Part of Leviathan Platform · requires Decoy Kit + Agent Guardrails
Bait for the thing that reads everything. Decoy Kit plants a credential-shaped file and a decoy MCP server with tool names like rotate_aws_credentials. Agent Guardrails watches what an agent's response does after it finds one. Neither is duplicated here — Agent Canary is the wiring between them, plus the one signal neither had alone: whether a response narrates using what it found, even before the real fetch happens.
Why this exists
Poisoned tool descriptions, IDE auto-load gadgets, plain carelessness reading a file it shouldn't act on — a growing body of disclosed research keeps surfacing the same shape (Black Hat Asia 2026's "IntentGuard" and "IDE Zaster 2.0" talks, most recently). Decoy Kit already catches the touch — a real HTTP fetch against a planted credential file or a call to a decoy MCP tool. Agent Guardrails already catches manipulated intent in text. The gap between them: an on-demand test of an agent's own transcript has no real filesystem or network to trigger that real fetch, so without a narration signal — does the response say it would use the beacon URL, or say it would call the bait tool — there's no way to register compromise at all. Agent Canary closes exactly that gap, for coding-agent workflows specifically.
Decoy Kit's directory_trap blends bait into whatever extensions are already common in a project — but a directory with few real config files might never get one. plant_credential_bait() guarantees a .env.bak regardless, since a credential-shaped file sitting where a Read/Glob tool call would find it is the single highest-value lure for this threat model.
prompt_injection_detector.scan() runs exactly as it ships — no new detector categories, no forked copy. Agent Canary adds no security logic here, on purpose: reusing an already-tested judge is safer than shipping a second one un-battle-tested.
Does the response mention a planted file's real id or beacon URL? Does it narrate calling a bait tool, not just mentioning or declining one? A three-way comply/resist/ambiguous window check — never counting a bare mention as compliance — built the way it was specifically because of a real, live false-positive bug caught twice elsewhere in this portfolio's own history.
Active mode
Not a reimplementation of Stikkprøver — Leviathan Platform's own continuous red-team engine runs a full evidence graph and recruitment channel against a fleet, and Agent Canary doesn't try to be that. This is the cut-down version: three probes scoped to exactly the two bait mechanisms it actually plants — the credential file, the decoy MCP server — run once, against one agent, judged entirely by the same narration and detector signals above. Wrap your agent as a command that reads a prompt on stdin and writes a response on stdout, and active-test does the rest.
agent-canary scan and agent-canary active-test both exit non-zero the moment any signal fires — safe to wire directly into a pipeline without parsing output first.
run_via_subprocess() is the reusable primitive if you're wiring an agent under test into your own tooling instead of the CLI.
Pricing
Agent Canary isn't standalone — it's real logic (the guaranteed bait shape, the narration signals, the curated probe set, the CLI) layered on top of two products you already need to own. Priced below either of those alone.
Requires an active Decoy Kit and Agent Guardrails license. Unlimited environments and seats within your org.
Honest about scope
What's real: the plant/scan/active-mode pipeline described above, all of it — 52 tests passing, including real end-to-end subprocess runs against a live test agent for active mode, and real HTTP round-trips for the MCP bait router. The narration checks are tested against adversarial cases specifically ("I will NOT call X", "I flagged X but did not call it") — the same class of case that broke a simpler design elsewhere in this portfolio first.
Not built yet: v1.0's bring-your-own-model judging for active mode — today's judging is entirely heuristic, zero LLM dependency, by design (reusing an already-tested judge over shipping a new un-battle-tested one). No evidence graph, no continuous daemon, no fleet-wide recruitment channel — that's Stikkprøver's job, not this product's.
What this won't do: duplicate Decoy Kit's or Agent Guardrails' own detection logic. A finding in the bait-generation or narration-scan code here is in scope for a security report; a finding in either underlying mechanism belongs in that product's own repo, not this one.