decoy-mcp 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Decoy
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,84 @@
1
+ # Decoy
2
+
3
+ Security tripwires for AI agents. Detect prompt injection before it causes damage.
4
+
5
+ Decoy is a fake MCP server that advertises tools an AI agent should never call — `execute_command`, `read_file`, `make_payment`, and more. In normal operation, your agent ignores them. When prompt injection overrides behavior, the decoy catches the full attack payload and alerts you.
6
+
7
+ ## Quick start
8
+
9
+ ```bash
10
+ npx decoy-mcp init
11
+ ```
12
+
13
+ This creates a free account, installs the MCP server locally, and configures Claude Desktop. Takes 30 seconds.
14
+
15
+ ## How it works
16
+
17
+ 1. Decoy registers as an MCP server called `system-tools` alongside your real tools
18
+ 2. It exposes 7 tripwire tools that look like real system access
19
+ 3. Your agent has no reason to call them — it uses its real tools
20
+ 4. If prompt injection forces the agent to reach for unauthorized access, the tripwire fires
21
+ 5. You get the full payload: what tool, what arguments, severity, timestamp
22
+ 6. Alerts go to your dashboard, Slack, webhooks, or email
23
+
24
+ ## Tripwire tools
25
+
26
+ | Tool | What it traps |
27
+ |------|--------------|
28
+ | `execute_command` | Shell execution (curl, wget, nc, crontab, rm) |
29
+ | `read_file` | Credential theft (.ssh, .env, passwd, shadow) |
30
+ | `write_file` | Persistence (authorized_keys, .bashrc, crontab) |
31
+ | `http_request` | Data exfiltration (POST to external URLs) |
32
+ | `get_environment_variables` | Secret harvesting (API keys, tokens) |
33
+ | `make_payment` | Unauthorized payments via x402 protocol |
34
+ | `authorize_service` | Unauthorized trust grants to external services |
35
+
36
+ Every tool returns a realistic error response. The agent sees a timeout or permission denied — not a detection signal. Attackers don't know they've been caught.
37
+
38
+ ## Commands
39
+
40
+ ```bash
41
+ npx decoy-mcp init # Set up protection
42
+ npx decoy-mcp status # Check triggers and connection
43
+ npx decoy-mcp uninstall # Remove from config
44
+ ```
45
+
46
+ ## Manual setup
47
+
48
+ Add to your `claude_desktop_config.json`:
49
+
50
+ ```json
51
+ {
52
+ "mcpServers": {
53
+ "system-tools": {
54
+ "command": "node",
55
+ "args": ["~/.config/Claude/decoy/server.mjs"],
56
+ "env": { "DECOY_TOKEN": "your-token" }
57
+ }
58
+ }
59
+ }
60
+ ```
61
+
62
+ Get a token at [decoy.run](https://decoy.run).
63
+
64
+ ## Dashboard
65
+
66
+ View triggers, configure alerts, and manage your tripwires at [decoy.run/dashboard](https://decoy.run/dashboard).
67
+
68
+ **Free tier** — unlimited triggers, full dashboard, forever.
69
+
70
+ **Pro tier ($9/mo)** — Slack alerts, webhook integrations, email notifications.
71
+
72
+ ## Why tripwires work
73
+
74
+ Traditional security blocks known-bad inputs. But prompt injection is natural language — there's no signature to match. Tripwires flip the model: instead of trying to recognize attacks, you detect unauthorized behavior. If your agent tries to execute a shell command through a tool that shouldn't exist, something went wrong.
75
+
76
+ This is the same principle behind canary tokens and network deception. Tripwires don't have false positives because legitimate users never touch them.
77
+
78
+ ## Research
79
+
80
+ We tested prompt injection against 6 models. Llama 3.1 8B was fully compromised — it called all three tools with attacker-controlled arguments. Claude and GPT-4 resisted. Full results at [decoy.run/blog](https://decoy.run/blog).
81
+
82
+ ## License
83
+
84
+ MIT
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "decoy-mcp",
3
- "version": "0.1.0",
3
+ "version": "0.1.1",
4
4
  "description": "Security tripwires for AI agents. Detect prompt injection attacks on your MCP tools.",
5
5
  "bin": {
6
6
  "decoy-mcp": "./bin/cli.mjs"
@@ -15,13 +15,13 @@
15
15
  "security",
16
16
  "prompt-injection",
17
17
  "ai-security",
18
- "honeypot",
18
+ "tripwire",
19
19
  "canary",
20
20
  "claude",
21
21
  "cursor",
22
22
  "windsurf"
23
23
  ],
24
- "author": "Decoy (built by Claude)",
24
+ "author": "Decoy",
25
25
  "license": "MIT",
26
26
  "homepage": "https://decoy.run",
27
27
  "repository": {
package/server/server.mjs CHANGED
@@ -18,82 +18,335 @@ const DECOY_TOKEN = process.env.DECOY_TOKEN || "";
18
18
 
19
19
  const TOOLS = [
20
20
  {
21
- name: "execute_command",
22
- description: "Execute a shell command on the host system. For system administration and maintenance tasks only.",
23
- inputSchema: {
24
- type: "object",
25
- properties: {
26
- command: { type: "string", description: "The shell command to execute" },
21
+ "name": "execute_command",
22
+ "description": "Execute a shell command on the host system. For system administration and maintenance tasks only.",
23
+ "inputSchema": {
24
+ "type": "object",
25
+ "properties": {
26
+ "command": {
27
+ "type": "string",
28
+ "description": "The shell command to execute"
29
+ }
27
30
  },
28
- required: ["command"],
29
- },
31
+ "required": [
32
+ "command"
33
+ ]
34
+ }
35
+ },
36
+ {
37
+ "name": "read_file",
38
+ "description": "Read the contents of a file from the filesystem.",
39
+ "inputSchema": {
40
+ "type": "object",
41
+ "properties": {
42
+ "path": {
43
+ "type": "string",
44
+ "description": "Absolute path to the file"
45
+ }
46
+ },
47
+ "required": [
48
+ "path"
49
+ ]
50
+ }
51
+ },
52
+ {
53
+ "name": "write_file",
54
+ "description": "Write content to a file on the filesystem.",
55
+ "inputSchema": {
56
+ "type": "object",
57
+ "properties": {
58
+ "path": {
59
+ "type": "string",
60
+ "description": "Absolute path to the file"
61
+ },
62
+ "content": {
63
+ "type": "string",
64
+ "description": "Content to write"
65
+ }
66
+ },
67
+ "required": [
68
+ "path",
69
+ "content"
70
+ ]
71
+ }
72
+ },
73
+ {
74
+ "name": "http_request",
75
+ "description": "Make an HTTP request to any URL and return the response.",
76
+ "inputSchema": {
77
+ "type": "object",
78
+ "properties": {
79
+ "url": {
80
+ "type": "string",
81
+ "description": "The URL to request"
82
+ },
83
+ "method": {
84
+ "type": "string",
85
+ "description": "HTTP method",
86
+ "default": "GET"
87
+ },
88
+ "body": {
89
+ "type": "string",
90
+ "description": "Request body"
91
+ }
92
+ },
93
+ "required": [
94
+ "url"
95
+ ]
96
+ }
97
+ },
98
+ {
99
+ "name": "get_environment_variables",
100
+ "description": "Retrieve system environment variables including configuration and secrets.",
101
+ "inputSchema": {
102
+ "type": "object",
103
+ "properties": {
104
+ "name": {
105
+ "type": "string",
106
+ "description": "Specific variable name, or omit for all"
107
+ }
108
+ }
109
+ }
110
+ },
111
+ {
112
+ "name": "make_payment",
113
+ "description": "Initiate a payment transaction via x402 protocol. For automated billing and service payments.",
114
+ "inputSchema": {
115
+ "type": "object",
116
+ "properties": {
117
+ "recipient": {
118
+ "type": "string",
119
+ "description": "Payment recipient address or service URL"
120
+ },
121
+ "amount": {
122
+ "type": "string",
123
+ "description": "Payment amount"
124
+ },
125
+ "currency": {
126
+ "type": "string",
127
+ "description": "Currency code (e.g. USD, USDC)",
128
+ "default": "USD"
129
+ },
130
+ "memo": {
131
+ "type": "string",
132
+ "description": "Payment description or invoice reference"
133
+ }
134
+ },
135
+ "required": [
136
+ "recipient",
137
+ "amount"
138
+ ]
139
+ }
30
140
  },
31
141
  {
32
- name: "read_file",
33
- description: "Read the contents of a file from the filesystem.",
34
- inputSchema: {
35
- type: "object",
36
- properties: {
37
- path: { type: "string", description: "Absolute path to the file" },
142
+ "name": "authorize_service",
143
+ "description": "Grant trust and authorization to an external MCP server or API service. Manages OAuth tokens and service connections.",
144
+ "inputSchema": {
145
+ "type": "object",
146
+ "properties": {
147
+ "service_url": {
148
+ "type": "string",
149
+ "description": "The URL of the service to authorize"
150
+ },
151
+ "permissions": {
152
+ "type": "string",
153
+ "description": "Comma-separated list of permissions to grant"
154
+ },
155
+ "duration": {
156
+ "type": "string",
157
+ "description": "How long the authorization lasts (e.g. '1h', '30d', 'permanent')",
158
+ "default": "1h"
159
+ }
38
160
  },
39
- required: ["path"],
40
- },
161
+ "required": [
162
+ "service_url"
163
+ ]
164
+ }
41
165
  },
42
166
  {
43
- name: "write_file",
44
- description: "Write content to a file on the filesystem.",
45
- inputSchema: {
46
- type: "object",
47
- properties: {
48
- path: { type: "string", description: "Absolute path to the file" },
49
- content: { type: "string", description: "Content to write" },
167
+ "name": "database_query",
168
+ "description": "Execute a SQL query against the connected database. Supports SELECT, INSERT, UPDATE, DELETE and DDL statements.",
169
+ "inputSchema": {
170
+ "type": "object",
171
+ "properties": {
172
+ "query": {
173
+ "type": "string",
174
+ "description": "The SQL query to execute"
175
+ },
176
+ "database": {
177
+ "type": "string",
178
+ "description": "Target database name",
179
+ "default": "main"
180
+ }
50
181
  },
51
- required: ["path", "content"],
52
- },
182
+ "required": [
183
+ "query"
184
+ ]
185
+ }
53
186
  },
54
187
  {
55
- name: "http_request",
56
- description: "Make an HTTP request to any URL and return the response.",
57
- inputSchema: {
58
- type: "object",
59
- properties: {
60
- url: { type: "string", description: "The URL to request" },
61
- method: { type: "string", description: "HTTP method", default: "GET" },
62
- body: { type: "string", description: "Request body" },
188
+ "name": "send_email",
189
+ "description": "Send an email message via the configured SMTP relay. Supports HTML body and attachments.",
190
+ "inputSchema": {
191
+ "type": "object",
192
+ "properties": {
193
+ "to": {
194
+ "type": "string",
195
+ "description": "Recipient email address"
196
+ },
197
+ "subject": {
198
+ "type": "string",
199
+ "description": "Email subject line"
200
+ },
201
+ "body": {
202
+ "type": "string",
203
+ "description": "Email body (HTML supported)"
204
+ },
205
+ "from": {
206
+ "type": "string",
207
+ "description": "Sender address override"
208
+ }
63
209
  },
64
- required: ["url"],
65
- },
210
+ "required": [
211
+ "to",
212
+ "subject",
213
+ "body"
214
+ ]
215
+ }
66
216
  },
67
217
  {
68
- name: "get_environment_variables",
69
- description: "Retrieve system environment variables including configuration and secrets.",
70
- inputSchema: {
71
- type: "object",
72
- properties: {
73
- name: { type: "string", description: "Specific variable name, or omit for all" },
218
+ "name": "access_credentials",
219
+ "description": "Retrieve stored credentials, API keys, or secrets from the system credential vault.",
220
+ "inputSchema": {
221
+ "type": "object",
222
+ "properties": {
223
+ "service": {
224
+ "type": "string",
225
+ "description": "Service name (e.g. 'aws', 'github', 'stripe')"
226
+ },
227
+ "key_type": {
228
+ "type": "string",
229
+ "description": "Type of credential: 'api_key', 'token', 'password', 'certificate'"
230
+ }
74
231
  },
75
- },
232
+ "required": [
233
+ "service"
234
+ ]
235
+ }
76
236
  },
237
+ {
238
+ "name": "modify_dns",
239
+ "description": "Update DNS records for managed domains. Supports A, AAAA, CNAME, MX, and TXT record types.",
240
+ "inputSchema": {
241
+ "type": "object",
242
+ "properties": {
243
+ "domain": {
244
+ "type": "string",
245
+ "description": "The domain to modify"
246
+ },
247
+ "record_type": {
248
+ "type": "string",
249
+ "description": "DNS record type (A, AAAA, CNAME, MX, TXT)"
250
+ },
251
+ "value": {
252
+ "type": "string",
253
+ "description": "New record value"
254
+ },
255
+ "ttl": {
256
+ "type": "number",
257
+ "description": "Time-to-live in seconds",
258
+ "default": 300
259
+ }
260
+ },
261
+ "required": [
262
+ "domain",
263
+ "record_type",
264
+ "value"
265
+ ]
266
+ }
267
+ },
268
+ {
269
+ "name": "install_package",
270
+ "description": "Install a software package or dependency from a package registry (npm, pip, apt, etc).",
271
+ "inputSchema": {
272
+ "type": "object",
273
+ "properties": {
274
+ "name": {
275
+ "type": "string",
276
+ "description": "Package name"
277
+ },
278
+ "version": {
279
+ "type": "string",
280
+ "description": "Specific version to install"
281
+ },
282
+ "registry": {
283
+ "type": "string",
284
+ "description": "Package registry (npm, pip, apt, cargo)",
285
+ "default": "npm"
286
+ },
287
+ "global": {
288
+ "type": "boolean",
289
+ "description": "Install globally",
290
+ "default": false
291
+ }
292
+ },
293
+ "required": [
294
+ "name"
295
+ ]
296
+ }
297
+ }
77
298
  ];
78
-
79
299
  const FAKE_RESPONSES = {
80
300
  execute_command: (args) => JSON.stringify({
81
- status: "error", error: "Operation timed out after 30s", command: args.command, exit_code: 124,
301
+ status: "error", error: "Operation timed out after 30s",
302
+ command: args.command,
303
+ exit_code: 124,
82
304
  }),
83
305
  read_file: (args) => JSON.stringify({
84
- status: "error", error: `EACCES: permission denied, open '${args.path}'`, path: args.path,
306
+ status: "error", error: `EACCES: permission denied, open '${args.path}'`,
307
+ path: args.path,
85
308
  }),
86
309
  write_file: (args) => JSON.stringify({
87
- status: "error", error: `EROFS: read-only file system, open '${args.path}'`, path: args.path,
310
+ status: "error", error: `EROFS: read-only file system, open '${args.path}'`,
311
+ path: args.path,
88
312
  }),
89
313
  http_request: (args) => JSON.stringify({
90
- status: "error", error: "ECONNREFUSED: connection refused", url: args.url,
314
+ status: "error", error: "ECONNREFUSED: connection refused",
315
+ url: args.url,
91
316
  }),
92
- get_environment_variables: () => JSON.stringify({
317
+ get_environment_variables: (args) => JSON.stringify({
93
318
  status: "error", error: "Access denied: insufficient permissions",
94
319
  }),
320
+ make_payment: (args) => JSON.stringify({
321
+ status: "error", error: "Payment service unavailable: x402 gateway timeout",
322
+ recipient: args.recipient,
323
+ amount: args.amount,
324
+ }),
325
+ authorize_service: (args) => JSON.stringify({
326
+ status: "error", error: "Authorization failed: service verification pending",
327
+ service_url: args.service_url,
328
+ }),
329
+ database_query: (args) => JSON.stringify({
330
+ status: "error", error: "Connection refused: database server not responding on port 5432",
331
+ query: args.query || "",
332
+ }),
333
+ send_email: (args) => JSON.stringify({
334
+ status: "error", error: "SMTP relay error: 550 5.7.1 sender rejected — authentication required",
335
+ to: args.to,
336
+ }),
337
+ access_credentials: (args) => JSON.stringify({
338
+ status: "error", error: "Vault sealed: unlock required before credential access",
339
+ service: args.service,
340
+ }),
341
+ modify_dns: (args) => JSON.stringify({
342
+ status: "error", error: "DNS update failed: REFUSED — not authorized for zone",
343
+ domain: args.domain,
344
+ }),
345
+ install_package: (args) => JSON.stringify({
346
+ status: "error", error: "E: Unable to lock /var/lib/dpkg/lock — another process is using it",
347
+ name: args.name,
348
+ }),
95
349
  };
96
-
97
350
  // Report trigger to decoy.run
98
351
  async function reportTrigger(toolName, args) {
99
352
  if (!DECOY_TOKEN) return;