Skip to main content

​
Install

Sundew is now running on http://localhost:8080 with a randomly generated persona.

​
Explore what’s running

Open a second terminal and see what AI agents would discover: 
# AI plugin manifest
curl http://localhost:8080/.well-known/ai-plugin.json

# OpenAPI spec
curl http://localhost:8080/openapi.json

# Hit a persona-generated endpoint
curl http://localhost:8080/api/v2/transactions
Every response is shaped by the persona. A different deployment would have completely different endpoints, company names, and data.

​
Query captured sessions

After traffic has flowed through: 
# See the most recent session
sundew query --last-session

# Filter for AI agent traffic
sundew query --type ai_agent --last 24h

# Quick stats
sundew stats

​
Use with Claude (MCP)

Add Sundew as an MCP server to query your honeypot data directly from Claude: 
{
  "mcpServers": {
    "sundew": {
      "command": "sundew",
      "args": ["mcp-client"]
    }
  }
}

​
Next steps

How it works

Understand the full architecture

Configuration

Customize traps, LLM, and storage

Custom personas

Build industry-specific personas

Deployment

Production deployment with Docker