wisp – a single static-binary honeypot with cloud/container/LLM decoys (a modern take on OpenCanary)

A honeypot is only useful if it's actually running, and I kept watching them die at the dependency install. OpenCanary proved the model and is still the more battle-tested tool, but it needs Python 3.10+, Twisted, Scapy, and — for SMB — a full Samba install with a full_audit module tailing syslog.

So I rebuilt it as one static Go binary. ./wispd and it's running, no root, no runtime:

• All 21 of OpenCanary's protocol modules, reimplemented.
• 9 decoys it doesn't have for the modern surface: k8s, kubelet, docker, imds (cloud metadata), elasticsearch, jenkins, gitlab, ollama, mcp — capturing stolen service-account tokens, the container spec an attacker tries to run (Privileged: true, host mounts), the prompts sent to a fake GPU, and so on.
• Native SMB — NetNTLMv2 hashes (hashcat 5600), no Samba.
• A self-hosted fleet console (scriptless UI, per-sensor tokens, dedup) and honeytokens (DNS/HTTP/docx/kubeconfig/MCP).

It's pre-1.0 and younger than OpenCanary — the README keeps an honest comparison table, not a marketing one. Reach for it when the Python/Samba chain is what's stopping you deploying a honeypot at all, or when you want the cloud/container/LLM decoys.

Repo + a short demo video: https://github.com/willysnow/wisp

Happy to answer questions — and I'd genuinely like to hear which decoys are missing.