml

Mount a real config on the config port to record which ghost tools that server actually ships, instead of documenting the intended set.

Catch drift in a deception layer

Schedule the catalog and diff runs, so a removed or renamed ghost tool surfaces before you notice the detections went quiet.

Bootstrap a new MCP deployment

Use the init mode to produce a starting configuration for a server that has no deception layer yet, then bring it under the same catalog check.

reference

honeymcp inputs and flags

2 inputs
NameTypeFlagDescription
modeSTRING--modecatalog (default) or init
configFILE--configOptional honeymcp.yaml to inventory

Showing key inputs. honeymcp exposes 2 inputs in total.

example

Run honeymcp

honeymcp · command
# export the packaged ghost-tool cataloghoneymcp --mode catalog # inventory a config you actually runhoneymcp --mode catalog --config honeymcp.yaml
sample output
{  "tool": "honeymcp",  "mode": "catalog",  "ghost_tool": "read_internal_credentials",  "bait_class": "exfiltration",  "trigger": "tool_call",  "severity": "info",  "note": "No legitimate caller; an invocation is evidence of indirect prompt injection"}

guidance

Choosing honeymcp

Reach for honeymcp when you own the MCP server and want an instrumented tripwire plus a record of it. Use mcparasite when you need to drive an agent and test propagation across channels, and use a template scanner when the question is about the host or transport rather than the tool surface.

mcparasite

The active side of the same boundary. It tries to move an instruction across MCP channels; honeymcp waits for something to take the bait.

agentsleak

Runtime policy for AI coding agents, evaluated over agent-action events. Adjacent surface, event stream rather than tool catalog.

nuclei

Template checks against a reachable host. Use it on the MCP server's transport; it does not model tool-level deception.

faq

honeymcp questions

An MCP tool entry that exists only to be tempting. It advertises something security sensitive, no legitimate workflow calls it, so an invocation is strong evidence that the agent is following instructions it should not be following.

Run honeymcp yourself

An optional honeymcp.yaml feeds honeymcp, which exports the ghost-tool catalog as findings for a correlate or report node.

Facts on this page come from the live Trickest tool library.