net.honeylabs/mcp

Official8 tools

by honeylabshq · Python

HoneyLabs

Query 90 days of honeypot probe data: IP reputation, scanners, CVE probing, TLS/SSH fingerprints.

Query 90 days of honeypot probe data for IP reputation and threat intelligence.

Captured live from the server via tools/list.

search_events_tool

Return individual raw honeypot events with all fields. Use when the user wants to see actual records: 'show me events from this IP', 'what hit port 443 last week', 'events from Russia yesterday'. Filters: source_ip, country (2-letter code), asn (e.g. 'AS12345'), dest_port, protocol ('tls' or ''), http_method, request_header (substring of the masked HTTP request headers), ja4/ja3 (exact TLS client fingerprint), community_id (exact Corelight flow hash), has_client_cert (true = only events where the client presented an mTLS cert), ip_version (4 or 6 = only IPv4 or IPv6 sources). since/until are ISO-8601 UTC strings. Each record includes: source_ip, country, asn, dest_port, user_agent, url_path, http_request_headers, tls_client_ja4, tls_client_ja3, http_request_ja4h, ssh_client_hassh, community_id, tls_client_cert_subject/issuer, event_sequence, event_duration, source_bytes/dest_bytes/network_bytes, network_protocol, timestamp.

Parameters (15)

sincestringrequired
untilstringrequired
source_ipany
countryany
asnany
dest_portany
protocolany
http_methodany
request_headerany
ja4any
ja3any
community_idany
has_client_certany
ip_versionany
limitinteger

top_attackers_tool

Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top attacking countries', 'most targeted ports', 'most common user agents', 'top ASNs by attack volume', 'top IPs from China', 'top attackers hitting port 22'. 'by' controls grouping: ip, asn, country, port, user_agent, ja4, url_path. Optional filters: country (2-letter ISO, e.g. 'CN'), dest_port, asn (e.g. 'AS12345'). Adding a filter is required for large time ranges to stay within memory limits. since/until are ISO-8601 UTC strings.

Parameters (7)

sincestringrequired
untilstringrequired
bystring
limitinteger
countryany
dest_portany
asnany

ioc_lookup_tool

Look up any IP address or domain in the honeypot dataset. Use this FIRST whenever the user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?', 'what does this IP do?', 'when was it last seen?', 'is this IP in your data?'. Returns: total_events (0 = never observed), first_seen, last_seen, country, ASN, all ports targeted, top user agents, top URL paths, TLS/HTTP/SSH fingerprints. Covers both IPv4 and domains.

Parameters (1)

iocstringrequired

payload_search_tool

Full-text search across HTTP URL paths and user agents in attack traffic. Use for: 'find attacks targeting /wp-admin', 'show exploit attempts for CVE-2024-XXXX', 'find requests with this user agent string', 'what payloads hit port 80 last week'. Pro/Team plan only. since/until are ISO-8601 UTC strings.

Parameters (4)

querystringrequired
sincestringrequired
untilstringrequired
limitinteger

attack_timeline_tool

Attack volume over time, bucketed by hour or day. Use for: 'show attack trends this week', 'was there a spike on port 22?', 'how has SSH scanning changed?', 'attack volume from China over 30 days'. bucket: 'hour' or 'day'. Optional filters: filter_protocol ('tls'/'''), filter_country (2-letter code), filter_dest_port. since/until ISO-8601 UTC.

Parameters (6)

sincestringrequired
untilstringrequired
bucketstring
filter_protocolany
filter_countryany
filter_dest_portany

asn_enrich_tool

Full honeypot profile for an ASN (autonomous system / hosting provider). Use for: 'tell me about AS202425', 'what is Vultr doing in my honeypots?', 'attacks from this hosting provider', 'attribute this IP to its network'. asn format: 'AS12345'. Returns: total events, unique IPs, top targeted ports, top source countries, top user agents, org name. since/until are ISO-8601 UTC strings.

Parameters (3)

asnstringrequired
sincestringrequired
untilstringrequired

fingerprint_search_tool

Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks: 'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?', 'how common is this HASSH?', 'find all scanners with this SSH client fingerprint'. fp_type: 'ja4' (TLS client), 'ja3' (legacy TLS client, MD5 — still keyed by many TI feeds), 'ja4h' (HTTP client), 'hassh' (SSH client). since/until are ISO-8601 UTC strings.

Parameters (5)

fingerprintstringrequired
fp_typestringrequired
sincestringrequired
untilstringrequired
limitinteger

fingerprint_population_tool

The population behind a single client fingerprint: how many source IPs carry it, across how many networks (ASNs) and countries, the ports they hit, the top networks and a sample of the IPs, plus a read on whether it is concentrated (a likely coordinated operation, many IPs on few networks) or spread thin (a common client). Use when a user asks: 'is this JA4 one botnet or a common tool?', 'how many networks use this HASSH?', 'how specific / concentrated is this fingerprint?'. fp_type: 'ja4' (TLS), 'ja4h' (HTTP), 'hassh' (SSH). Covers the full retained window (no date range).

Parameters (2)

fingerprintstringrequired
fp_typestringrequired

README.md4 KBView on GitHub

HoneyLabs

Honeypot threat intelligence as MCP tools. Query 90 days of probe data from our honeypot sensor network: IP reputation, scanner classification, CVE probing trends, TLS/SSH fingerprints (JA4, JA3, JA4H, HASSH), mTLS client certificates, Community ID flow hashes, and attack timelines. Use it straight from Claude, Cursor, Gemini, Cline, or any other Model Context Protocol client.

🌐 Web: https://honeylabs.net
🔌 MCP endpoint: https://mcp.honeylabs.net/mcp (streamable HTTP)
🧰 Tool catalog & worked prompts: https://honeylabs.net/mcp
📖 Docs: https://honeylabs.net/docs
🔑 Access: free with a key, within fair-use limits

Install

Claude Code

bash

claude mcp add honeylabs \
  --transport http \
  https://mcp.honeylabs.net/mcp \
  --header "Authorization: Bearer <your-key>"

Get a key at https://honeylabs.net/dashboard (magic-link sign-in, no password).

Claude Desktop / Cursor

Add to your MCP config:

json

{
  "mcpServers": {
    "honeylabs": {
      "url": "https://mcp.honeylabs.net/mcp",
      "headers": {
        "Authorization": "Bearer <your-key>"
      }
    }
  }
}

Cline

Same JSON config as Claude Desktop / Cursor. Install via the MCP Marketplace listing or paste the config block above into your settings.

Gemini CLI

bash

gemini /mcp add honeylabs https://mcp.honeylabs.net/mcp
gemini /mcp auth honeylabs    # OAuth flow, no static key

OAuth 2.1 with PKCE + DCR is supported at /oauth/authorize. Any MCP client that speaks standard OAuth (Gemini, MCP Inspector, Smithery, Cline's OAuth flow) works out of the box.

Tools

Tool	What it answers
`ioc_lookup`	Is this IP / domain known to be probing? When was it last seen? What ports / paths does it hit?
`top_attackers`	Ranked leaderboard of source IPs, ASNs, countries, ports, or user-agents over a time window.
`search_events`	Raw honeypot events matching filters (IP, ASN, country, dest_port, protocol, http_method, ja4/ja3, community_id, has_client_cert).
`attack_timeline`	Hourly / daily attack volume over a window, with protocol / country / port filters.
`asn_enrich`	Full profile for an ASN: total events, unique IPs, top ports, source countries, user-agents, org name.
`fingerprint_search`	Search by TLS JA4 / JA3 / HTTP JA4H / SSH HASSH fingerprint to find shared infrastructure.
`payload_search`	Full-text URL-path + user-agent search across attack traffic. Pro tier.

Each row in a response counts as one credit. A free key gives 500 credits a day, with higher limits for heavier use. See https://honeylabs.net/docs#plans for the breakdown.

What the data is

HoneyLabs runs a fleet of honeypots that get probed by the public internet all day. Every probe, meaning every connection, TLS handshake, and HTTP request, is logged with the source IP, ASN, geo, TLS/HTTP/SSH fingerprints, and full URL path. We retain the last 90 days and expose it through this MCP server, a JSON API, a public lookup web UI at /lookup/<ip>, and CSV / STIX exports.

This is our own ground-truth record of what is actively scanning the internet right now, gathered first-hand rather than copied from a CVSS database or a third-party reputation feed.

Showcase prompts

Things to ask Claude / Cursor / Gemini once HoneyLabs is wired in:

"Is 80.82.77.202 a known scanner? When was it last seen and what does it probe?"
"Pull every IP that hit port 445 with a non-Windows User-Agent in the last 24 hours."
"Show CVE-2024-4577 probing volume per day for the last 7 days, broken down by ASN."
"For the top 10 attackers on port 6379 right now, what TLS JA4 fingerprints do they share?"

More worked examples at https://honeylabs.net/mcp.

Open source

The honeypot fleet itself (Spip-Go) and the enrichment pipeline (Loom) are public. This repo (the MCP / API surface) is closed.

Contact

Install

claude_desktop_config.json

{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.honeylabs.net/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.