Plant the trap. Find out the moment it's touched.

The trap library

20 traps, one seed, honest about the one that shares state.

Pulled from the same Leviathan Control modules that ship inside Leviathan Platform — packaged standalone for teams who want just this piece, without the full governed-automation platform around it.

Cloud · AWS — IMDS SSRF trap

Decoy EC2 metadata endpoint with the real IMDSv2 token handshake, so a scanner that skips it gets an ordinary 401, not a giveaway.

Cloud · GCP — Metadata SSRF trap

Enforces the real, case-sensitive Metadata-Flavor: Google header check actual GCP uses.

Kubernetes — Kubeconfig honeytoken

A decoy kubeconfig whose real client-go exec plugin beacons on use, then returns a believable "token expired" failure.

Git / secrets · free — SSH key trap

A real, valid key from actual ssh-keygen, comment field set to a beacon URL — passes any scanner that checks key structure. Free forever, MIT-licensed →

API tooling — Postman Poisoner

Plants a decoy admin request and a fake bearer token into a real collection. Catches use of a leaked collection, not just its existence.

RAG / AI — Honeydocuments

Decoy documents with a markdown-image beacon — fires when a RAG pipeline or agent renders one back during retrieval.

Web — Ghost-Schema

An API tarpit for scanner-bait paths (/admin, /.env, /backup...) — deterministic fake data instead of a real hit.

Web — Ephemeral Routes

Time-rotating decoy paths, computed statelessly so every worker process agrees on what's currently valid with zero coordination.

Network · IoT — Router/gateway CGI trap

Decoy config-dump and path-traversal endpoints that leak a fake MAC address — modeled on a real, disclosed 2026 CVE class where a home router's admin password is predictable from its own MAC. The strong signal isn't the leak, it's a login attempt using the password derived from it.

OT / industrial — Serial/OT gateway trap

Decoy remote fleet-management endpoints for serial-to-Ethernet gateways — modeled on a real disclosed vulnerability class (unauthenticated config writes, remote reboot, a stale-credential auth bypass) used in real power-grid attacks.

LLM / AI — Tarpit document

A decoy internal document authored to cost an LLM-driven prober real reasoning effort and tokens, not just get detected — contradictory fields, disagreeing severities, an honest dead-end puzzle.

MCP — Decoy MCP server

A fake Model Context Protocol server whose bait tool names sound like exactly what a compromised agent would go looking for. Enumerating its tools is already a signal; calling one always "succeeds."

Supply chain — Internal registry traps

Decoy npm and PyPI-shaped internal package feeds, speaking each ecosystem's real index and upload API — catches the common pattern of an internal registry with no real auth on uploads.

Filesystem — Directory file planter

Scans an operator-approved directory for its real naming conventions, then plants matching decoy files with a Ghost-Schema beacon — never overwrites a real file.

Cloud · Azure — Metadata SSRF trap

Completes the AWS/GCP/Azure set — enforces the real Metadata: true header and Azure's own X-Forwarded-For rejection, so a lazy scanner gets an ordinary rejection, not a giveaway.

Cloud · Firebase — Realtime Database trap

Mimics Firebase's real GET /<path>.json REST shape — a bare hit reads as recon, any auth parameter presented reads as a leaked credential being used.

Data store — Redis trap

A decoy Redis server speaking the real RESP wire protocol — PING/INFO read as recon, CONFIG SET/SAVE/MODULE LOAD/EVAL (the real unauthenticated-Redis RCE path) read as misuse.

Supply chain — Tool Manifest Poisoner

Plants a fake internal "approved security tools" manifest — the tripwire fires when something reads it and fetches one of its named mirror URLs.

Social · Browser — Calendar Invite trap

A real, RFC 5545-valid .ics invite built to steer an agentic browser into a localhost dev pivot or a password-manager detour — modeled on a real DEF CON 34 disclosure.

What's actually in it

What's actually in it.

• Zero core pip dependencies — fastapi/uvicorn and pyyaml are optional extras, only needed if you run the combined service or want YAML kubeconfig output.
• decoy-kit serve runs every route-based trap as one combined FastAPI service.
• decoy-kit generate ssh-key / postman / kubeconfig produces plantable artifact files from the CLI.
• 19 of 20 traps detect hits statelessly — HMAC(seed, request), no registry to keep in sync across replicas. The generator traps (Postman, kubeconfig, SSH key, directory planter, Tool Manifest Poisoner, calendar invite) have no route of their own; they plant bait against Ghost-Schema's already-stateless paths. RAG Beacon is the one exception: it checks an in-process registry, correct within one instance.
• Every generator refuses (fails loud) to target a bait path Ghost-Schema doesn't recognize — a poisoned artifact can never silently point at a real, unprotected endpoint.
• 362 tests, including real end-to-end runs: actual ssh-keygen calls, a real TestClient hitting every mounted route.

Trust & scope

What's real, and what this isn't.