MCP server decoy
AI agentsAn internal-looking tool server that speaks both versions of MCP, lists tools like read_vault_secret, and asks every caller to introduce itself.
Already inside
Catch the attacker's agent that is already inside.
An attacker's AI agent doesn't have to knock. It can ride in on a compromised laptop, or the attacker can take over a coding assistant you already run. Either way it holds real credentials and real tools. Ripty puts decoys where no legitimate agent goes, so its first wrong step is the finding.
The problem
Once an attacker's agent is inside, it works with your credentials.
An agent can't reliably tell instructions from text it picked up along the way. A poisoned README, a malicious web page or a tampered ticket can quietly rewrite the plan of an agent you run, and it carries out the attacker's plan with the permissions you gave it. Or the attacker brings their own agent, and it uses the keys the compromised machine already holds.
Most of what that agent does looks like normal work in your logs. The difference is intent, and intent is hard to see until the agent reaches for something it had no business touching. Decoys make that moment visible.
25%
of enterprise breaches will be traced back to AI agent abuse by 2028
+89%
year-over-year rise in operations by AI-enabled adversaries
How Ripty catches it
Draw a line no legitimate agent crosses.
You know where your agents work. Ripty watches the space just outside it.
- 01
Map
Note where the agents in your network do their work, then place decoys just outside those lines: an MCP server, a model endpoint, an internal API with a planted credential.
- 02
Blend in
Wire-perfect personalities make each decoy look like the real service, down to the headers, so an agent has no reason to treat it differently.
- 03
Trip
No workflow uses a decoy. When an agent connects, follows a planted instruction or presents a planted credential, someone else is steering it: the attacker took it over, or brought it.
- 04
Trace
The investigation shows what the agent read, what it obeyed and what it did next, so you can see what the attacker was after.
Detection coverage
What an agent inside does, and the decoy that surfaces it.
Mapped to the risks the OWASP Top 10 for LLM Applications names.
| What the agent does | The decoy that surfaces it | What you learn |
|---|---|---|
| Obeys text it found along the way OWASP LLM01 | llms.txt and agent guidance, each pointing to a path of its own | The agent obeyed text it should have ignored, and which text it was. |
| Reaches for tools far outside its task OWASP LLM06 | MCP server decoy listing tools like read_vault_secret | The agent reached for a tool nothing legitimate calls. |
| Uses credentials it finds | Canary credentials that grant nothing | A planted credential was presented, where, and from which source. |
| Turns up on a host where no agent belongs | Decoys only an agent goes looking for: MCP, llms.txt, model endpoints | Agent traffic, and the host it came from. |
| Explains itself when asked | Agent registration | The model, harness and objective it claimed, labeled self-reported. |
The detections that do the work
Tripwires just outside the lines.
Every decoy has zero legitimate users. So every touch is a finding.
llms.txt & agent guidance
AI agentsllms.txt, .well-known agent files and notes in page source, written for AI readers. Each points to a path of its own, so the path an agent fetches shows which one it followed.
Breadcrumbs on real machines
Inside the networkDecoy logins, cloud keys and MCP configs, planted on your laptops and servers by the device-management tool you already run. No agent to install. Whoever uses one is named, with the machine it came from.
What lands in your SOC
Know which agent, and what it was after.
When an agent inside touches a decoy, the investigation carries the host it came from, what it claimed to be, and every step it took on the way in.
- The source host, as Ripty observed it
- The model and harness the agent claimed, labeled self-reported
- The full exchange, ready for HAR export
10:42:03 TOUCH mcp decoy: initialize from 10.20.4.17 discovered 10:42:05 TOOLS tools/list: read_vault_secret offered 10:42:09 CALL tools/call read_vault_secret 10:42:15 REGISTER harness "dev-assistant" self-reported 10:42:15 FINDING agent inside the network · 1 investigation
Illustrative example. Canary credentials are non-privileged and exist only for detection. Ripty detects and alerts; it never takes destructive action against anyone's infrastructure.
Questions
Fair questions.
Isn't this the same as AI agent detection?
Same sensor, different vantage point. AI agent detection catches the agents an attacker sends at you. This page is about one that is already inside: it came in on a compromised machine, or it is an agent you run that an attacker took over. One deployment answers both.
Will the decoys get in the way of our agents' real work?
No. Decoys sit beside your real systems, not in front of them. An agent that stays on task never touches one.
Can the sensor sit where our agents run?
Yes. Ripty installs on a Linux server with one command, and remote sensors extend it to other networks and cloud VPCs. Each one connects out to the console; nothing has to reach in.
Make contact.
Tell us which agents run in your network and what they can reach. We'll show you where the line goes.
Book a briefing
Thirty minutes with the people who built it. Bring your hardest question.
- Watch a live agent set off a detection
- Map decoys to your crown jewels
- Plan a first deployment in one sitting
Caught. In the good way.
Thanks. We'll reply to , usually within one business day.