OpenCanary
v0.9.10 open-sourceThe section your link pointed to isn't on OpenCanary's page any more, so we've brought you to the top.
OpenCanary is a multi-protocol network honeypot that alerts you when attackers breach non-public networks and interact with its services.
{
"mongo.enabled": true,
"mongo.port": 27017
}
Summary
OpenCanary is an open-source, free multi-protocol network honeypot daemon that mimics services like MySQL, MSSQL, and MongoDB so it can alert on attacker interactions after a network breach, running as a lightweight background process with low enough resource needs to sit on a Raspberry Pi or a small VM. It suits blue teams and detection engineers who want tripwires inside a network rather than at its perimeter, configured per host as a Linux web server, Windows server, or database box, with alerts sent to syslog, email, HTTP webhooks, or a companion correlator that merges repeated events like brute-force attempts into one notification. Its README describes it as the open-source counterpart to Thinkst's commercial Canary product. First committed in 2015 and still active, with 65 contributors and a release cut just 30 days ago.
OpenCanary is a multi-protocol network honeypot that alerts you when attackers breach non-public networks and interact with its services.
How OpenCanary helps
Has anyone touched the fake database or file share I set up as bait?
each canary service logs the connection attempt with source IP, timestamp, and credentials tried, and sends an alert through whichever channel is configured
Is someone quietly probing this network before I notice anything else is wrong?
the daemon sits on the host mimicking real services, so any interaction at all is inherently unauthorized and worth an alert, catching lateral movement that perimeter tools never see
Am I about to get buried in alerts from one attacker retrying a login?
repeated related events, like a string of brute-force attempts, can be routed to the companion correlator which merges them into a single notification instead of one per attempt
Which of my machines should look like a database server versus a web server versus a Windows box?
the config file enables only the protocol modules matching that host's personality, so a MySQL or MSSQL box presents matching fake services while a web server or Windows server presents different ones
Is anyone scanning this specific host's ports rather than just hitting one service?
the optional portscan module watches for scan activity against the host itself and can alert on that separately from the service honeypots
Where do these alerts actually end up so my team sees them?
alerts can be written to syslog or local logs, emailed directly, posted to an HTTP webhook, or forwarded to the correlator, depending on which output is configured
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for OpenCanary, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail OpenCanary puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
6 entries
No entries match these filters.
- September 20261
- July 20261
- May 20261
- October 20241
- March 20241
- October 20231
Project health
Issue, contributor and maintainer activity in thinkst/opencanary, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 11 +4 vs prior 12 months
- Maintainers 2 +2 joined · −2 left, last 12 months
- Bus factor 1 committers behind half the commits
- Community-filed 100% of issues opened, last 12 months
- Median time to close 28 days first maintainer reply 28 days
- Open backlog 1 of 231 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 1
- Contributors / month 4
- Commits / month 9
- Stars 3,035
- bugs 88%
- features 12%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →