Tcotl / AgentCapture

What it does

• High-fidelity interactive SSH honeypot. a real paramiko protocol stack presenting a fake Ubuntu host (≈40 emulated commands + deceptive filesystem); any password logs in; exec, SFTP, and interactive shells are all transcribed per command wi
• Session-watermarked decoy credentials. watermarked secrets embedded in the fake host (Bk2026!) trace any reuse back to the exact honeypot session.
• Five-tier risk decisions that actually fire. allow / observe / JS challenge / persistent isolation / block are all enforced; the isolation list is viewable, extendable, and revocable from the admin console.
• Non-disruptive internet-system onboarding. add a deception layer to existing services through reverse proxies, route mapping, static file drops, and frontend injection — no business-code changes.
• Three-decoy closed loop. route, file, and credential decoys operate alone or bind into a complete attack chain, with one-click default-chain generation.