Every module, precisely — not summarized from a filename.

API tarpit for scanner-bait paths (/admin, /.env, /backup, /.git/config) — a plausible fake 200 instead of a real 404 or a real hit.

A decoy internal document authored to cost an LLM-driven prober real reasoning effort and tokens — contradictory fields, disagreeing severities, an honest dead-end puzzle.

A decoy Model Context Protocol server whose bait tool names sound like exactly what a compromised agent would go looking for.

Decoy EC2 metadata endpoint with the real IMDSv2 token handshake, so a scanner that skips it gets an ordinary 401, not a giveaway.

Enforces the real, case-sensitive Metadata-Flavor: Google header check actual GCP uses, then returns a fake OAuth2 token.

Decoy config-dump endpoints modeled on a real, disclosed 2026 router CVE class where the admin password is derivable from a leaked MAC address.

Decoy fleet-management endpoints for serial-to-Ethernet OT gateways, modeled on a real disclosed vulnerability class used in real power-grid attacks.

Decoy internal package feed speaking PyPI's real index and upload API — catches the common pattern of an internal registry with no real auth on uploads.

The npm sibling — genuinely different wire shape (packument JSON, scoped names, base64 tarballs), verified against npm's own registry-client source.

A real, valid key from actual ssh-keygen, comment field set to a beacon URL — passes structural scanning. Free forever →

A decoy kubeconfig whose real client-go exec plugin beacons on use, then returns a believable "token expired" failure.

Plants a decoy admin request and a fake bearer token into a real Postman collection — catches use of a leaked collection, not just its existence.

Scans an approved directory for its real naming conventions, then plants matching decoy files with a beacon — never overwrites a real file.

Time-rotating decoy paths computed statelessly, so every worker process agrees on what's currently valid with zero coordination.

Decoy documents with a markdown-image beacon — fires when a RAG pipeline or agent auto-renders one back during retrieval.

Completes the AWS/GCP/Azure set — enforces the real Metadata: true header and Azure's X-Forwarded-For rejection so a lazy scanner gets an ordinary rejection, not a giveaway.

Mimics Firebase's real GET /<path>.json Realtime Database REST shape — a bare hit is recon-tier, any auth parameter presented is treated as a leaked credential.

A decoy Redis server speaking real RESP — PING/INFO read as recon, CONFIG SET/SAVE/MODULE LOAD/EVAL (the real unauthenticated-Redis RCE path) read as misuse.

Plants a fake internal "approved security tools" manifest — fires when something reads it and fetches one of its named mirror URLs.

A real RFC 5545 .ics invite built to steer an agentic browser into a localhost dev pivot or password-manager detour, sourced from a real DEF CON 34 disclosure.

12 categories synthesized from 4 sourced taxonomies, no verbatim jailbreak text included.

A real Ollama-backed semantic classifier for deeper coverage beyond pattern matching, kept as an injected dependency.

Translate-to-English step so the detector catches injection attempts written in another language.

Scans retrieved chunks with per-chunk source attribution, plus honeydocuments that signal probing or misconfiguration.

Admission-time control — scans a tool's own description text for injection before it's ever called, plus a call-rate limiter.

Call-time control — flags "value becomes code" argument shapes as a review trigger, never an automatic hard block.

Sequences admission, call-time, and result guards into one object — admit once, then hook before/after each call.

Detects the "MCP rug pull" — hashes a tool's schema and diffs against a lockfile to catch silent post-approval changes.

The same lockfile mechanism applied to skill/instruction files instead of MCP schemas.

Append-only, hash-chained event store — a later silent edit is detectable. No update or delete exists at all.

Ed25519-signed inter-agent messages so a receiver can cryptographically verify who sent them — built, tested, awaiting adoption.

Four rules over a run's evidence — denial bursts, multi-tool probing, tool-block thresholds, beacon bursts.

The live twin — fed events one at a time, so a defender can react mid-incident, not just at post-mortem.

Continuously runs adversarial social-engineering probes against real guarded agents, on a jittered interval that can't be predicted.

The probe corpus — 12+ angles modeled on real influence principles. The "compromised" action is always harmless.

Turns raw probe results into per-agent resistance scores, weighting genuine deliberation over a reflexive pass.

Four live agent variants: the raw baseline, the internally-guarded persona, the shipped-package-guarded persona, and a qwen3:4b size-comparison agent.