Excalibur

Active-defense deception middleware for SaaS APIs.

The last line of defense. Even if the host application is breached, Excalibur takes over: the attacker thinks they succeeded — they exfiltrate booby-trapped fake data and get traced back to the source.

Excalibur sits in front of an API. When an attacker probes it, Excalibur detects the suspicious pattern, silently switches the session into a decoy lane, serves plausible fake data seeded with canary tokens, and logs the full behaviour for forensics. The attacker wastes time on poisoned data — and the canaries call home, geolocating them.

Free and open source (AGPL-3.0). Excalibur is developed in the open and welcomes contributions, improvements and ideas — as well as donations to support the work. See Contributing and Support the project below.

from excalibur import protect
app = protect(app)          # one line

How it works

A session flows through three states, driven by a scoring engine:

• PASS — normal traffic, forwarded untouched.
• CANARY — suspicious (abnormal volume, off-hours, known offensive tooling / JA3): real responses, but seeded with tracking canaries.
• DECEIVE — confirmed hostile: the API is fully replaced by synthetic, booby-trapped data. Every time the attacker opens the loot, a canary fires.

Repository layout

excalibur/            The platform
  sdk/                One-line middleware (Rust core + Python/Node bindings)
  control_plane/      ML scorer + PASS/CANARY/DECEIVE switch
  deception/          Synthetic data generation (LLM) + canary injection
  tracer/             Attribution, forensic Merkle log, STIX export
  dashboard/          Real-time SOC interface
  honeypot/           Decoy endpoints
  infra/              Docker + Kubernetes + Terraform
  docs/               Architecture blueprint + implementation plan

excalibur-demo/       End-to-end, runnable demo ("ANTS" national-ID API storyline)

Status

Prototype — architecture validated. The platform is a working skeleton; the excalibur-demo/ is a polished, runnable end-to-end demonstration (attacker vs. shield, live scoring, canary geolocation) suitable for a walkthrough. This is not yet a hardened production release.

Try the demo

The demo wraps a mock national-ID API and runs a scripted attack against it, showing the session escalate PASS → CANARY → DECEIVE in real time on the dashboard.

cd excalibur-demo
cp ../excalibur/infra/docker/.env.example ../excalibur/infra/docker/.env   # fill it in
./run_demo.sh up          # boots Excalibur + the protected mock API
#   open the dashboard at http://127.0.0.1:8002
./run_demo.sh attack      # runs the simulated attack
./run_demo.sh down

Synthetic data can be generated by a local GGUF model (llama.cpp) or the Anthropic API — configured in excalibur/infra/docker/.env (see .env.example). No PII ever leaves the box; forensic events carry metadata only (GDPR by design).

Security & configuration

• No secrets in the repo. All keys live in infra/docker/.env (gitignored). Use .env.example as the template; the Kubernetes secret.yaml ships placeholders only.
• Excalibur is a defensive tool: deception, attribution and forensics against attackers hitting your own API. The included "attacker" is a simulation for the demo.
• The canary tracking domains in .env should look like legitimate CDN/infra hostnames in production — see the comments in .env.example.

Contributing

Excalibur is open to pull requests, ideas and improvements — the Rust SDK, the scorer, new deception strategies, connectors (Slack/TheHive/PagerDuty), docs. See CONTRIBUTING.md. Open an issue first for anything large.

Support the project

Excalibur is free and open source, and stays that way. If it is useful to you — or if you would simply like to support its development — you can donate via GitHub Sponsors. Sponsorship funds new deception strategies, hardening of the Rust SDK, and continued maintenance. Contributions of code, ideas and feedback are just as valuable — see Contributing.

License

Excalibur is licensed under the GNU Affero General Public License v3.0 — see LICENSE. In short: you are free to use, study, modify and self-host it, but if you run a modified version as a network service you must publish your source under the same license. Created and maintained by Léo Camus / NextGen Labs.