# UHBS — full agent digest (llms-full.txt)

> Curated plain-text digest of UHBS v4.5.1 for answer engines and coding agents. Prefer the live docs and GitHub sources when they disagree with this file. Last aligned: 2026-08-02.
> Canonical: https://github.com/uhbs/uhbs-standard · https://uhbs.github.io/uhbs-standard/ · https://uhbs.github.io/uhbs-standard/mkdocs/

## What UHBS is

UHBS (Universal Honeypot Benchmarking Standard) is an open-source **evaluation framework** for comparing honeypots and deception systems by **decoy class** and **protocol**, not by vendor brand. Version **4.5.1**. License **Apache-2.0**. Author/maintainer: Moran Zavdi (@mziqudhd92).

It is **not** a consortium standard, not multi-party governed, and not a mandatory industry requirement. Suggested Production Baseline Profile (RECOMMENDED for internal use): **UHQS > 80** with Module D Safety Gate pass (containment C ≥ 95 → δ_C = 1.0).

Primary URLs:
- Landing: https://uhbs.github.io/uhbs-standard/
- MkDocs: https://uhbs.github.io/uhbs-standard/mkdocs/
- Repo: https://github.com/uhbs/uhbs-standard
- Spec status: https://uhbs.github.io/uhbs-standard/mkdocs/specification/status/
- MCP for AI hosts: https://uhbs.github.io/uhbs-standard/mkdocs/tooling/mcp/

## Normative UHQS formula

UHQS = δ_C · (w_A·S_A + w_B·S_B + w_C·S_C + w_E·S_E + w_F·S_F)

- S_A…S_F: module scores 0–100 (A protocol, B behavior, C telemetry, D containment, E scale, F static)
- Weights w_* depend on profile class and sum to 1.00
- δ_C = 1.0 if C ≥ 95; else δ_C = (C/100)²
- UHQS rounded to **two** decimal places
- Letter grades: A≥90, B≥80, C≥70, D≥50, F<50

Single source of scoring math in package: `uhbs_core.uhqs_math` (CLI, MCP, and harness must agree).

## Profile classes (weights)

| Class | w_A | w_B | w_C | w_E | w_F |
| --- | --- | --- | --- | --- | --- |
| POSIX-Shell / GenAI-Shell | 0.20 | 0.25 | 0.20 | 0.15 | 0.20 |
| Low-Interaction | 0.30 | 0.15 | 0.25 | 0.10 | 0.20 |
| ICS-SCADA | 0.35 | 0.20 | 0.15 | 0.10 | 0.20 |
| Web-API | 0.25 | 0.20 | 0.20 | 0.15 | 0.20 |
| Database | 0.25 | 0.25 | 0.20 | 0.10 | 0.20 |

## Conformance levels

- **UHBS-Core:** valid TPS + scorecard schemas; recomputed UHQS/δ_C/grade integrity
- **UHBS-Lab:** UHBS-Core + Modules A–F harness (`uhbs[lab]` / `uhbs-lab`) + MANIFEST digests
- **UHBS-MCP:** optional stdio MCP server (`uhbs[mcp]` / `uhbs-mcp`) wrapping Core validators — no live lab exec
- **AEP (optional):** offline Advanced Evidence Profile (`uhbs[aep]` / `uhbs aep`) — informative VoD/FSV/DTDR/EER from local **lab** trial files; never changes UHQS; never launches attacks; **lab/sandbox only** (not real-world production testing). Research credits: Zhu 2019 DOI 10.1145/3314058.3314067; Collins et al. 2024 arXiv:2401.13815; Ersok et al. 2022 DOI 10.1109/ICCC202255925.2022.9922853; Li et al. 2020 DOI 10.1109/OJCS.2020.3030825 (citation ≠ endorsement).
- **AEP SLM (alpha, opt-in):** `uhbs[aep-slm]` / `uhbs aep slm` — draft AEP trial JSONL (`mock` / `recorded` / loopback `openai_compatible`). **Disabled by default**; unlock only by editing `aep-slm.yaml`. Never changes UHQS; not exposed via AI-host MCP. Docs: https://uhbs.github.io/uhbs-standard/mkdocs/advanced-evidence/slm-alpha/

## Install & commands

```bash
pip install -e ".[lab,mcp,aep]"
# optional alpha: pip install -e ".[aep-slm]"  # still off until you edit aep-slm.yaml
uhbs validate-profile templates/profile.yaml
uhbs validate-scorecard path/to/scorecard.json --strict
uhbs score --class Low-Interaction --scores scores.json
uhbs lab --list-protocols
uhbs aep --help   # offline only; local experiment.yaml + trials.jsonl
uhbs aep slm --help   # alpha; generate blocked until config unlock
# 36 built-in protocols in v4.5.1 (bluetooth, dhcp, dns, ftp, generic, git, http,
# httpproxy, imap, ipp, irc, kubernetes, ldap, mcp, memcache, modbus, mongodb,
# mssql, mysql, ntp, oracle, pjl, pop3, postgres, rdp, redis, s7comm, sip, smb,
# smtp, snmp, socks5, ssh, telnet, tftp, vnc)
# AI hosts (Cursor/Claude/VS Code): configure mcpServers → python -m uhbs_mcp
# Docs: https://uhbs.github.io/uhbs-standard/mkdocs/tooling/mcp/
# AEP: https://uhbs.github.io/uhbs-standard/mkdocs/advanced-evidence/
# AEP SLM (alpha): https://uhbs.github.io/uhbs-standard/mkdocs/advanced-evidence/slm-alpha/
# Landing AEP: https://uhbs.github.io/uhbs-standard/#advanced-evidence
# Related frameworks: https://uhbs.github.io/uhbs-standard/mkdocs/mappings/related-frameworks/
```

## MCP (Model Context Protocol)

Industry open standard for AI tool calling (AAIF / Linux Foundation). UHBS exposes local stdio tools: validate_scorecard, validate_profile, compute_uhqs, list_conformance_fixtures, get_scorecard_summary, list_lab_reports, plus schema/scoring resources. Metadata: https://github.com/uhbs/uhbs-standard/blob/main/server.json

## Vendor neutrality

Normative docs and templates use **classes and protocols** only. Named products appear only under conformance fixtures / lab reports as evaluation **proof**, not as UHBS requirements.

Published full-lab proof (sanitized fixtures; prefer live fixture JSON if this digest drifts):
- ESPot (Web-API HTTP): UHQS **49.82** (F)
- miniprint (Low-Interaction PJL): UHQS **47.77** (F)
- Conpot (ICS-SCADA Modbus): UHQS **55.51** (D)
- Cowrie (Low-Interaction SSH): UHQS **61.37** (D)
- OpenCanary HTTP: UHQS **50.12** (D); FTP **59.43** (D); SSH **28.44** (F); Telnet **57.00** (D); Redis **48.26** (F)
- Endlessh (SSH tarpit / ssh_tarpit): UHQS **51.90** (D)
- CyberHalluciNet / POSIX-Shell lab (illustrative): UHQS **80.33** (B)

## Machine-readable artifacts

- Schemas: https://github.com/uhbs/uhbs-standard/tree/main/schemas
- CITATION.cff: https://github.com/uhbs/uhbs-standard/blob/main/CITATION.cff
- ROADMAP: https://github.com/uhbs/uhbs-standard/blob/main/ROADMAP.md
- Repo llms.txt: https://github.com/uhbs/uhbs-standard/blob/main/llms.txt
- MCP server.json: https://github.com/uhbs/uhbs-standard/blob/main/server.json

## Citation note

Cite as software/framework (see CITATION.cff). Do not describe UHBS as an adopted industry or academic standard unless Phase 6 roadmap exit criteria are met.