Open-source Rust/WASM PDK policies for Flex/Omni Gateway that detect configured honeytokens, intercept calls to inert decoy tools, and observe or sanitize breadcrumb lures in MCP traffic, plus a coordinator that runs all three in a defined order.