honeylabshq/honeylabs-mcp

**Honeypot threat intelligence as MCP tools.** Query 90 days of probe
data from our honeypot sensor network: IP reputation, scanner
classification, CVE probing trends, TLS/HTTP/SSH fingerprints (JA4, JA3, Akin,
HASSH), mTLS client certificates, Community ID flow hashes, and attack
timelines. Use it straight from Claude, Cursor, Gemini, Cline, or any
other Model Context Protocol client.
- 🌐 **Web:** https://honeylabs.net
- 🔌 **MCP endpoint:** https://mcp.honeylabs.net/mcp (streamable HTTP)
- 🧰 **Tool catalog & worked prompts:** https://honeylabs.net/mcp
- 📖 **Docs:** https://honeylabs.net/docs
- 🔑 **Access:** free with a key, within fair-use limits
---
Install
Claude Code
Get a key at https://honeylabs.net/dashboard?src=github (magic-link sign-in, no
password).
Claude Desktop / Cursor
Add to your MCP config:
Cline
Same JSON config as Claude Desktop / Cursor. Install via the MCP
Marketplace listing or paste the config block above into your settings.
Gemini CLI
OAuth 2.1 with PKCE + DCR is supported at /oauth/authorize. Any MCP
client that speaks standard OAuth (Gemini, MCP Inspector, Smithery,
Cline's OAuth flow) works out of the box.
---
Tools
| Tool | What it answers |
|---|---|
| ioc_lookup | Is this IP / domain known to be probing? Returns our verdict, whether it is a recognised benign scanner, the CVEs it probed, plus ports / paths / fingerprints. |
| top_attackers | Ranked leaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (by='cve') over a time window. |
| search_events | Raw honeypot events matching filters (IP, ASN, country, dest_port, protocol, http_method, ja4/ja3/akin, community_id, has_client_cert). |
| attack_timeline | Hourly / daily attack volume over a window, with protocol / country / port filters. |
| asn_enrich | Full profile for an ASN: total events, unique IPs, top ports, source countries, user-agents, org name. |
| fingerprint_search | Search by TLS JA4 / JA3, HTTP Akin or SSH HASSH fingerprint to find shared infrastructure. |
| fingerprint_similar | Request shapes within a few headers of an Akin HTTP fingerprint, what those clients ask for, and the family the token belongs to. |
| cve_lookup | Who is probing a named CVE: severity, KEV status, top probing IPs with ASN and scanner tag, fingerprints, sample paths, daily timeline. |
| payload_search | Full-text URL-path + user-agent search across attack traffic. |
Every tool is free to call. Plans differ by how much you can pull, not by
which tools exist: each row in a response counts as one credit, and a free
key gives 500 credits a day, with higher limits for heavier use. See
https://honeylabs.net/docs#plans for the breakdown.
---
What the data is
HoneyLabs runs a fleet of honeypots that get probed by the public
internet all day. Every probe, meaning every connection, TLS
handshake, and HTTP request, is logged with the source IP, ASN,
geo, TLS/HTTP/SSH fingerprints, and full URL path. We retain the