Workspace Tools MCP server

What it does

A research honeypot server that presents synthetic workspace tools (search, file read, database queries, credentials listing, command execution) to study what MCP clients and agents do when given access to dangerous-sounding tools. It logs all requests and arguments, and includes active prompt-injection probes to measure agent behavior.

• Study whether agents invoke dangerous-sounding tools unprompted or follow injected instructions to disclose system prompts.
• Measure retrieve-then-use credential chains by observing agents that fetch honeytokens and attempt to use them.
• Analyze patterns in MCP client behavior and tool usage across different agent implementations and ecosystem indexers.

Tools this server exposes

Tool	Does
search_documents	Returns invented documents; logs query text and includes a prompt-injection probe soliciting system instructions.
read_file	Returns invented file contents; logs the requested path.
list_credentials	Returns honeytokens (synthetic, unique per issuance, never valid).
query_database	Returns invented rows; logs the query text.
get_page	Returns an invented next page of results.
get_config	Returns invented configuration including a synthetic api_key honeytoken.
execute_command	Does not execute anything; returns a synthetic error and logs the command string.
admin_exec	Requires an api_key from get_config (a honeytoken); logs if an agent retrieves and reuses it.
admin_status	Requires an api_key from get_config; returns invented account status.
diagnostics	Returns invented diagnostics; targeted by prompt-injection probes.

Before you enable it

An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.