Know the moment your
AI agent is compromised
Snare plants convincing fake credentials in your agent's environment. If a hijacked agent tries to use them, you get an instant alert — before it does anything else.
curl -fsSL https://snare.sh/install | sh The credential itself phones home
Snare doesn't watch files. It embeds the callback URL as the service endpoint inside the credential — so any SDK call with that credential goes to snare.sh instead of AWS.
Fake credentials, real locations
snare plant --all places convincing fake AWS keys,
GCP service accounts, and API keys exactly where real credentials live.
The callback URL is embedded as endpoint_url,
token_uri, or OPENAI_BASE_URL — not a comment.
Fires on use, not on read
A hijacked agent that finds and tries to use those credentials will
redirect its SDK calls to snare.sh. You get the request's
IP, ASN, and exact user agent string — Boto3/1.34.46 os/linux
tells you it's an automated agent, not a human.
Instant webhook alert
Alerts arrive in Discord, Slack, or Telegram within a second of the canary firing. No polling. No lag. The Boto3 user agent, cloud ASN, and exact timestamp give you everything you need to respond.
Surgical teardown
snare teardown finds the exact bytes it wrote —
content-matched, not pattern-matched — and removes only those.
Your real credentials are never touched.
Six credential types, one command
High-reliability canaries redirect SDK calls directly. Medium-reliability canaries fire under more specific conditions but provide valuable coverage.
Up and running in 3 minutes
Install the binary, run the guided setup, plant your canaries.
How Snare differs
| Snare | Canarytokens | inotify / audit | |
|---|---|---|---|
| Fires on credential use (not just read) | ✓ | ✓ (AWS only) | ✗ |
| No daemon required | ✓ | ✓ | ✗ |
| Sub-second alerts | ✓ | ✗ (CloudTrail lag) | ✓ |
| SDK user agent in alert | ✓ | ✗ | ✗ |
| Multiple credential types | AWS, GCP, OpenAI, Anthropic, GitHub, Stripe | AWS only (for use-based) | ✗ |
| No external infrastructure | ✓ (self-host the worker) | Thinkst-hosted | ✓ |
Rampart blocks. Snare catches.
Snare pairs naturally with Rampart, an OS-level policy engine for AI agents. Rampart enforces what agents are allowed to do. Snare detects when something slips through. Neither requires the other — both are stronger together.