Live status of the honeypot capture net, the honest capabilities catalog (implemented vs stub), the most-recent captures, and the primary actions that drive it. Status and captures are read from the honeypot telemetry database over the last 24h; the capabilities catalog and actions need no database and remain available at all times.
The single typed source of truth for what the honeypot toolset can do — 21 implemented, 1 stub, 22 total. Mirrored byte-for-byte by the honeypot.capabilities.list MCP verb.
Capture ingest pipelineimplemented
Webhook-verified POST that persists a capture event, computes and stores the fingerprint reputation score, evaluates auto-tarpit triggers, and records ingest + replay samples.
model · HoneypotEvent
Fingerprint reputation scoringimplemented
Deterministic 0-100 reputation score computed and persisted per fingerprint on every ingest, driving blocklist and tarpit decisions.
model · FingerprintReputation
Fingerprint clusteringimplemented
Groups capture events into attacker clusters keyed by request fingerprint for operator triage.
model · Fingerprint
External echo sighting recordingimplemented
CRON_SECRET-authed recording of trap-marker echoes observed off-platform (canary tokens surfacing in the wild).
model · EchoSighting
Canary token registryimplemented
Issues and tracks canary tokens embedded in bait content so their later appearance can be attributed.
model · CanaryToken
Live event stream (SSE)implemented
Backfilled server-sent-events feed of new capture events for real-time operator dashboards.
model · HoneypotEvent
Public landing aggregateimplemented
Windowed public capture aggregate (1-720h) powering the Landing hero, with no per-request PII.
model · HoneypotEvent
Weekly content digestimplemented
ISO-week human/JSON digest summarizing capture activity for a period (content summary, not a determinism hash).
model · HoneypotEvent
Embeddable capture badgeimplemented
Embeddable SVG badge rendering the current capture count.
model · HoneypotEvent
Blocklist exportimplemented
Plaintext blocklist export of high-risk fingerprints/IP hashes derived from reputation scores.
model · FingerprintReputation
Events CSV exportimplemented
CSV export surface of capture events for offline analysis.
model · HoneypotEvent
Tarpit state lookupimplemented
Internal bridge-token server-to-server lookup of active auto-tarpit state for a fingerprint/ASN.
model · TarpitState
Per-ASN rate-limit policyimplemented
Internal bridge-token lookup of the per-ASN token-bucket window/limit policy applied to callers.
model · RateLimitPolicy
Verified vendor allowlistimplemented
Allowlist of verified legitimate crawlers used to suppress false-positive captures.
model · VerifiedVendor
Fingerprint investigationimplemented
Per-fingerprint drill-down with persisted operator investigation notes.
model · InvestigationNote
Tenant fleet registryimplemented
Multi-tenant registry and fleet overview across all onboarded honeypot tenants.
model · Tenant
Tenant heartbeat alertingimplemented
Evaluates per-tenant self-observability heartbeats and raises alerts when a tenant goes silent.
model · TenantHeartbeat
Alert rule evaluationimplemented
Evaluates operator-defined alert rules against the capture stream and fires configured notifications.
model · AlertRule
Datadog metrics pushimplemented
Pushes capture-rate and ingest-health metrics to Datadog for external observability.
model · IngestSample
PII retention rotationimplemented
Rotates/expires PII fields on aged capture rows per the retention policy (GDPR data-minimization).
model · HoneypotEvent
Replay determinism comparatorimplemented
Compares recorded ingest replay envelopes to prove deterministic parity of the capture pipeline.
model · IngestSample
honeypot.* MCP namespacestub
Read-only agent verbs (honeypot.status.get, honeypot.capabilities.list) at /api/mcp/v1/honeypot.* — scaffolded via this catalog kernel but NOT yet exposed as endpoints (Phase T.5).
Every action maps to a real honeypot MCP verb, operator page, or authed action — nothing here is a placeholder.