629 Faq 0abb3060

## ❓ FAQ

### Can attackers detect the honeypots?

While it's theoretically possible for a sophisticated attacker to identify honeypots through careful analysis, it's **highly improbable** in practice:

- **Dynamic honeypots** are generated by LLM to match your server's domain and naming patterns, making them indistinguishable from legitimate tools
- **Tool descriptions** are crafted to appear as restricted/privileged versions of real functionality
- **No behavioral differences** - honeypots respond with realistic data, not errors or suspicious patterns
- **MCP protocol limitation** - AI agents cannot inspect tool implementation, only names and descriptions

Detection would require:
1. Prior knowledge of your specific tool catalog
2. Ability to distinguish between legitimate privileged tools and honeypots
3. Understanding that deception is being employed

For most attack scenarios (automated scanners, opportunistic attacks, indirect prompt injection), detection is effectively impossible.

### Will this slow down my MCP server?

No. HoneyMCP adds negligible overhead:
- **~1ms per tool call** for interception logic
- **Async event logging** doesn't block tool execution
- **Zero impact on legitimate tools** - they execute normally
- **LLM calls only at startup** for dynamic honeypot generation (cached for subsequent requests)

### What if I don't have LLM credentials?

HoneyMCP works perfectly without LLM access:
- Set `use_dynamic_tools=False` to use **static mode**
- Pre-configured generic honeypots work out-of-the-box
- No external dependencies or API calls required
- Slightly less convincing than dynamic honeypots, but still effective

### How do I know if I'm being attacked?

Multiple indicators:
- **Dashboard alerts** - Real-time visualization of attack events
- **Event logs** - JSON files in `~/.honeymcp/events/` with complete attack context
- **Webhook notifications** (optional) - Configure Slack/Discord alerts
- **Tool call sequences** - See exactly what the attacker tried before triggering honeypot

### Does this work with all MCP clients?

HoneyMCP is designed for **FastMCP servers** and works with any MCP-compatible client:
- ✅ Claude Desktop (stdio and HTTP transports)
- ✅ Custom MCP clients
- ✅ Any client following MCP protocol specification

The detection mechanism is client-agnostic - it operates at the server level.

### What's the difference between SCANNER and COGNITIVE modes?

**SCANNER mode (default):**
- Immediate lockout after honeypot trigger
- All subsequent tools return errors
- Best for automated attacks and quick containment

**COGNITIVE mode:**
- Sustained deception after honeypot trigger
- Real tools return synthetic/mock data
- Keeps attacker engaged for intelligence gathering
- Best for sophisticated attacks and red team exercises