What is honeyprompt?

Honeyprompt is a deception tool for cybersecurity teams. It sets up fake versions of common network services, like an SSH server, a web server, or a Docker or Kubernetes control panel, that look real to an attacker but are actually traps meant to record what they do. Instead of using a fixed script of canned responses, honeyprompt hands the conversation to a large language model, so when someone types an unexpected command, the fake system can answer the way a real one would, keeping the attacker engaged longer. The project supports many cloud and local language model providers, and it can also run with fixed, non AI rules for the most common requests, which saves on language model costs for things like simple health checks. It ships as a small container or a single static binary, and every setting lives in one configuration file, so there is nothing extra to compile or a database to run separately. The tool comes with ready made profiles for a generic corporate web server, an AI agent gateway, the Docker Engine API, the Kubernetes API, a Linux server set up for AI development work, a Redis database, and an older industrial control system reachable over Telnet. Each profile is meant to convincingly imitate the real thing long enough for an attacker to reveal what tools they are using and what they are after. Everything that happens is recorded in two separate places. One log captures attacker activity such as connections, login attempts, and every command along with the reply that was sent back, meant to be read as threat intelligence. A separate log tracks the tool's own health, like startup messages and provider errors, and has nothing to do with attacker behavior. An optional web dashboard shows the attacker activity live and can export it all to a file. This is a personal project built for web developers who want a modern, AI backed honeypot, and a public demo instance is available to try before self hosting it.