tapscrollWIKI

Honeypots

Bait containers that only a snooping staff member would ever open — how to place them so they catch something.

Argus v1.1.1Paper · Purpur · Folia-safe1.21 – 1.21.x

A honeypot is an ordinary container that Argus has armed. Nothing about it looks special in-game. Any monitored staff member who opens or breaks it is flagged with honeypot_triggered, the heaviest weight in the system (40 points by default).

Arming a trap

Look at a chest, barrel or any container within 6 blocks and run:

BASH
/argus honeypot add

Disarm the same way:

BASH
/argus honeypot remove

Running /argus honeypot with no argument prints how many traps are currently armed.

Honeypots are per-server. Coordinates do not travel across a network, so arm traps on every backend you care about.

Placement is the whole game

A honeypot in a public build catches nothing but curiosity. A good trap has one property: no legitimate reason exists to open it.

Good placements:

  • A chest inside a protected region a player reported griefing in. Only staff can reach it.
  • A barrel in an unfinished staff build nobody has been told about.
  • A chest at coordinates that only appear in a staff-only channel, labelled as something valuable.
  • A container in a vanished-admin area — reachable only by someone who flew there.

Bad placements:

  • Anywhere in spawn.
  • Inside a shop or a public farm.
  • Somewhere staff have a routine reason to look, like a warp hub.

Make it look worth stealing

An empty chest that never gets opened proves nothing. Fill the trap with something a dishonest staff member would want: shulkers, netherite, a stack of elytras. The point is that opening it must be tempting and indefensible.

Do not announce them

The moment your team knows where the honeypots are, they stop being honeypots and become a list of places not to go. If you want the deterrent effect instead, that is what alerts.deterrent-mode is for — it tells staff that logging exists without telling them where.

What gets recorded

When a trap fires, Argus records:

  • who opened or broke it
  • the exact container and location
  • the timestamp and, in network mode, the server-id
  • whether anything was taken

The event lands in the audit chain like every other action, so it survives an attempt to clean up afterwards.

Deterrent mode

plugins/Argus/config.yml
alerts:  deterrent-mode: true

With this on, monitored staff get a quiet action-bar notice when they take a sensitive action. It does not name honeypots or reveal locations — it just makes supervision visible.

Visible supervision is the cheapest abuse prevention there is. Most opportunistic theft is opportunistic; a person who knows the action is being recorded usually does not take it.

False positives

The one realistic false positive is a staff member who stumbles onto a trap while doing legitimate work — restoring a griefed region, for instance. Two things keep that survivable:

  1. The rating comes with a Why breakdown, so you can see it was a single isolated trigger with no supporting signals.
  2. The GUI's Clear action resets the score while leaving the audit entry intact.

If it happens more than once, the trap is in the wrong place. Move it.