AgentDecoy
What is in each plan, what it guards against, and how to install it
The threat scan is free and stays free. Pro watches one site every week. Agency does it for 25 with your name on the reports. Guard is the free install that puts the decoys on your own site and joins it to the network. Every site that joins makes every other site safer and smarter: an address that uses a stolen secret on one Guard site is refused on logins and forms across all of them within the hour. Everything on one page, nothing hidden.
| Feature | Free | Pro $12 a month, 1 site | Agency $99 a month, 25 sites | Guard plugin free, with a free key |
|---|---|---|---|---|
| The threat scan | ||||
| Threat level and every way in: secret files, leaked keys, unguarded forms, missing headers, hidden agent text | ||||
| Platform named, numbered fix list with the exact place to change it | ||||
| Shareable result page, threat card and verified badge | ||||
| Re-scanned automatically | monthly alert only | weekly | weekly | monthly email |
| Email the day a new way in opens | ||||
| Every page scanned for hidden AI instructions (up to 30 a site) | home page only | |||
| Full findings: which file, which key, which page (after ownership proof) | ||||
| Sites covered | 1 at a time | 1 | 25 | any |
| Guard: the decoys | ||||
| Decoys on your site: fake .env, .git, AWS key, backup.zip, admin login, API docs, MCP server, hidden link | on ours, not yours | with the plugin | with the plugin | |
| Fake keys, webhook and admin password that report back when used | with the plugin | with the plugin | ||
| Verified search engines never see a decoy, never blocked | ||||
| Security headers and form bot guards set for you (WordPress) | with the plugin | with the plugin | ||
| Catches reported to your account | weekly report | weekly report | monthly email | |
| Email the day a stolen secret is used | ||||
| Every catch sorted: script, browser or AI agent, and how sure (confirmed by speed or a verified signature, likely, possible) | on our sites | |||
| How far each attacker got: looked, took a secret, used it, tried to take over | weekly report | weekly report | monthly email | |
| The network behind each attacker (cloud or not), and the abuse contact to report it | weekly report | weekly report | monthly email | |
| Attack strings flagged: SQL injection, path traversal, XSS, template and command injection | on our sites | |||
| Signed AI agents (Web Bot Auth) checked against their published keys, never treated as attackers | ||||
| Network intelligence: which attackers also hit other Guard sites, and since when | in reports | in reports | on the plugin page | |
| Shared protection: an address that uses a stolen secret on ANY Guard site is refused on your logins, sign-ups and forms within the hour (WordPress Guard mode, npm and Cloudflare blockKnown) | with Guard | with Guard | ||
| Watch list: attackers raiding several Guard sites, and rogue AI agents that ignore robots.txt, flagged in your report before they reach you | weekly report | weekly report | monthly email | |
| Early warning: the day one of your attackers is caught using stolen keys elsewhere | ||||
| Counted in the public Agent Attack Index | ||||
| Agencies and developers | ||||
| API key: 120 scans an hour, GitHub Action that fails a build at the threat level you set | ||||
| White-label client reports with your name, logo and prices; printable branded report | ||||
| Prospect finder: 100 sites at once, worst first | ||||
| Ask Kyle: tickets answered within a business day | ||||
Yearly plans are ten months for twelve: Pro $120, Agency $990. Every paid plan starts with 7 free days and is cancelled in one click from your account page; reports continue to the end of what you paid for.
What it guards against
Every item below is something the decoys have seen, not a hypothetical.
Secret files left public
Scanners ask every site for /.env, /.git/config and /.aws/credentials. On our sites one took the fake AWS key and tried to make itself admin within three hours. The scan finds the real ones; the decoys catch the people looking.
Stolen keys used from anywhere
A key copied today is tried from another machine tomorrow. The fake keys, webhook and admin password report back the moment they are used, and name the visit they were stolen on.
AI agents that read first and act second
Agents browse like people now. The note only AI reads, the fake API docs and the fake MCP server catch the ones that act on what they find, and the fake login tells a person, a script and an AI browser agent apart by how the form is filled.
Hidden instructions on your own pages
Text planted in a review or a widget can hijack the AI agents your visitors send to shop or book. The free scan checks the home page; Pro checks every page, every week.
Forms with no bot guard
Login and signup forms with nothing stopping a script get credential-stuffed and filled with spam. The plugin adds a hidden field and a fill-time check to WordPress forms.
And what it never does: it never blocks a visitor, never fights back, holds nothing real, and reads only what any visitor can see. Verified search engines get a plain 404 on decoy paths, so your search traffic is never harmed.
Install Guard
Cloudflare: Shopify, Wix, Squarespace, Webflow or any site behind it
One click on Deploy to Cloudflare, set your site and key, add a route for your domain. The Worker sits in front of your site and honours Cloudflare’s verified-bot list. Hosted builders without Cloudflare get the threat scan, badge and directory listing; the decoys need Cloudflare in front (its free plan is enough).
GitHubNext.js
npm install agentdecoy, then one middleware file at the project root and three environment variables.
GitHubEverything else
Any runtime with a fetch handler (Deno, Bun, Vercel and Netlify edge functions) uses the same core. For a stack not listed, email kyle@simgen.dev.
GitHubStart
Run the free scan first; it takes under a minute. Then pick a plan if you want it watched.
Free
$0
Check any site, protect your own.
The check
- What a hostile AI agent would find on your site: leaked keys and files, open forms, missing locks, hidden instructions
- A fix list for your platform, each with a do-it-for-you price
- Shareable threat card, link and badge
- An email once a month if a new way in opens
Guard, free
- Decoys on your site: WordPress, Cloudflare, Next.js, Express
- A dashboard of every catch: script, person or AI agent, how far it got, where it came from
- Attackers caught on any Guard site refused on your logins and forms
- Never touches Google or Bing
Pro
$12 per site a month
Everything in Free, watched for you every week.
Every Monday
- Re-scanned, with a report by email
- Every page scanned for hidden AI instructions, not just the home page
Alerts, the same day
- A new way in opens
- A stolen decoy key or password is used on your site
- One of your attackers is caught on another site
Answers
- Full findings: which file, which key, which page (after you confirm ownership)
- API key (120 checks an hour) and a GitHub Action
- Ask Kyle: tickets answered within one business day
Free for 7 days, then $12 a month. Cancel any time in PayPal.
Agency
$99 a month, up to 25 sites
Everything in Pro for 25 client sites, under your name.
Your clients
- One dashboard and one weekly report for every client site
- White-label client reports with your name, logo and prices, ready to print
- Fixes prepared for client sites; the client applies them in one click
- Access requests and fixes shown in your agency’s name
Your pipeline
- Prospect finder: scan 100 sites at once, worst first
- Every score and catch you can show a prospect
- Priority help
Free for 7 days, then $99 a month. Cancel any time in PayPal.
Prices in USD, billed by PayPal after the 7 free days. Questions: kyle@simgen.dev, or the chat in the corner, which is really me.
Partners: earn 20% for a year
Web agencies, SEO consultants, MSPs and hosts: send clients with your own link and earn 20% of what they pay for 12 months, by PayPal each month once it reaches $20. Every Pro and Agency customer also has a share link on their dashboard.