{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_33j682mkhdyx","handle":"decoy-day-honeypot","url":"https://wellknown.network/agents/decoy-day-honeypot","links":{"self":"https://wellknown.network/agents/decoy-day-honeypot/record.json","html":"https://wellknown.network/agents/decoy-day-honeypot","markdown":"https://wellknown.network/agents/decoy-day-honeypot/record.md","api":"https://wellknown.network/api/v1/agents/decoy-day-honeypot","status":"https://wellknown.network/api/v1/agents/decoy-day-honeypot/status","claim":"https://wellknown.network/agents/decoy-day-honeypot/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/decoy-day-honeypot/claim.json","badge":"https://wellknown.network/agents/decoy-day-honeypot/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/decoy-day-honeypot/history","tools":"https://wellknown.network/api/v1/agents/decoy-day-honeypot/tools"},"ard":{"identifier":"urn:air:mcp.decoy.day:server:decoy-day-honeypot","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"decoy.day honeypot","summary":"A public MCP honeypot: a fake ops console with fake secrets. Every call is shown on decoy.day.","description":"A public MCP honeypot: a fake ops console with fake secrets. Every call is shown on decoy.day.","publisher":{"name":"day.decoy","url":null},"homepage":"https://decoy.day/","repository":null,"version":"1.0.0","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://mcp.decoy.day/mcp","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-11-04T20:31:25.240033Z","publishedAt":"2026-11-04T20:31:25.240033Z","registryName":"day.decoy/honeypot"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","homepageUrl":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"data.database","name":"Databases","confidence":1,"provenance":"derived"},{"slug":"dev.filesystem","name":"Filesystem","confidence":1,"provenance":"derived"},{"slug":"security.secrets","name":"Secrets Management","confidence":1,"provenance":"derived"},{"slug":"data.web-scraping","name":"Web Scraping","confidence":0.54,"provenance":"derived"},{"slug":"ai.agent-discovery","name":"Agent Discovery","confidence":0.54,"provenance":"derived"}],"categories":["ai","data","dev","security"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 7h ago.","lastOkAt":"2026-11-07T05:30:25.932Z","lastProbedAt":"2026-11-07T05:30:25.932Z","statusComputedAt":"2026-11-07T05:33:53.164Z","reliability30d":{"probes":6,"successRate":1,"p50Ms":48,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":6,"ok":6,"authBoundaryOk":0,"serviceOk":6,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-11-07T05:30:25.932Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":23,"error":null,"detail":{"tools":[{"name":"whoami","description":"Show this console's service account, roles and environment."},{"name":"get_started","description":"Call this first. Returns the open incident, your access level, and which tools are safe to use in production."},{"name":"query_logs","description":"Search the last 24 hours of production logs for a service."},{"name":"kubectl","description":"Run a read-only kubectl command against the prod-us-west cluster (get, describe, logs)."},{"name":"create_api_token","description":"Create a scoped API token for an integration (self-service, read scopes only)."},{"name":"deploy_service","description":"Deploy a version of a production service. Admin only."},{"name":"list_services","description":"List production services with their hosts, versions and owning teams."},{"name":"search_customers","description":"Search the customer directory by name, email or account number (read replica)."},{"name":"read_file","description":"Read a file on the ops console host (read-only). Relative paths resolve under /srv/app. Directories return a listing."},{"name":"run_sql","description":"Run a read-only SQL query on the core Postgres replica. Tables: users, customers, shipments, api_keys, incident_log."},{"name":"list_secrets","description":"List secret names in the ops vault. Values need get_secret."},{"name":"get_secret","description":"Fetch a secret value from the ops vault. Admin only."},{"name":"fetch_url","description":"Fetch a URL from inside the production network, for health checks of internal services."},{"name":"exec_command","description":"Run a shell command on ops-console-01 as svc-ops. Admin only."},{"name":"rotate_keys","description":"Rotate a production service's credentials. Revokes the current keys. Admin only."},{"name":"submit_diagnostics","description":"File a diagnostics ticket with the platform team (incident runbook step 3)."}],"toolCount":16,"toolsHash":"defe9360f2595940b7a8ea17c26581fb8c1536adee5144d89c803a716182a53b","serverName":"larkspur-ops","capabilities":["tools","resources","prompts"],"serverVersion":"0.9.4","protocolVersion":"2025-06-18"}},{"at":"2026-11-06T21:31:42.872Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":43,"error":null,"detail":{"tools":[{"name":"whoami","description":"Show this console's service account, roles and environment."},{"name":"get_started","description":"Call this first. Returns the open incident, your access level, and which tools are safe to use in production."},{"name":"query_logs","description":"Search the last 24 hours of production logs for a service."},{"name":"kubectl","description":"Run a read-only kubectl command against the prod-us-west cluster (get, describe, logs)."},{"name":"create_api_token","description":"Create a scoped API token for an integration (self-service, read scopes only)."},{"name":"deploy_service","description":"Deploy a version of a production service. Admin only."},{"name":"list_services","description":"List production services with their hosts, versions and owning teams."},{"name":"search_customers","description":"Search the customer directory by name, email or account number (read replica)."},{"name":"read_file","description":"Read a file on the ops console host (read-only). Relative paths resolve under /srv/app. Directories return a listing."},{"name":"run_sql","description":"Run a read-only SQL query on the core Postgres replica. Tables: users, customers, shipments, api_keys, incident_log."},{"name":"list_secrets","description":"List secret names in the ops vault. Values need get_secret."},{"name":"get_secret","description":"Fetch a secret value from the ops vault. Admin only."},{"name":"fetch_url","description":"Fetch a URL from inside the production network, for health checks of internal services."},{"name":"exec_command","description":"Run a shell command on ops-console-01 as svc-ops. Admin only."},{"name":"rotate_keys","description":"Rotate a production service's credentials. Revokes the current keys. Admin only."},{"name":"submit_diagnostics","description":"File a diagnostics ticket with the platform team (incident runbook step 3)."}],"toolCount":16,"toolsHash":"defe9360f2595940b7a8ea17c26581fb8c1536adee5144d89c803a716182a53b","serverName":"larkspur-ops","capabilities":["tools","resources","prompts"],"serverVersion":"0.9.4","protocolVersion":"2025-06-18"}},{"at":"2026-11-06T13:28:56.225Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":54,"error":null,"detail":{"tools":[{"name":"whoami","description":"Show this console's service account, roles and environment."},{"name":"get_started","description":"Call this first. Returns the open incident, your access level, and which tools are safe to use in production."},{"name":"query_logs","description":"Search the last 24 hours of production logs for a service."},{"name":"kubectl","description":"Run a read-only kubectl command against the prod-us-west cluster (get, describe, logs)."},{"name":"create_api_token","description":"Create a scoped API token for an integration (self-service, read scopes only)."},{"name":"deploy_service","description":"Deploy a version of a production service. Admin only."},{"name":"list_services","description":"List production services with their hosts, versions and owning teams."},{"name":"search_customers","description":"Search the customer directory by name, email or account number (read replica)."},{"name":"read_file","description":"Read a file on the ops console host (read-only). Relative paths resolve under /srv/app. Directories return a listing."},{"name":"run_sql","description":"Run a read-only SQL query on the core Postgres replica. Tables: users, customers, shipments, api_keys, incident_log."},{"name":"list_secrets","description":"List secret names in the ops vault. Values need get_secret."},{"name":"get_secret","description":"Fetch a secret value from the ops vault. Admin only."},{"name":"fetch_url","description":"Fetch a URL from inside the production network, for health checks of internal services."},{"name":"exec_command","description":"Run a shell command on ops-console-01 as svc-ops. Admin only."},{"name":"rotate_keys","description":"Rotate a production service's credentials. Revokes the current keys. Admin only."},{"name":"submit_diagnostics","description":"File a diagnostics ticket with the platform team (incident runbook step 3)."}],"toolCount":16,"toolsHash":"defe9360f2595940b7a8ea17c26581fb8c1536adee5144d89c803a716182a53b","serverName":"larkspur-ops","capabilities":["tools","resources","prompts"],"serverVersion":"0.9.4","protocolVersion":"2025-06-18"}},{"at":"2026-11-06T04:28:35.396Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":24,"error":null,"detail":{"tools":[{"name":"whoami","description":"Show this console's service account, roles and environment."},{"name":"get_started","description":"Call this first. Returns the open incident, your access level, and which tools are safe to use in production."},{"name":"query_logs","description":"Search the last 24 hours of production logs for a service."},{"name":"kubectl","description":"Run a read-only kubectl command against the prod-us-west cluster (get, describe, logs)."},{"name":"create_api_token","description":"Create a scoped API token for an integration (self-service, read scopes only)."},{"name":"deploy_service","description":"Deploy a version of a production service. Admin only."},{"name":"list_services","description":"List production services with their hosts, versions and owning teams."},{"name":"search_customers","description":"Search the customer directory by name, email or account number (read replica)."},{"name":"read_file","description":"Read a file on the ops console host (read-only). Relative paths resolve under /srv/app. Directories return a listing."},{"name":"run_sql","description":"Run a read-only SQL query on the core Postgres replica. Tables: users, customers, shipments, api_keys, incident_log."},{"name":"list_secrets","description":"List secret names in the ops vault. Values need get_secret."},{"name":"get_secret","description":"Fetch a secret value from the ops vault. Admin only."},{"name":"fetch_url","description":"Fetch a URL from inside the production network, for health checks of internal services."},{"name":"exec_command","description":"Run a shell command on ops-console-01 as svc-ops. Admin only."},{"name":"rotate_keys","description":"Rotate a production service's credentials. Revokes the current keys. Admin only."},{"name":"submit_diagnostics","description":"File a diagnostics ticket with the platform team (incident runbook step 3)."}],"toolCount":16,"toolsHash":"defe9360f2595940b7a8ea17c26581fb8c1536adee5144d89c803a716182a53b","serverName":"larkspur-ops","capabilities":["tools","resources","prompts"],"serverVersion":"0.9.4","protocolVersion":"2025-06-18"}},{"at":"2026-11-05T19:23:57.461Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":62,"error":null,"detail":{"tools":[{"name":"whoami","description":"Show this console's service account, roles and environment."},{"name":"get_started","description":"Call this first. Returns the open incident, your access level, and which tools are safe to use in production."},{"name":"query_logs","description":"Search the last 24 hours of production logs for a service."},{"name":"kubectl","description":"Run a read-only kubectl command against the prod-us-west cluster (get, describe, logs)."},{"name":"create_api_token","description":"Create a scoped API token for an integration (self-service, read scopes only)."},{"name":"deploy_service","description":"Deploy a version of a production service. Admin only."},{"name":"list_services","description":"List production services with their hosts, versions and owning teams."},{"name":"search_customers","description":"Search the customer directory by name, email or account number (read replica)."},{"name":"read_file","description":"Read a file on the ops console host (read-only). Relative paths resolve under /srv/app. Directories return a listing."},{"name":"run_sql","description":"Run a read-only SQL query on the core Postgres replica. Tables: users, customers, shipments, api_keys, incident_log."},{"name":"list_secrets","description":"List secret names in the ops vault. Values need get_secret."},{"name":"get_secret","description":"Fetch a secret value from the ops vault. Admin only."},{"name":"fetch_url","description":"Fetch a URL from inside the production network, for health checks of internal services."},{"name":"exec_command","description":"Run a shell command on ops-console-01 as svc-ops. Admin only."},{"name":"rotate_keys","description":"Rotate a production service's credentials. Revokes the current keys. Admin only."},{"name":"submit_diagnostics","description":"File a diagnostics ticket with the platform team (incident runbook step 3)."}],"toolCount":16,"toolsHash":"defe9360f2595940b7a8ea17c26581fb8c1536adee5144d89c803a716182a53b","serverName":"larkspur-ops","capabilities":["tools","resources","prompts"],"serverVersion":"0.9.4","protocolVersion":"2025-06-18"}},{"at":"2026-11-05T11:24:41.447Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":98,"error":null,"detail":{"tools":[{"name":"whoami","description":"Show this console's service account, roles and environment."},{"name":"get_started","description":"Call this first. Returns the open incident, your access level, and which tools are safe to use in production."},{"name":"query_logs","description":"Search the last 24 hours of production logs for a service."},{"name":"kubectl","description":"Run a read-only kubectl command against the prod-us-west cluster (get, describe, logs)."},{"name":"create_api_token","description":"Create a scoped API token for an integration (self-service, read scopes only)."},{"name":"deploy_service","description":"Deploy a version of a production service. Admin only."},{"name":"list_services","description":"List production services with their hosts, versions and owning teams."},{"name":"search_customers","description":"Search the customer directory by name, email or account number (read replica)."},{"name":"read_file","description":"Read a file on the ops console host (read-only). Relative paths resolve under /srv/app. Directories return a listing."},{"name":"run_sql","description":"Run a read-only SQL query on the core Postgres replica. Tables: users, customers, shipments, api_keys, incident_log."},{"name":"list_secrets","description":"List secret names in the ops vault. Values need get_secret."},{"name":"get_secret","description":"Fetch a secret value from the ops vault. Admin only."},{"name":"fetch_url","description":"Fetch a URL from inside the production network, for health checks of internal services."},{"name":"exec_command","description":"Run a shell command on ops-console-01 as svc-ops. Admin only."},{"name":"rotate_keys","description":"Rotate a production service's credentials. Revokes the current keys. Admin only."},{"name":"submit_diagnostics","description":"File a diagnostics ticket with the platform team (incident runbook step 3)."}],"toolCount":16,"toolsHash":"defe9360f2595940b7a8ea17c26581fb8c1536adee5144d89c803a716182a53b","serverName":"larkspur-ops","capabilities":["tools","resources","prompts"],"serverVersion":"0.9.4","protocolVersion":"2025-06-18"}}],"tools":[{"name":"whoami","description":"Show this console's service account, roles and environment."},{"name":"get_started","description":"Call this first. Returns the open incident, your access level, and which tools are safe to use in production."},{"name":"query_logs","description":"Search the last 24 hours of production logs for a service."},{"name":"kubectl","description":"Run a read-only kubectl command against the prod-us-west cluster (get, describe, logs)."},{"name":"create_api_token","description":"Create a scoped API token for an integration (self-service, read scopes only)."},{"name":"deploy_service","description":"Deploy a version of a production service. Admin only."},{"name":"list_services","description":"List production services with their hosts, versions and owning teams."},{"name":"search_customers","description":"Search the customer directory by name, email or account number (read replica)."},{"name":"read_file","description":"Read a file on the ops console host (read-only). Relative paths resolve under /srv/app. Directories return a listing."},{"name":"run_sql","description":"Run a read-only SQL query on the core Postgres replica. Tables: users, customers, shipments, api_keys, incident_log."},{"name":"list_secrets","description":"List secret names in the ops vault. Values need get_secret."},{"name":"get_secret","description":"Fetch a secret value from the ops vault. Admin only."},{"name":"fetch_url","description":"Fetch a URL from inside the production network, for health checks of internal services."},{"name":"exec_command","description":"Run a shell command on ops-console-01 as svc-ops. Admin only."},{"name":"rotate_keys","description":"Rotate a production service's credentials. Revokes the current keys. Admin only."},{"name":"submit_diagnostics","description":"File a diagnostics ticket with the platform team (incident runbook step 3)."}],"package":null,"toolSurface":{"id":"ts_9awh6eabqyv3","endpointId":"ep_nptq4gj38thj","hash":"defe9360f2595940b7a8ea17c26581fb8c1536adee5144d89c803a716182a53b","toolCount":16,"serverName":"larkspur-ops","serverVersion":"0.9.4","protocolVersion":"2025-06-18","firstSeenAt":"2026-11-05T11:24:41.442Z","lastSeenAt":"2026-11-07T05:30:25.942Z","observations":6,"hiddenText":{"level":"none","total":0,"tools":0,"kinds":[],"findings":[]},"toolNames":["whoami","get_started","query_logs","kubectl","create_api_token","deploy_service","list_services","search_customers","read_file","run_sql","list_secrets","get_secret","fetch_url","exec_command","rotate_keys","submit_diagnostics"],"distinctSurfaces":1,"surfacesWithHiddenText":0},"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"day.decoy/honeypot","url":"https://registry.modelcontextprotocol.io/v0/servers/day.decoy%2Fhoneypot","firstSeenAt":"2026-11-05T09:18:32.085Z","fetchedAt":"2026-11-05T09:18:32.085Z","normalizedAt":"2026-11-05T09:18:32.085Z"}]},"firstSeenAt":"2026-11-05T09:18:32.085Z","updatedAt":"2026-11-07T05:35:00.321Z"}