beelzebub-labs/beelzebub

Health v2 · maintenance only

Adoption not part of the score

2165 stars · 206 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Beelzebub is an open-source deception runtime framework written in Go that deploys adaptive, LLM-powered honeypot decoy services across SSH, HTTP, TCP, TELNET, and MCP protocols. It engages attackers in realistic interactions to collect threat intelligence and detect prompt injection attacks against AI agents, with YAML-based configuration and a plugin system.

Use cases

• deploy an SSH honeypot to detect brute-force attacks
• run an LLM-powered honeypot that simulates a realistic Linux terminal
• detect prompt injection attacks against AI agents and MCP servers
• collect threat intelligence from attackers in a Kubernetes cluster
• set up low-code deception decoys across HTTP, TCP, and TELNET protocols
• monitor honeypot events with Prometheus metrics and RabbitMQ
• simulate vulnerable services to study attacker behavior

When to choose

• you want a low-code, YAML-configured honeypot framework with multi-protocol support
• you need LLM-driven high-fidelity attacker interaction without a fully compromised system
• you want to secure Kubernetes environments against lateral movement with deception
• you need to detect and study prompt injection attacks on AI infrastructure

When to avoid

• you need a production firewall, IDS, or endpoint protection rather than deception technology
• you cannot expose decoy services on your network or lack the resources to monitor them
• you want a fully high-interaction honeypot with real OS virtualization
• you require a license more permissive than GPL-3.0

Facets

framework · maturity active

security monitoring logging plugin-system llm-inference mcp security artificial-intelligence large-language-models self-hosted cloud-computing go self-hosted cloud honeypot deception-technology threat-intelligence prompt-injection-detection decoy-services ssh-honeypot http-honeypot mcp-honeypot llm-security yaml-configuration prometheus-metrics rabbitmq linux docker kubernetes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="beelzebub-labs/beelzebub")