Quickstart

Install

Docker (recommended)
pip
From source

docker run -p 8080:8080 karpie28/sundew

Pulls the latest image from Docker Hub and starts Sundew with a randomly generated persona.

pip install sundewsh
sundew serve

git clone https://github.com/sundew-sh/sundew.git
cd sundew && make run

Sundew is now running on http://localhost:8080 with a randomly generated persona.

Explore what’s running

Open a second terminal and see what AI agents would discover:

# AI plugin manifest
curl http://localhost:8080/.well-known/ai-plugin.json

# OpenAPI spec
curl http://localhost:8080/openapi.json

# Hit a persona-generated endpoint
curl http://localhost:8080/api/v2/transactions

Every response is shaped by the persona. A different deployment would have completely different endpoints, company names, and data.

Query captured sessions

After traffic has flowed through:

# See the most recent session
sundew query --last-session

# Filter for AI agent traffic
sundew query --type ai_agent --last 24h

# Quick stats
sundew stats

Use with Claude (MCP)

Add Sundew as an MCP server to query your honeypot data directly from Claude:

{
  "mcpServers": {
    "sundew": {
      "command": "sundew",
      "args": ["mcp-client"]
    }
  }
}

Next steps

How it works

Understand the full architecture

Configuration

Customize traps, LLM, and storage

Custom personas

Build industry-specific personas

Deployment

Production deployment with Docker

Getting started

Concepts

Guides

Security

Install

Explore what’s running

Query captured sessions

Use with Claude (MCP)

Next steps

How it works

Configuration

Custom personas

Deployment

​Install

​Explore what’s running

​Query captured sessions

​Use with Claude (MCP)

​Next steps

How it works

Configuration

Custom personas

Deployment

Install

Explore what’s running

Query captured sessions

Use with Claude (MCP)

Next steps