HSK
Deception Engineering

MCP Threat Trap

Deception Engineering for Zero Trust AI access, an advanced honeypot system that simulates vulnerable systems to detect and analyze attack patterns.

Status
Open source
Since
Built with
TypeScript · Deception Engineering · Zero Trust
Source
harshadk99/deception-remote-mcp-server
View Repository

How it works

MCP Threat Trap: request flowAn AI agent connects over MCP (Streamable HTTP or SSE) and sees three tools: welcome and ask_about_me, which are benign, and okta_admin_password_reset, the trap. A scripted client can also call the trap directly over REST, rate limited to five requests a minute per IP. Every call to the trap fires a Canarytokens web bug carrying the username, IP, User-Agent, tool and time, writes the same fields to the worker logs, and returns a believable reply after a short delay; sensitive account names get an elevated-privileges notice with a reference ID.AI agentMCP clientScripted clientcurl · any HTTP toolMCP Threat TrapCloudflare Worker · deception-remote-mcp-server/mcp · /sseMCP (Streamable HTTP, SSE)REST endpoint/okta_admin_password_reset5 req/min per IP, then 429welcomebenignask_about_mebenignTRAPokta_admin_password_resetfires on every callALERTCanarytokens web buguser · IP · UA · tool · timealert to the token ownerworker logsthe same fields, per callbelievable reply0.5–1.5 s delay, reference IDadmin, root, ceo… get an“elevated privileges” noticeOver MCP the trap records the tool and username; the REST path adds the caller’s real IP and User-Agent.
Request flow. Two tools are harmless; the third, an Okta admin password reset, is the trap. Calling it fires a Canarytoken and gets a plausible answer back, so the caller has no reason to stop.

Talks

All talks →

  1. Show and Tell — What are you building with AI & how are you securing it using MCP Threat Trap

    AI Security Engineers Community · Livestream

    • Deception Engineering
    ▶ Watch Recording · AI Security Engineers Community

  2. MCP Threat Trap: Deception Engineering for Zero Trust AI Access

    BSides SWFL 2025 · Fort Myers, FL

    • Deception Engineering
    Event ScheduleSpeaker Page

  3. MCP Threat Trap: Deception Engineering for Zero Trust AI Access

    BSides Chicago 2025 · Chicago, IL

    • Deception Engineering
    Speaker Profile

  4. MCP Threat Trap: Deception Engineering for Zero Trust AI Access

    DevSecCon 2025 · Global Virtual

    • Deception Engineering
    ▶ Event Recording · AI Security Engineers CommunitySpeaker Page

  5. MCP Threat Trap: Deception Engineering for Zero Trust AI Access

    Cloudflare Connect 2025 · Las Vegas, NV

    • Deception Engineering
    Session Page (archived)Speaker Page (archived)

  6. MCP Threat Trap: Deception Engineering for Zero Trust AI Access

    BSides Orlando 2025 · Orlando, FL

    • Deception Engineering
    ▶ Event Recording · BSides OrlandoEvent Schedule

Elsewhere

  1. Lenny Zeltser — "Build a Decoy MCP Server to Catch AI Agent Attackers"

    Independent citation by Lenny Zeltser — SANS Institute Faculty Fellow and creator of REMnux — who cited Harshad's Deception Remote MCP Server by name: "Harshad Sadashiv Kadam's Deception Remote MCP Server takes that approach for a public-facing honeypot any MCP client can discover and connect to."

    Read on zeltser.com →

Connect With Me

All contact methods in one place

Email
[email protected]
Location
Austin, Texas
LinkedIn
linkedin.com/in/harshad99
GitHub
github.com/harshadk99