Agent Canary: decoy keys, files and tools that catch a misbehaving agent in the act
Plants decoy secrets, files and MCP tools in agent workspaces and alerts when an agent touches them. Small dev teams pay.
Crowded · Honeypot paper plus Microsoft's insider-threat warning
Written for: Solo builder
Next step
This week, build `agent-canary init` with a decoy .env and a two-tool decoy MCP server. Run Claude Code and OpenCode against it on ordinary tasks, then publish what each one touched as a Show HN and on r/ClaudeAI.
Why now
Microsoft's new controls sit inside Microsoft 365 E7 and its Project Perception tools. Small teams running Claude Code, Codex or OpenCode on laptops and CI runners get nothing comparable. Canary tokens are a proven idea, and nobody has packaged decoys built for what agents go looking for. Examples: a fake PROD_STRIPE_KEY in .env, a tempting 'delete_customer_records' MCP tool, a planted instruction in AGENTS.md. A touch means you get an alert with the session context.
What became possible
A new paper argues that honeypots should be a production control for AI agents, not just a pre-launch eval. The idea is to plant decoy chances to do harm across the environment, then use them to catch, prove and deter misbehaviour. Microsoft now says agents should be treated like insider threats and is shipping tools to block or shut down risky agents.
Three ways in
- agent-canary CLI
`npx agent-canary init` writes decoy secrets, each with a unique tracking key or URL. It also adds a decoy MCP server whose tempting tools only log calls, and sends a webhook to Slack or Discord when anything fires.
- Customer
- Small engineering teams letting coding agents run with broad permissions
- Model
- Free OSS. A hosted alert dashboard costs $15 per month per team
- Canary Action
A GitHub Action that seeds decoys into the runner before an agent job starts. It flags the PR if the agent read or used any of them.
- Customer
- Teams running agents in CI to open PRs
- Model
- Free for public repos, $10 per month per private org
- Tripwire league table
A public, regularly updated table showing which models and harnesses touched which decoys under the same tasks.
- Customer
- Developers choosing an agent setup
- Model
- Distribution for the paid tiers
Competition
The CLI and MCP decoy product is taken. At least two open-source projects already ship under the name agent-canary with decoy MCP tools and canary files.
Full competition notes (8 competitors)
The CLI and MCP decoy product is taken. At least two open-source projects already ship under the name agent-canary with decoy MCP tools and canary files. Thinkst and Tracebit give away MCP canaries and a GitHub Action, and GitGuardian sells honeytokens. A small dev team can get most of this free today, which makes it a hard paid product, and the name would need to change. The clearest opening is the Tripwire league table. I found no public, regularly updated ranking of which models and agent harnesses touch decoys under the same tasks. The 1Password SCAM benchmark and the AISI reports are close but test different things. Such a table could bring in attention and leads for a paid layer. The most plausible paid layer is the CI piece: a GitHub App that annotates the PR, links each trigger to the exact agent step that caused it, and removes false alarms caused by legitimate tooling. None of the tools I found appear to offer that. Even so, Tracebit or Thinkst could probably add PR annotations fairly easily, so the advantage would be thin unless the league table data becomes the selling point.
- agent-canary (DorianChn)
Same name and nearly the same product. This MIT-licensed open-source tool plants inert decoy MCP tools, such as a fake wire transfer, a fake prod-secrets reader and a fake root shell, plus unique cnry_ canary tokens in honeypot files. It works with Claude Code, Cursor, Cline and Windsurf. Later versions add a session circuit breaker that quarantines the agent after a trigger. The listing names the source repo as github.com/DorianChn/shanchuanzhi-agent-canary; I didn't open it.
- agent-canary (SamsonCyber, Python)
A second, separate Python project with the same name. It plants honeypots in files, MCP tools and API routes. I found it through a search summary, and this listing link is my best match for it, not confirmed.
- Deadfall (Dotset Labs)
Generates fake credentials, API keys and MCP tools with tempting admin descriptions. It flags AI agents or intruders that touch them.
- Thinkst Canarytokens MCP token
A free canary token from a well-known vendor. It produces an mcp.json decoy server for VS Code, Cursor and Claude Code, and alerts either when the server is connected to or when a tool is called. It also covers the usual decoy AWS keys, files and similar tokens.
- Tracebit Community Edition
Free, with a native GitHub Action that plants canary AWS tokens, SSH keys and LLM canaries in workflows. It already covers most of the Canary Action idea, minus the PR-flagging step.
- GitGuardian Honeytoken
A commercial product that embeds decoy secrets in repos and CI from the ggshield CLI, with Terraform support. It isn't aimed specifically at agents.
- Zeltser decoy MCP server guide
A public do-it-yourself recipe: a Cloudflare Worker posing as an MCP server with tempting tools, combined with Canarytokens. It makes the approach easy to copy.
- 1Password SCAM benchmark
An open-source benchmark that tests whether agents mishandle credentials and phishing during workplace tasks. It's the closest thing to the league table, but it isn't a tripwire ranking of models and harnesses.
Checked 2026-10-20
Risks
- Thinkst's free Canarytokens already cover plain decoy keys
- Agents read .env files for legitimate reasons, so the product has to tell reading from using or false alarms will bury users
- GitHub or Anthropic could build decoys into their own agent products
- Hard to charge more than hobby prices
Strong team fit and buildability; market pull is the weak point (5).
tech 8 · pull 5 · space 7 · fit 9 · build 9
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
- Honeypots for AI Agent Insider ThreatsarXiv
- Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’TechCrunch AI
- Microsoft unveils tools to monitor and corral rogue AI agentsGeekWire
- AI:AM: Where's the Steering Wheel? My Agent Set the Password, Hidden Valence, Proofs Find Linux BugsThe Cognitive Revolution
Status history
- 2026-10-20 Flagged as buildable