beelzebub-labs/beelzebub

A secure low code deception runtime framework, leveraging AI for System Virtualization.

What it solves

Beelzebub is a deception framework that allows security teams to deploy realistic decoys (honeypots) to detect and study attacker behavior. It transforms interactions with these decoys into security evidence, helping analysts investigate how attackers are operating within a network.

How it works

Users define decoy services, routes, and response rules using YAML configurations. The framework supports multiple protocols including SSH, HTTP, TCP, TELNET, and MCP. It can respond to attackers using either static handlers for predictable behavior or LLM-powered responses for adaptive, realistic interactions.

Custom behavior can be extended via Go plugins. Captured interactions—such as commands and HTTP requests—are emitted as evidence and can be sent to local logs, RabbitMQ, or the Beelzebub Platform. The system also exposes Prometheus metrics for runtime monitoring.

Who it’s for

Security teams and analysts who need to monitor for unauthorized activity and gather forensic evidence from attackers through controlled, deceptive environments.

Highlights

  • Adaptive Responses: Uses LLMs to sustain realistic interactions with attackers beyond fixed command sets.
  • Broad Protocol Support: Covers SSH, HTTP, TCP, TELNET, and MCP.
  • AI Agent Bait: Includes MCP decoys that expose bait tools to observe suspicious invocations and prompt-injection attempts during agent testing.
  • Extensible Architecture: Supports trusted Go plugins for custom runtime behavior.
  • Flexible Deployment: Can be deployed via local Go binary, Docker Compose, or Kubernetes with Helm.

Related

  • Project
    liu00222/Open-Prompt-Injection

    An open-source toolkit for implementing and evaluating prompt injection attacks and defenses, featuring specialized tools for detecting and localizing malicious prompts.

  • Project
    confident-ai/deepteam

    DeepTeam is an open-source LLM red teaming framework that simulates adversarial attacks like jailbreaking and prompt injection to uncover vulnerabilities such as bias, data leakage, and SQL injection in AI agents, RAG pipelines, and chatbots. It runs locally, offers 50+ pre-built vulnerabilities, 20+ attack methods, and production guardrails.

  • Project
    prompt-security/ps-fuzz

    An open-source tool for hardening GenAI applications by simulating dynamic LLM-based attacks to test and refine system prompt security.

  • Project
    mlflow/mlflow

    MLflow is an Apache‑2.0‑licensed open‑source platform for managing the full lifecycle of machine‑learning and generative‑AI projects. It provides experiment tracking, model registry, deployment tools, and a new GenAI stack (tracing, evaluation, prompt registry, optimization, and an AI gateway) with integrations for dozens of LLM providers and agent frameworks.

  • Project
    canwhite/AgentEval

    A transparent HTTP proxy that captures Agent-LLM traffic to provide automated grading, behavioral diagnosis, and source-code probing for AI agent evaluation.