Beelzebub ChatGPT Honeypot
FreeA secure low code deception runtime framework, leveraging AI for System Virtualization.
FreeFree tier
About Beelzebub ChatGPT Honeypot
Beelzebub is an open-source deception runtime framework that deploys adaptive, LLM-powered decoy services across SSH, HTTP, TCP, TELNET, and MCP protocols. It goes beyond passive honeypots by actively engaging attackers in realistic interactions, collecting high-fidelity threat intelligence, and detecting prompt injection attacks against AI agents. The framework uses YAML-based low-code service definitions, supports multiple LLM backends (OpenAI, Ollama), and offers full observability through Prometheus metrics and RabbitMQ event streaming. It is production-ready with Docker and Kubernetes (Helm) deployment options.
Key Features
Adaptive deception engine with LLM integration (OpenAI, Ollama) for contextually accurate real-time responses
Low-code YAML-based service definition with regex command matching – no custom code required
Multi-protocol coverage: SSH, HTTP, TCP, TELNET, MCP – from infrastructure targets to AI agent attack surfaces
Extensible plugin system via CommandPlugin and HTTPPlugin interfaces
Full observability stack with Prometheus metrics and RabbitMQ event streaming
Production-ready runtime including Docker, Kubernetes (Helm), graceful shutdown, and per-service memory limits
Pros & Cons
Pros
- Open-source and free to use
- LLM-powered realistic interactions keep attackers engaged longer
- Supports multiple protocols from SSH to MCP
- Low-code YAML configuration makes it easy to define new decoy services
- Extensible plugin system allows custom behaviors without modifying core
- Full observability integrated with Prometheus and RabbitMQ
- Production-ready with Docker and Kubernetes support
Cons
- Requires technical expertise to configure and deploy effectively
- Depends on external LLM services (OpenAI or Ollama) for adaptive responses
- Limited to the five supported protocols (SSH, HTTP, TCP, TELNET, MCP)
- Honeypot detection sophistication may vary depending on configuration
Best For
Deploying adaptive honeypots to engage attackers and collect TTPsGathering high-fidelity threat intelligence from decoy interactionsDetecting prompt injection attacks against AI agentsSecurity research and testing of attack techniques across multiple protocolsMonitoring AI agent attack surfaces with MCP protocol decoys
FAQ
What protocols does Beelzebub support?
Beelzebub supports SSH, HTTP, TCP, TELNET, and MCP protocols for deploying decoy services.
Is Beelzebub open-source?
Yes, Beelzebub is open-source and available under the MIT license on GitHub.
How does the LLM integration work?
Beelzebub integrates with OpenAI and Ollama to generate contextually accurate responses in real time, keeping attackers engaged.
Can I deploy Beelzebub on Kubernetes?
Yes, Beelzebub provides a Helm chart for deployment on Kubernetes.