Skip to content
Kandaro
Start free trial

Decoy · Application

AI agent server decoy

Attackers now use AI agents that read every file and talk to anything that looks helpful. This decoy poses as ai-agents01, a server running Ollama, an OpenAI-compatible API, an MCP tool server, an agent-to-agent (A2A) endpoint and a Qdrant vector database.

Start free trialAll decoys

What it emulates

Poses as: LLM and AI agent server.

People do not speak these protocols by hand. A tool call or a prompt sent here is a strong sign an automated agent is loose in your network, and the decoy records exactly what it asked for.

  • SSH 22

    Records every password, key and username tried, then refuses them. Only a password Kandaro planted opens a fake shell, where every command is recorded and answered with made-up output. Nothing runs.

  • Ollama 11434

    Lists a handful of tempting models. Records every prompt and system prompt sent, then answers with an "out of memory" error. Attempts to pull, push or delete models are recorded and refused.

  • OpenAI API 8000

    An OpenAI-compatible API that records every API key sent and always answers "unauthorised".

  • MCP 3000

    An MCP tool server with tools for databases, customers, files and secrets, chosen per decoy. Records every tool call with all its arguments. Results are fake rows, fake credentials or "pending approval": nothing ever runs.

  • Agent console 8080

    An "AI Agent Console" sign-in that records every username and password.

  • A2A agent 8090

    An A2A agent that publishes an agent card. Records every task sent to it, with the message text. Tasks stay "pending approval" forever.

  • Vector DB 6333

    A Qdrant-style vector database with collections like customer contracts and HR documents. Attempts to read them are recorded and refused.

  • Redis 6379

    Speaks Redis, with real Redis error messages. Records every password and every command. Requests to list keys get a slow, endless stream of made-up keys.

What it catches

Every touch, explained in plain English.

Each event gets a plain-English explanation. Related events from the same source become one incident with a recommended action.

  • AI agents that discover and call MCP tools, with every argument
  • Prompts sent to the local LLM, including the system prompt
  • Stolen API keys tried against the OpenAI-compatible API
  • Tasks sent to the A2A agent
  • Attempts to read the vector database
  • Agents that follow a hidden canary note, which proves the visitor is automated

MITRE ATT&CK

Techniques come from a fixed table, not from AI, so the same activity always maps the same way.

  • T1046Network Service Discovery
  • T1059Command and Scripting Interpreter
  • T1110Brute Force
  • T1552.001Unsecured Credentials: Credentials In Files
  • T1552.005Unsecured Credentials: Cloud Instance Metadata API

Incidents go to email, Slack, your SIEM or a signed webhook. Kandaro and your SOC

Safe by design

Built to be attacked. Never a way in.

A decoy only listens and answers with fake data. It never runs code and only connects out to Kandaro, so it can never become a way into your network.

  • It runs nothing

    The sensor has no way to run a command, load code or update itself. Every command an intruder types gets a fake text answer.

  • It connects to one place only

    Its only outbound connection is HTTPS to the Kandaro API address set at install time. Nothing Kandaro sends can change that address.

  • Kandaro can only send it settings

    Which decoy to imitate, which services to turn off, which addresses to ignore. There is no field for code, files, commands or updates.

  • It holds no real secrets

    Passwords, keys and records it shows are fake. Its only credential is its own key, which can send events for your organisation and nothing more.

  • It cannot be used to attack others

    It never forwards traffic, never fetches a URL and never serves scripts or programs. Its only UDP replies (SNMP) are rate-limited per address.

Non-root, read-only container with signed images. How we secure sensors

Where to put it

Place it where an intruder will look.

Put it next to your real AI and data-science servers, or in any network an internal AI agent can reach.

Installs in about a minute with Docker, Kubernetes, Ansible, a VM or a Raspberry Pi, and needs outbound HTTPS only. Deployment guide · Where to put your first decoys · What an AI agent does when it lands in your network

FAQ

AI agent server decoy questions

What is an MCP honeypot?
MCP is how AI agents find and call tools. A decoy MCP server offers tempting tools, such as reading customer data or secrets. An agent that calls one reveals itself and what it was after.
What is an agent canary?
A short note in the decoy text that asks AI agents to do one harmless thing on the same decoy. A person ignores it; an agent that obeys it proves it is automated. It never points anywhere else.
Do the tools do anything?
No. Every tool returns fake data or "pending approval". Nothing is sent, run or stored.
Is it safe to run on my network?
Yes. A decoy only answers connections with fake data. It runs nothing, forwards nothing and only connects out to the Kandaro API over HTTPS. It runs as an unprivileged, read-only container.

Related decoys

Pair it with these.

Put this decoy on your network today.

Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.

Start free trialView packages

Card required · cancel before day 14 and pay nothing