Thinkst Canary is a deception based breach detection product from Thinkst Applied Research. It helps security teams find attackers early by scattering decoys around a network that raise an alert the moment someone touches them.
Most companies find out about a breach far too late. Canaries and Canarytokens are built to change that, with little setup, no ongoing overhead and very few false positives, because legitimate users have no reason to touch a decoy.
At A Glance
| Vendor | Thinkst Applied Research |
|---|---|
| Category | Deception based breach detection |
| Identities covered | Decoy credentials such as AWS API keys and MCP server credentials |
| Deployment | Hardware, VM, cloud and container Canaries, managed from a hosted Console |
| Agentic AI | MCP server Canarytoken to detect agentic attackers |
| Market classification | Security Operations |
What Thinkst Canary Does
Attackers who get inside a network spend time looking around before they act: browsing shares, trying credentials and probing services. Thinkst turns that habit against them. Instead of analysing every event for signs of trouble, it places things that only an intruder would touch, either devices that look like real systems or traps hidden inside files, keys and configuration. One touch is enough to raise an alert, which reaches the team through its existing notification channels or security tools. The aim is to catch attackers while they are still exploring, long before they dig in.
Products
Thinkst Canary
Canaries suit teams that want an early warning inside the network without tuning another detection tool. They come as hardware, virtual, cloud and container devices, including bundles.
- Flock management with notes, canary limits and change alerts
- Flock settings for notifications, ignore lists, webhooks and auto commissioning
- Flock level API keys for automation
Canarytokens
Canarytokens are available as a free service, as an open source self hostable project on GitHub, and inside the commercial Console, where a token factory, queries and token actions are exposed through the API. Tokens can be planted in code repositories, Lambda configurations or VM disks, so anyone who harvests secrets from those places gives themselves away.
Package Proxy
Package Proxy extends the same early-warning idea to the software supply chain, for teams worried about malicious packages entering their builds. It adds safety checks on packages without any client-side software.
How It Works
Canaries run on the customer network and report to a hosted Console, which has its own unique domain per customer and an API key for automation. Canarytokens notify their owner as soon as they are triggered. Events can be delivered in generic and Splunk formats.
Teams that self-host Canarytokens install the open source server from a Docker image and connect it to one email provider for sending alerts. To avoid floods, the server sends at most one alert per unique calling IP per minute by default.
Identities And Systems Covered
Several Canarytokens are decoy credentials and identity artefacts that alert when used.
| AWS API keys | Decoy keys in code repositories, Lambda configurations and VM disks |
|---|---|
| AWS infrastructure | The AWS Infrastructure Canarytoken |
| MCP server credentials | Decoy mcp.json files offering tools that appear to hold credentials for other services |
| SaaS and identity providers | Office365, Gmail and SAML IdP app validation in the Canarytokens API |
Agentic AI Capabilities
MCP Server Canarytoken
The MCP server Canarytoken is designed to catch agentic attackers moving through a network. It generates decoy mcp.json files for VS Code, Cursor, Claude Code and Copilot CLI. Connection mode alerts on any valid connection to the /mcp endpoint, while MCP Tool Call mode alerts only when a client lists tools and tries to call one. Each alert carries the source IP, the MCP method and the tool name. In one example, a Copilot agent with MCP disabled by policy still read the file and set off alerts.
Integrations
| Area | Integrations |
|---|---|
| SIEM and SOAR | Splunk; Google Security Operations SOAR, where Canary alerts arrive as cases |
| Email providers | Mailgun, Mandrill, SendGrid, SMTP |
Company Background
| Organisation | Thinkst Applied Research, creator of Thinkst Canary |
|---|---|
| Acquisitions | Acquired UK based DeceptIQ, a company built by red teamers, in January 2026 |
| Research | More than twenty years of security research presented at events worldwide |
| Reach | Canaries deployed on all seven continents |
Note: This overview is compiled from Thinkst Canary’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.