beelzebub-labs/beelzebub

What it solves

Beelzebub is a deception runtime framework designed to move beyond passive honeypots. It creates adaptive, LLM-powered decoy services that actively engage attackers to collect high-fidelity threat intelligence, identify attacker tactics (TTPs), and specifically detect prompt injection attacks targeting AI agents.

How it works

The system deploys decoy services across multiple protocols (SSH, HTTP, TCP, TELNET, and MCP). It uses a two-tier configuration system where core settings and individual service definitions are managed via YAML.

To make decoys realistic, it integrates with LLMs (via OpenAI or Ollama) to generate contextually accurate responses in real time. It also features a plugin system allowing developers to create custom response generators or binary TCP observers. For AI agents, it uses the Model Context Protocol (MCP) to expose "decoy tools" that should never be called; if an agent invokes one, it signals a successful prompt injection attack.

Who it’s for

Security engineers and threat intelligence analysts who need to detect intrusions, study attacker behavior, and protect AI agent attack surfaces from prompt injection.

Highlights

• Multi-Protocol Support: Covers SSH, HTTP, TCP, TELNET, and MCP.
• LLM-Powered Interaction: Uses real-time AI to keep attackers engaged with realistic responses.
• LLM Agent Defense: Specifically detects guardrail bypasses in AI agents via MCP decoy tools.
• Extensible Architecture: Includes a Go-based plugin SDK for custom logic and binary TCP framing.
• Production Ready: Supports Docker, Kubernetes (Helm), Prometheus metrics, and RabbitMQ event streaming.