MedPot review
A focused healthcare protocol honeypot for monitoring and research.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
MedPot is a self-hosted, open-source honeypot for security monitoring and research involving healthcare communication protocols. It emulates HL7 and FHIR services over TCP, making it a focused option for teams investigating activity around healthcare application traffic. The project runs on Linux, can be compiled as a Go binary, and can be built as a Docker container.
Its main strength is protocol-specific deception with structured capture. MedPot listens on a configurable port, returns configurable dummy XML responses for recognized and unrecognized requests, and records connection metadata alongside received payloads. Captured payloads can be Base64 encoded, while the log location is configurable. These controls support deployments that need visibility into healthcare protocol interactions without exposing a production service. The selectable startup logo also provides a small customization point for deployments.
MedPot can submit captured connection data to an external EWS/T-Pot homebase when configured, giving it a defined fit within that ecosystem. Deployment remains self-hosted, so teams are responsible for compiling or containerizing the project, configuring the listener and logs, and operating the surrounding Linux environment. Its scope is deliberately narrow: the decoy centers on a single healthcare application area rather than a broad set of services. Choose MedPot when HL7 or FHIR deception, payload logging, and optional T-Pot integration are the priority. It is less suitable for teams seeking multi-application honeypot coverage or a managed deployment.
Questions about MedPot
What does MedPot run on? Linux. It runs self-hosted.
What does MedPot integrate with? 1 integration: EWS poster / T-Pot homebase.
Who is MedPot built for? Solo users and small businesses (our editorial estimate).
MedPot pros and cons
- Where it wins
- Emulates HL7 and FHIR services over configurable TCP ports
- Logs connection metadata and payloads with Base64 encoding
- Supports Docker builds and optional EWS/T-Pot submission
- Where it doesn't
- Self-hosted Linux deployment requires technical administration
- Focuses on healthcare application protocols rather than broader decoy coverage
- Dummy XML responses are limited to recognized and unrecognized requests
MedPot fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update