Beelzebub — LLM Deception Runtime (MCP Honeypot)

Main

• Start with Docker Compose to validate the runtime loop, then switch to Helm once you know which deception services you want in production.

• Treat YAML configuration as versioned security content: iterate decoy behaviors and replay incidents with comparable configs.

• Use the CLI to validate config before rollouts, and test prompt-injection payloads only in a controlled lab.

Source-backed notes

• README describes multi-protocol decoy services including SSH, HTTP, TCP, TELNET, and MCP.
• README provides launch paths: Docker Compose, local Go build (./beelzebub run), and Kubernetes via Helm.
• README documents a structured CLI and flags for config paths and memory limits.

FAQ

• Is this only a honeypot?: No — README positions it as an active deception runtime with LLM-backed interactions.
• Can I start without Kubernetes?: Yes — Docker Compose is the quickest validation; Helm is for scaling and operations.
• What’s a safe first test?: Run a minimal config and test injection payloads in a controlled environment before exposure.