Integrates with Amazon services to support the HoneyHome AI security analyst: Amazon Bedrock generates incident reports and activity summaries, Amazon Polly provides natural voice output, and Amazon SNS sends high-severity text alerts. It also exposes MCP tools for Alexa+ voice interaction, letting users ask about network activity, verify evidence integrity, generate reports, and check honeypot status.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@HoneyHome what's happening on my network right now?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Leave a trap. Catch the hacker. A home network honeypot with an AI security analyst you talk to on Alexa+.
Track: Alexa+ (self-hosted MCP server) · Mini challenge: AWS Builder (Amazon Bedrock + Amazon Polly + Amazon SNS)
Big companies catch intruders with honeypots: fake, deliberately tempting devices that no real user would ever touch, so anyone who does is suspicious. HoneyHome brings that to the home, and puts an AI incident responder behind it that you talk to by voice.
It runs three decoys on your own network: a fake IP camera, a fake old router with a telnet login, and a fake file server. The moment anything connects, tries a login, or scans them, HoneyHome identifies the device, classifies the attack using the MITRE ATT&CK framework, seals the event in a tamper-evident hash chain, and alerts you through Alexa+ and a text message.
Related MCP server: Project Aegis
"Alexa, what's happening on my network?" - a spoken summary of recent activity.
"Alexa, is my evidence intact?" - verifies the forensic hash chain.
"Alexa, write me an incident report" - a full professional report.
"Alexa, HoneyHome status" - decoys armed, events and devices seen.
A high-severity event (like a default-password login) also speaks up on its own and sends a text via Amazon SNS.
graph LR
A[Alexa+] -->|Streamable HTTP| M[HoneyHome MCP server]
D[Dashboard website] -->|HTTP| M
HP[3 honeypot decoys] --> EV[Evidence hash chain]
M --> EV
M --> TH[Threat + ATT&CK engine]
M --> B[Amazon Bedrock report writer]
M --> P[Amazon Polly voice]
M --> S[Amazon SNS alerts]Honeypots (honeypots.py): real TCP listeners on high ports (8081, 2323, 8445), so no admin rights are needed. They record every connection, login attempt and request. Nothing real is ever exposed.
Threat engine (threats.py): detects brute force, factory-default logins, port scans and path traversal, and maps each to a MITRE ATT&CK technique ID.
Device fingerprinting (devices.py): identifies the maker from the MAC address and flags random/spoofed addresses.
Evidence chain (evidence.py): every event is a JSON line sealed with a SHA-256 hash of the record before it. Editing any old record breaks every later hash, which verify_chain() detects and pinpoints.
AI analyst (report.py): Amazon Bedrock writes incident reports and summaries like a SOC analyst. Without Bedrock, a clear template report is produced instead.
Voice (voices.py): Amazon Polly gives the analyst a natural voice; the dashboard falls back to a browser voice.
MCP server + dashboard (app.py): one process serves the Alexa+ tools, the live dashboard, and its API.
Tool | What it does |
| Decoys armed, events and devices seen, evidence intact |
| Spoken summary of recent activity |
| The latest events, newest first |
| Verify the tamper-evident hash chain |
| A full professional incident report |
| Give a device a friendly name for future alerts |
Needs Python 3.10+.
git clone <your-repo-url>
cd honeyhome
python -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -r requirements.txt
cp .env.example .env # Windows: copy .env.example .env
python doctor.py # checks everything and tells you how to fix issues
python app.pyThe MCP endpoint for Alexa+ is at /mcp.
No AWS? Set DEMO_MODE=1 in .env. Everything runs, with template reports and a browser voice.
With AWS? Run aws configure, enable your Bedrock model (Model access, same region as AWS_REGION), set DEMO_MODE=0. Polly and SNS use the same credentials.
Dashboard: click Launch a test attack. It really connects to the honeypot ports, so every event is genuine. The feed, ATT&CK tags and evidence chain update live, and the analyst speaks the serious ones.
A real attack (great for the video): open http://localhost:8081 in a browser and type admin / admin, or run python demo_attack.py from another terminal.
MCP test: python test_mcp.py connects like Alexa+ would.
docs/index.html is a single file: a cinematic WebGL landing page (hand-written shader, hairline canvas overlay, one scroll-driven animation loop, no animation libraries) plus the live dashboard. Hosted on GitHub Pages it runs a self-contained demo; served by app.py it drives the real honeypots; opened on claude.ai it uses Claude to write live reports.
To host on GitHub Pages: repo Settings > Pages, source Deploy from a branch, branch main, folder /docs.
Run python doctor.py first. Common things:
Problem | Fix |
| Activate the venv, then |
| Old tutorial; this uses MCP SDK v2 ( |
A honeypot port won't bind | Something else uses 8081/2323/8445. Close it, or change the ports in |
Dashboard says "template mode" | No AWS/Bedrock. Run |
No voice / robotic voice | Use Microsoft Edge for natural browser voices, or set up Polly |
Text alert not arriving | New AWS accounts are in the SNS sandbox; verify the number in the SNS console |
MCP client can't connect via tunnel | Put the tunnel host in |
HoneyHome only listens on your own machine and only records what connects to its own decoys. The decoys hold nothing real and expose no way in. Run it on a network you own.
All code here was written from scratch during the submission period.
MIT, see LICENSE.
This server cannot be deployed
Research honeypot. Logs connections and tool arguments; injects instructions. Read README first.
Security intelligence for AI agents. 27 x402 endpoints: honeypot, forensics, CAPTCHA, preflight.
Real-time CVE, exploit, and vulnerability intelligence for AI assistants (350K+ CVEs, 115K+ PoCs)
Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.
