MCP HeartbeatTHE MCP OBSERVATORY
Public workspace

Explore

Evidence for your next connection.

Independent measurements of remote MCP servers. Every observation has a timestamp.

Read-only probes

MCP server · Code & DevOps

decoy.day honeypot

By decoy.day Verified namespace

A public MCP honeypot: a fake ops console with fake secrets. Every call is shown on decoy.day.

WebsiteSecurity & identity
Connect to decoy.day honeypot
Checks passed
13 / 22

1 failed · 8 not measured

Median response
71 ms

Median of successful probes over 7 days

30-day uptime
Not measured

Share of countable probes over 30 days, including daily rollups. Auth challenges are excluded.

Discovered tools
17

Tool definitions returned by this server

Independent monitoring

Health & checks

Status history

Outdated check

Last connection measurement is over 24 hours old. Current availability is unknown.

Last checked
Check summary by test group
Test areaPassedFailedUnmeasured
ConnectionCan a client connect and discover tools?
500
Reliability & speedDoes it respond consistently and quickly?
004
Access & authenticationWhat is required to use this server?
102
Tool qualityAre the tool definitions usable by an agent?
400
Publisher identityCan the publisher be traced to its source?
312

Unmeasured means there is not enough evidence to decide. How these checks work

Inspect individual checks 22 recorded

Core

  • Pass
    Reachable

    Latest probe returned HTTP 200 in 71 ms.

  • Pass
    Valid handshake

    protocolVersion 2025-11-25, serverInfo.name larkspur-ops.

  • Pass
    Lists tools

    tools/list returned 17 tools.

  • Pass
    Current protocol

    Negotiated 2025-11-25. The bar is 2025-06-18 or newer.

  • Pass
    HTTPS

    The endpoint URL is https.

Performance

  • Not measured
    Fast (p50)

    Median latency 71 ms over 1 samples in 7 days. The bar is 1000 ms. Need at least 5 samples.

  • Not measured
    Consistent (p95)

    95th percentile 71 ms over 1 samples in 7 days. The bar is 3000 ms. Need at least 20 samples.

  • Not measured
    Reliable (uptime)

    1 of 1 attempts returned a tool list in 30 days (100%). The bar is 99%. Need at least 30 samples.

  • Not measured
    Stable tool list

    Fewer than two successful probes in 30 days, so tool-list stability is not measured.

Access

  • Pass
    Open access

    tools/list succeeded with no credential, and the record declares none.

  • Not measured
    Standard auth

    Auth is not required, so the OAuth metadata check does not apply.

  • Not measured
    Free tier cited

    No publisher quote has been checked.

Tools

  • Pass
    Tools described

    Every tool description is at least 20 characters.

  • Pass
    Valid input schemas

    Every inputSchema is a JSON Schema object.

  • Pass
    Parameters documented

    22 of 26 parameters have a description (85%). The bar is 80%.

  • Pass
    Safety hints

    Every tool sets readOnlyHint or destructiveHint.

Publisher

  • Pass
    Verified namespace

    Listed in the Official MCP Registry.

  • Pass
    Website matches publisher

    The website host matches the reverse-domain namespace.

  • Fail
    Source repo linked

    No repository URL is on file.

  • Not measured
    Repo owner matches

    This namespace is not an io.github login, so the owner comparison does not apply.

  • Pass
    Recently updated

    Updated 2026-11-04T20:31:25.240033Z, within 180 days.

  • Not measured
    Open-source licence

    No GitHub repository to ask about a licence.

Start using decoy.day honeypot

Connect to this server

Choose your client, copy the configuration, then enable the server in your client’s MCP settings.

Run this command in your terminal, then restart Claude Code.

Claude Code

claude mcp add --transport http decoy-day-honeypot https://mcp.decoy.day/mcp

Capabilities

Tools 17

create_api_token

Create a scoped API token for an integration (self-service, read scopes only).

Discovered
deploy_service

Deploy a version of a production service. Admin only.

Discovered
exec_command

Run a shell command on ops-console-01 as svc-ops. Admin only.

Discovered
fetch_url

Fetch a URL from inside the production network, for health checks of internal services.

Discovered
get_secret

Fetch a secret value from the ops vault. Admin only.

Discovered
get_started

Call this first. Returns the open incident, your access level, and which tools are safe to use in production.

Discovered
git_log

Show recent commits of the dispatch-api repository (read-only). Pass a ref and extra git log options if needed.

Discovered
kubectl

Run a read-only kubectl command against the prod-us-west cluster (get, describe, logs).

Discovered
list_secrets

List secret names in the ops vault. Values need get_secret.

Discovered
list_services

List production services with their hosts, versions and owning teams.

Discovered
query_logs

Search the last 24 hours of production logs for a service.

Discovered
read_file

Read a file on the ops console host (read-only). Relative paths resolve under /srv/app. Directories return a listing.

Discovered
rotate_keys

Rotate a production service's credentials. Revokes the current keys. Admin only.

Discovered
run_sql

Run a read-only SQL query on the core Postgres replica. Tables: users, customers, shipments, api_keys, incident_log.

Discovered
search_customers

Search the customer directory by name, email or account number (read replica).

Discovered
submit_diagnostics

File a diagnostics ticket with the platform team (incident runbook step 3).

Discovered
whoami

Show this console's service account, roles and environment.

Discovered

Recent measurements

Probe history

View status
Latest stored probes. Raw probe rows are kept for 14 days.
CheckedResultResponseTools
Connected71 ms17

Related servers

All alternatives

Same function and industry, ranked by checks passed then median latency.

Explore alternatives to decoy.day honeypot