HoneyHome

Inspiration

Companies catch intruders with honeypots: fake, deliberately tempting devices that no real user would ever touch, so anyone who does gives themselves away. Behind them sits a Security Operations Centre of analysts. Ordinary homes, now full of insecure smart devices, get none of this. I wanted to bring that enterprise defence pattern home and make it something you can simply talk to.

What it does

HoneyHome plants three decoys on your home Wi-Fi: a fake IP camera, a fake old router with a telnet login, and a fake file server. The moment anything connects, tries a login, or scans them, HoneyHome acts as your analyst: it identifies the device, classifies the attack using MITRE ATT&CK, seals the event in a tamper-evident hash chain, and alerts you on Alexa+ and by text.

Ask Alexa+:

• "What's happening on my network?" — a spoken summary
• "Is my evidence intact?" — verifies the forensic hash chain
• "Write me an incident report" — a full professional report

How I built it

A self-hosted MCP server exposes six tools to Alexa+ over Streamable HTTP. The honeypots are real asyncio TCP listeners. A threat engine detects brute force, default logins, port scans and path traversal, each mapped to a MITRE ATT&CK ID. Every event is sealed with a SHA-256 hash of the record before it, so editing one old record breaks every later hash. Amazon Bedrock writes the reports, Amazon Polly gives the analyst a voice, and Amazon SNS sends alerts. The dashboard is a hand-written WebGL page with no animation libraries.

Challenges

The MCP Python SDK moved from v1 to v2 (FastMCP became MCPServer, and startup hooks changed), so most tutorials were out of date. Running the honeypot listeners alongside the MCP server meant wiring them into the app's lifespan context.

What I learned

How to expose a real security tool to a voice assistant through MCP, how to design a tamper-evident evidence chain, and how to orchestrate Bedrock, Polly and SNS behind one server.

What's next

More decoy types, automatic blocking of repeat attackers on the router, and a shared threat feed across homes.

Built With

• amazon-alexa
• amazon-bedrock
• amazon-polly
• amazon-sns
• amazon-web-services
• asyncio
• honeypot
• mcp
• mitre-attack
• python
• webgl