🤖 Honey-MCP / Decoy LLM

Fake Model Context Protocol servers feeding synthetic data to agents.

→ Explore in ATT&CK matrix (1 mappings) Deployment detail

What it is

A fake Model Context Protocol server that offers attractive tools, such as database or secrets access, to AI agents and returns only synthetic data. A rogue or hijacked agent that discovers it will try those tools. The server has no access to real infrastructure, and every request it receives is logged in full.

Implementation requirements

MCP server implementing the Model Context Protocol specification
Fake tool definitions (e.g., query_production_db, read_ssh_keys, get_vault_secrets)
OpenTelemetry instrumentation for full request/response logging
Response generation: either static synthetic data or fine-tuned LLM for realistic responses
Network isolation: Honey-MCP must not have access to real infrastructure
Registration in tool discovery mechanisms (MCP registry, .cursor/mcp.json, etc.)
Rollback: Unregister it from every tool-discovery location (registries, agent configuration) first, then shut down the server. Keep its request logs as evidence.
Upkeep: Keep tool names and responses in step with the real tools agents see. Monthly proof-of-life call from a test agent.

Technologies

AI/LLM

ATT&CK coverage 1

Technique	Tactic	Status	Confidence	Tier
T1699 Direct Prompt Injection	Execution	theoretical	weak	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1699 as an adversary behaviour. LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems — (D050) LLMs can power convincing interactive honeypots; no study yet of a decoy LLM catching direct prompt injection. Weak: plausible, not yet studied.

Evidence

LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild — Reworr; Volkov, D., arXiv:2410.13919 2024 peer-reviewed
LLM Honeypot: Leveraging Large Language Models as Advanced Interactive Honeypot Systems — Otal, H.T.; Canbaz, M.A., arXiv:2409.08234 2024 peer-reviewed
When MCP Servers Attack: Taxonomy, Feasibility, and Mitigation — Zhao, W.; Liu, J.; Ruan, B.; Li, S.; Liang, Z., arXiv:2509.24272 2025 peer-reviewed
OWASP Top 10 for LLM Applications 2025 — OWASP 2025 standard
ATLAS: Adversarial Threat Landscape for AI Systems — MITRE standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: - Dmitrii Volkov & Reworr, "LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild" — arXiv:2410.13919, 2024. > - Hakan Tugrul Otal & Muhammed Abdullah Canbaz, "Leveraging Large Language Models as Advanced Interactive Honeypot Systems" — IEEE CNS / arXiv:2409.08234, 2024. > - MCP Honeypot implementations: cerebral-work/mcp-honeypot and kosiorkosa47/honeymcp (GitHub, 2025). > - Weibo Zhao et al., "When MCP Servers Attack: Taxonomy, Feasibility, and Mitigation" — arXiv, 2025.