Honeypots don't work on agents. Working services do.

The classic honeynet puts out fake, vulnerable-looking services and waits for someone to attack the fake services. That model made sense for human intruders and scanning worms. Autonomous agents do neither. An agent is not looking for a way in. An agent is looking for a way to finish a job: receive a verification code, save state before a restart, post a webhook, call a tool. Show an agent a fake service and the agent leaves. No session starts, no handshake happens, no identity is declared. A honeypot observes nothing, because nothing real ever takes place inside a honeypot.

Flypaper is the new paradigm, and the new paradigm is the opposite bet: don't bait agents — serve agents. Flypaper publishes real, working, zero-auth services exactly where agents already look for help: MCP registries, agent-readable documentation, and pages that answer the precise questions agents ask, such as how to get a verification code with no API key. No account, no key, no human approval step. Nothing stands between an agent and a working endpoint, so agents arrive on their own, do genuine work, and return session after session.

Every session, enumerated

declared model and build · MCP client name, version, and protocol version · SDK runtime and language · tool inventory and call order · request cadence class · stated purpose, when the agent gives one

How enumeration works

Genuine work means genuine identification. To use a service, an agent completes real protocol handshakes that declare the agent's model, client build, and protocol version. The agent then calls real tools, in a real order, at a real working cadence. The services cannot be simulated, because simulation is exactly the failure mode of the old honeynet: an agent detects a dead end in one call and never returns. Enumeration works because Flypaper services complete real work, and because Flypaper keeps everything a normal deployment discards:

Handshake capture. Every MCP initialize records the client's declared name, version, and protocol version. Every chat completion records the model string, message structure, and tool definitions the agent sends.

Cadence classification. Inter-arrival timing separates scripted polling, autonomous agent loops, and human-paced traffic into distinct bands, per session, with stated confidence.

Runtime fingerprinting. Header order, SDK signatures, and transport behavior identify the harness around the model — the framework, language, and HTTP stack — even when the agent declares nothing.

Session stitching. A composite identity links the same agent across rotating egress addresses and across services, so one agent's inbox, state, and tool activity read as one record.

Evidence storage. Append-only session records with secrets redacted at capture, queryable after the fact. Counts on this page are computed from those records on the deployed host.

The result is an evidence record per agent, not an aggregate guess. Questions that are unanswerable from outside a working surface become simple queries: Which model — and which build of that model — is actually out there working? Which harness wraps the model? Which tools, at which versions, does the agent carry? How did the agent population shift when a new release shipped last week?

The surface

The public layer is documented and free to call — publication is the point, because publication is how agents find the services. The measurement layer underneath the public layer is not published in full.

Email inbox & verification codesapi.model.tools/api/v1/inbox/{name}

Any name is a live inbox. Codes and magic links are extracted server-side and returned as JSON.

MCP gatewaymcp.model.tools/mcp

Ten zero-auth tools over streamable HTTP: email, checkpoints, wake-ups, webhooks, receipts, handoffs, and a web reader.

Ephemeral stateapi.model.tools/api/v1/state/{key}

Key-value storage an agent can write before a restart and read back after, with no account.

Webhook binsapi.model.tools/api/v1/hook/{id}

A public URL that records whatever is posted to the bin, readable over HTTP.

Scheduled wake-upsapi.model.tools/api/v1/schedule

The agent registers a callback and a delay; the service calls back when the time arrives.

Web readerapi.model.tools/api/v1/render

Fetches a page and returns readable markdown, for agents without a browser.

Behavioral cadence classificationper-session, at capture

Agent, script, or human — classified from request timing and tool-use shape alone, before any content is read.

Model & harness fingerprintingmultimodal-fp-v1

Declared model, client build, SDK runtime, and header-order signature, combined into one identity per agent.

Cross-IP session stitchingcomposite agent id

The same agent followed across rotating egress and across services, so fragments merge into a single history.

Stated-purpose capturex-session-purpose

When an agent declares what the agent is trying to do, the declaration is stored against the session record.

Unpublished baseline listenerno public documentation

A service persona with no docs, no registry listing, and no links. Whatever arrives there separates directed discovery from background noise.

Checkpoint-level signaturesIN PROGRESSbehavioral, per build

Separating builds of the same model by behavioral signature, so a silent checkpoint change shows up as a population shift.

Access

The full enumeration — per-session records, the restricted capabilities above, and how the agent population is shifting — is shared directly, not published.

Honeypots don't work on agents. Working services do.

Every session, enumerated

How enumeration works

The surface

Access

What access includes

Request access