Server data from the Official MCP Registry
Query 90 days of honeypot probe data: IP reputation, scanners, CVE probing, TLS/SSH fingerprints.
About
Query 90 days of honeypot probe data: IP reputation, scanners, CVE probing, TLS/SSH fingerprints.
Remote endpoints: streamable-http: https://mcp.honeylabs.net/mcp
Security Report
Valid MCP server (1 strong, 1 medium validity signals). No known CVEs in dependencies. Imported from the Official MCP Registry.
Endpoint verified · Requires authentication · 1 issue found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Connect
Remote Plugin
No local installation needed. Your AI client connects to the remote endpoint directly.
Add this to your MCP configuration to connect:
{
"mcpServers": {
"net-honeylabs-mcp": {
"url": "https://mcp.honeylabs.net/mcp"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
HoneyLabs
Honeypot threat intelligence as MCP tools. Query 90 days of probe data from our honeypot sensor network: IP reputation, scanner classification, CVE probing trends, TLS/SSH fingerprints (JA4, JA3, JA4H, HASSH), mTLS client certificates, Community ID flow hashes, and attack timelines. Use it straight from Claude, Cursor, Gemini, Cline, or any other Model Context Protocol client.
- 🌐 Web: https://honeylabs.net
- 🔌 MCP endpoint: https://mcp.honeylabs.net/mcp (streamable HTTP)
- 🧰 Tool catalog & worked prompts: https://honeylabs.net/mcp
- 📖 Docs: https://honeylabs.net/docs
- 🔑 Access: free with a key, within fair-use limits
Install
Claude Code
claude mcp add honeylabs \
--transport http \
https://mcp.honeylabs.net/mcp \
--header "Authorization: Bearer <your-key>"
Get a key at https://honeylabs.net/dashboard (magic-link sign-in, no password).
Claude Desktop / Cursor
Add to your MCP config:
{
"mcpServers": {
"honeylabs": {
"url": "https://mcp.honeylabs.net/mcp",
"headers": {
"Authorization": "Bearer <your-key>"
}
}
}
}
Cline
Same JSON config as Claude Desktop / Cursor. Install via the MCP Marketplace listing or paste the config block above into your settings.
Gemini CLI
gemini /mcp add honeylabs https://mcp.honeylabs.net/mcp
gemini /mcp auth honeylabs # OAuth flow, no static key
OAuth 2.1 with PKCE + DCR is supported at /oauth/authorize. Any MCP
client that speaks standard OAuth (Gemini, MCP Inspector, Smithery,
Cline's OAuth flow) works out of the box.
Tools
| Tool | What it answers |
|---|---|
ioc_lookup | Is this IP / domain known to be probing? Returns our verdict, whether it is a recognised benign scanner, the CVEs it probed, plus ports / paths / fingerprints. |
top_attackers | Ranked leaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (by='cve') over a time window. |
search_events | Raw honeypot events matching filters (IP, ASN, country, dest_port, protocol, http_method, ja4/ja3, community_id, has_client_cert). |
attack_timeline | Hourly / daily attack volume over a window, with protocol / country / port filters. |
asn_enrich | Full profile for an ASN: total events, unique IPs, top ports, source countries, user-agents, org name. |
fingerprint_search | Search by TLS JA4 / JA3 / HTTP JA4H / SSH HASSH fingerprint to find shared infrastructure. |
cve_lookup | Who is probing a named CVE: severity, KEV status, top probing IPs with ASN and scanner tag, fingerprints, sample paths, daily timeline. |
payload_search | Full-text URL-path + user-agent search across attack traffic. |
Every tool is free to call. Plans differ by how much you can pull, not by which tools exist: each row in a response counts as one credit, and a free key gives 500 credits a day, with higher limits for heavier use. See https://honeylabs.net/docs#plans for the breakdown.
What the data is
HoneyLabs runs a fleet of honeypots that get probed by the public
internet all day. Every probe, meaning every connection, TLS
handshake, and HTTP request, is logged with the source IP, ASN,
geo, TLS/HTTP/SSH fingerprints, and full URL path. We retain the
last 90 days and expose it through this MCP server, a JSON API, a
public lookup web UI at /lookup/<ip>, and CSV / STIX exports.
This is our own ground-truth record of what is actively scanning the internet right now, gathered first-hand rather than copied from a CVSS database or a third-party reputation feed.
Showcase prompts
Things to ask Claude / Cursor / Gemini once HoneyLabs is wired in:
- "Is 80.82.77.202 a known scanner? When was it last seen and what does it probe?"
- "Pull every IP that hit port 445 with a non-Windows User-Agent in the last 24 hours."
- "Show CVE-2024-4577 probing volume per day for the last 7 days, broken down by ASN."
- "Which CVEs are being mass-scanned this week, and who is behind the top one?"
- "167.94.146.63 is hammering my firewall logs. Is that an attack or a research scanner?"
- "For the top 10 attackers on port 6379 right now, what TLS JA4 fingerprints do they share?"
More worked examples at https://honeylabs.net/mcp.
Open source
The honeypot fleet itself (Spip-Go) and the enrichment pipeline (Loom) are public. This repo (the MCP / API surface) is closed.
Contact
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
FinAgent
Freeby mcp-marketplace · Finance
Free stock data and market news for any MCP-compatible AI assistant.