Documentation

Build with CanaryVaults

A deception-based security platform for AI systems. Plant believable tripwires across your stack — decoy identities, trap facts, honeypots, a prompt-injection firewall, and tamper-evident audit trails. When an attacker touches one, you get the alert, and the record it came from carries a content hash you can re-verify.

Quickstart →API reference

Surfaces

Six surfaces, four of them evidenced

CanaryVaults tripwires, CanaryHoneypot hits and CanaryAudit records land in the hash-sealed evidence log, and CanaryAgent timelines read from it. CanaryRAG and CanaryShield do not write to it: trap-fact triggers and blocked prompts live in their own tables, with no content hash and nothing for the public verifier to resolve. If you need an evidenced record of a Shield block today, write it yourself through CanaryAudit.

01CanaryVaultsDecoy email identities minted per protected email and seeded where credentials leak.open →02CanaryRAGTrap facts that catch AI knowledge bases leaking your content.open →03CanaryShieldA three-layer prompt-injection firewall for your model.open →04CanaryHoneypotDecoy assistants that fingerprint and classify attackers.open →05CanaryAuditTamper-evident, hash-sealed record of agent actions. Starts on Shield.open →06CanaryAgentHeartbeats and skill scans for your OpenClaw agents.open →

Reference

Look things up

API referenceAuthentication, evidence export, plan limits, errors and rate limits.open →Alerts & webhooksTelegram, email, Slack, Discord and HMAC-signed webhooks, with the payload shape.open →Enterprise & teamsOrganizations, seats, SAML configuration, and the audit-log CSV export.open →