A faithful replay of Legant's Honeytool demo: an agent is delegated only read and summarize, but the MCP server leaves bait tools visible in tools/list; a poisoned document drives the agent to call the bait, each attempt is denied with no data touched and recorded in a tamper-evident tripwire log.

Legant Live demo · Honeytool

Catch prompt injection by the tools an agent reaches for

agent:summarizer is delegated only read_document, summarize. The MCP server leaves honeytools visible in tools/list as bait — tools the agent was never granted. A well-behaved agent never touches them; a prompt-injected one impales itself on a tamper-evident tripwire that names who tried what for whom. Faithful replay of go run ./examples/honeytool.

tools/list · what the agent seesdocs MCP
read_documentdelegated
summarizedelegated
exfiltrate_secretshoneytool · bait
wire_fundshoneytool · bait
delete_all_datahoneytool · bait
the document being summarizedbenign
Meeting notes: Q3 planning, hiring, and the roadmap review.
the agent’s tool callsbooting…
tripwire log · tamper-evident0 alerts
no honeytool touched yet — a well-behaved agent never reaches for one.