Honeypot legality
Operating a honeypot on infrastructure you own or are authorized to operate is legal in most jurisdictions.- United States: No federal law prohibits operating honeypots on your own systems. The CFAA (18 U.S.C. 1030) applies to unauthorized access to protected computers -a honeypot you operate is not a protected computer in this context.
- European Union: GDPR applies to logged IP addresses (personal data). Operators must have a legitimate interest basis (Article 6(1)(f)) and should document this in a Data Protection Impact Assessment (DPIA).
- General principle: Do not deploy Sundew on networks you do not own or are not authorized to monitor.
MCP server registration
Sundew can register as a discoverable MCP server. This is intentional and ethical:- MCP is an open protocol. Registering a server is analogous to publishing a web page.
- Sundew presents as a fictional company/API -it does not impersonate a specific real service.
- The purpose is detection and research, not disruption of agent operations.
- Agents interacting with Sundew are not harmed -they receive fake data that is non-functional in any real context.
Canary tokens: not entrapment
Canary tokens are markers, not inducements:- Entrapment (in US law) requires a government actor inducing someone to commit a crime they were not predisposed to commit.
- Sundew is not a law enforcement tool. It is a research and detection tool operated by private entities.
- Canary tokens do not induce any action. They are passive data that becomes meaningful only when an agent exfiltrates and attempts to use them.
- All canary values are verifiably fake and cannot cause harm if used.
Publishing captured data
Sundew supports academic research on AI agent behavior. When publishing collected data:
Use the built-in anonymization: