Beelzebub
Deception Runtime Framework
Beelzebub is an open-source deception runtime that deploys adaptive, LLM-powered decoy services across SSH, HTTP, TCP, TELNET, and MCP protocols. It goes beyond passive honeypots by actively engaging attackers in realistic interactions, collecting high-fidelity threat intelligence, and detecting prompt injection attacks against AI agents.
Table of Contents
- Key Features
- Quick Start
- CLI Reference
- Plugin System
- Observability
- Prometheus Metrics
- RabbitMQ Integration
- Testing
- Code Quality
- Contributing
- License
- Configuration Reference
- Core Configuration
- Service Configuration
- Deception Services
- MCP Deception Service
- HTTP Deception Service
- SSH Deception Service
- TELNET Deception Service
- TCP Deception Service
Key Features
- Adaptive deception engine: LLM integration (OpenAI, Ollama) generates contextually accurate responses in real time, keeping attackers engaged long enough to collect actionable TTPs
- Low-code service definition: YAML-based configuration with regex command matching — no custom code required to deploy a new decoy service
- Multi-protocol coverage: SSH, HTTP, TCP, TELNET, MCP from infrastructure targets to AI agent attack surfaces
- Extensible plugin system: Implement the
CommandPluginorHTTPPlugininterface and register viainit()no core changes required - Full observability stack: Prometheus metrics, RabbitMQ event streaming
- Production-ready runtime: Docker, Kubernetes (Helm), graceful shutdown, per-service memory limits
