Skip to main content

​
CLI Reference

Deadfall detects AI agent compromise by exploiting their instruction-following behavior. When an AI agent reads a trapped file, it encounters instructions to call a verification tool — which triggers an alert.

​
Installation

go install github.com/dotsetlabs/deadfall/cmd/deadfall@latest

​
Commands

CommandDescription
initInitialize Deadfall in current project
trapCreate trap files or inject traps into existing files
statusList all registered traps
serveStart the Honey-MCP server
versionPrint version information

​
Global Options

deadfall --version    # Show version
deadfall --help       # Show help
deadfall -v           # Verbose output
deadfall --json       # JSON output format
deadfall --config     # Custom config file path

​
Quick Examples

# Initialize Deadfall in your project
deadfall init

# Create a trap in a context file
deadfall trap context CONTEXT.md

# Create AI-specific trap files
deadfall trap cursor-rules          # Creates .cursorrules
deadfall trap claude-context        # Creates CLAUDE.md
deadfall trap mcp-config            # Creates mcp.json

# Check status of all traps
deadfall status

# Start the Honey-MCP server
deadfall serve

​
Trap Types

Deadfall supports two categories of trap types:

​
Generic Types (Inject into Existing Files)

TypeDefault PathDescription
contextCONTEXT.mdContext/instruction files (Markdown, text)
codemain.goSource code files
env.env.exampleEnvironment files

​
AI-Specific Types (Generate Complete Files)

TypeDefault PathTarget AI
cursor-rules.cursorrulesCursor AI
claude-contextCLAUDE.mdClaude Code
copilot-instructions.github/copilot-instructions.mdGitHub Copilot
mcp-configmcp.jsonMCP clients