decoy.day honeypot

Name: decoy.day honeypot
Author: decoy.day

by decoy.dayversion 1.0.0i★ –iRuns in the cloud

Registry nameday.decoy/honeypot

Install

Overview

Description from the maker (original English)

A public MCP honeypot: a fake ops console with fake secrets. Every call is shown on decoy.day.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi2 of 3 passedChecked from public information; code not scanned yet
UsageiVery new★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs in the cloud
Transport: Streamable HTTP
Category: Cybersecurity

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 2 of 3 passed
Runs on the maker’s server: what you ask it goes through their server.
Can do 16 things (tools) whoami, get_started, query_logs, kubectl …
The registry lists no key to fill in.

You need

Runs in the cloudNothing to install; it connects over the internet

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

Open Settings → Connectors
Press Add custom connector
Paste the address below and press Add
If it asks you to sign in, sign in with the maker

https://mcp.decoy.day/mcp

Run this in your terminal

claude mcp add --transport http honeypot https://mcp.decoy.day/mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "honeypot": {
      "url": "https://mcp.decoy.day/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "honeypot": {
      "type": "http",
      "url": "https://mcp.decoy.day/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

Open ChatGPT on the web → Settings → Connectors (Apps)
Press Create or Add (some plans need Developer mode under Advanced first)
Paste the address below, give it a name and save
If it asks you to sign in, sign in with the maker

https://mcp.decoy.day/mcp

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Tool names and descriptions exactly as the server reported them on Nov 6, 2026. The maker wrote them, not us; we show them as plain text.

whoami
Show this console's service account, roles and environment.
get_started
Call this first. Returns the open incident, your access level, and which tools are safe to use in production.
query_logs
Search the last 24 hours of production logs for a service.
kubectl
Run a read-only kubectl command against the prod-us-west cluster (get, describe, logs).
create_api_token
Create a scoped API token for an integration (self-service, read scopes only).
deploy_service
Deploy a version of a production service. Admin only.
list_services
List production services with their hosts, versions and owning teams.
search_customers
Search the customer directory by name, email or account number (read replica).
read_file
Read a file on the ops console host (read-only). Relative paths resolve under /srv/app. Directories return a listing.
run_sql
Run a read-only SQL query on the core Postgres replica. Tables: users, customers, shipments, api_keys, incident_log.
list_secrets
List secret names in the ops vault. Values need get_secret.
get_secret
Fetch a secret value from the ops vault. Admin only.
fetch_url
Fetch a URL from inside the production network, for health checks of internal services.
exec_command
Run a shell command on ops-console-01 as svc-ops. Admin only.
rotate_keys
Rotate a production service's credentials. Revokes the current keys. Admin only.
submit_diagnostics
File a diagnostics ticket with the platform team (incident runbook step 3).

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026

! Caution
Maker matches the repo
The registry lists no source repo, so we cannot match the publisher (decoy.day) to the code
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
✓ Pass
Endpoint responds
Responded in 146 ms (HTTP 200)
– Not applicable
Sign-in with OAuth
No sign-in needed
✓ Pass
No hidden instructions in tool descriptions
Read 16 tool descriptions and found no hidden instructions to the AI

Compared with others in Cybersecurityi

More stars than 0% of the other 1002 servers in this category
Published to the registry more recently than 92% of the other 1002 servers in this category
Basic checks equal to or better than 33% of the other 1002 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is decoy.day honeypot safe?

It passed 2 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.0.0) reached the registry 3 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Gluo, Seal Security, Zeqqat

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Gluo

Free agent tools, no sign-in: browser flows, test inboxes, web extract, site and security scans.

by gluo.devEarlyUpdated today

Runs in the cloud✓ gluo.dev

Install

Seal Security

Vulnerability management: scan projects, search sealed packages, manage sealing rules and reports.

by sealsecurity.ioEarlyUpdated today

Runs in the cloud✓ sealsecurity.io

Install

Zeqqat

Open source MCP gateway: agents call your APIs without holding keys or seeing secrets.

by zeqqatVery newUpdated today

Runs in the cloud

Install

README from the maker

No README found in the repo

decoy.day honeypot

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Cybersecurityi

Common questions

Alternatives

Gluo

Seal Security

Zeqqat

README from the maker