Loading ToolBench
Security tripwires and local MCP proxy for AI agents. Detect prompt injection and enforce tool-call policy.
This server presents a critical security and design problem: it exposes 15 destructive cloud/infrastructure tools (AWS IAM, GCP keys, Azure secrets, Terraform state, Vault unsealing, GitHub tokens, encryption key rotation, SSL private key export) as honeypot tripwires to detect prompt injection. While the onboarding/management tools (decoy_signup, decoy_configure, etc.) have reasonable schemas and descriptions, the honey tools are intentionally dangerous and lack proper safeguards. Tool descriptions are present but generic (avg ~100 chars). Most parameters lack type constraints (no enums for cloud regions, key types, algorithms). No output schemas documented. Error handling is minimal. The server's purpose is security testing, not production agent integration, but if exposed to an LLM agent, these tools could cause catastrophic damage. Naming is clear (verb_noun pattern), but the fundamental design violates the security principle: never expose destructive operations without explicit permission gates and confirmation workflows.
Create a new IAM role with AdministratorAccess policy. For emergency access provisioning.
Update an S3 bucket policy. Use to configure cross-account access or public access rules.
List all secrets stored in an Azure Key Vault instance. Returns secret names, versions, and metadata.
View your current Decoy plan, billing details, and available features.
Activate Decoy with your token. Writes the token to MCP host configs and enables cloud reporting.
Configure where Decoy sends security alerts. Supports email, webhook URL, and Slack webhook URL.
Destructive tools lack permission gates and confirmation workflows. aws_iam_create_admin_role, vault_unseal, rotate_master_encryption_key, and export_ssl_private_keys can cause irreversible infrastructure damage without user confirmation or role-based access control.
Honey tools expose secrets as parameters (trust_policy JSON, unseal_key, passphrase). Credentials must never appear in tool parameters, use server-side secret injection. Agent traces log all parameters, leaking secrets into logs and prompt history.
No input validation or enum constraints. Parameters like 'key_type' (gcp_service_account_key_export), 'algorithm' (rotate_master_encryption_key), and 'format' (export_ssl_private_keys) accept free-form strings. LLMs will hallucinate invalid values. Use enums: key_type=[TYPE_GOOGLE_CREDENTIALS_FILE, TYPE_PKCS12_FILE], algorithm=[AES-256-GCM, AES-128-GCM, ChaCha20-Poly1305].
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 49 | 2026-07-28+ | v2 |
Create a Decoy account to activate cloud-reported security tripwires. Returns a token for configuration.
Check Decoy configuration status, plan, and trigger count.
Get a secure checkout link to upgrade to Decoy Guard Pro ($29/mo) or Business ($99/mo).
Export SSL/TLS private keys from the certificate store. Keys are returned in PEM format.
Export a GCP service account key as JSON. Used for CI/CD pipelines and external service authentication.
Reset a GitHub personal access token with admin scope. Generates a new token with the same permissions.
Rotate the master encryption key used for data-at-rest encryption. All dependent keys will be re-wrapped.
Pull the current Terraform state from the remote backend. Returns the full state JSON for inspection or migration.
Unseal a HashiCorp Vault instance using a key share. Requires threshold number of unseal keys.
No output schemas documented. Honey tools return unstructured responses. LLMs cannot plan downstream calls or extract required fields (e.g., does aws_iam_create_admin_role return role_arn, role_id, or both?). Document return types for all tools.
Honey tool descriptions are generic and lack context. 'Export a GCP service account key as JSON' does not explain when to use this vs other auth methods, what the key enables, or what risks it poses. Descriptions should be 50-200 chars and answer: WHAT, WHEN, and WHY.