# honeylabshq/honeylabs-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/honeylabshq/honeylabs-mcp  
**GitHub Stars:** 2  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/honeylabshq-honeylabs-mcp

## Description
Honeypot threat intelligence for AI agents: 90 days of probe data from a sensor network for IP reputation, scanner classification, CVE probing trends, and JA4/JA4H/HASSH fingerprints. Remote MCP, free tier.

## Tools
Capabilities this server exposes over MCP:

- **ioc_lookup** — Is this IP / domain known to be probing? Returns our verdict, whether it is a recognised benign scanner, the CVEs it probed, plus ports / paths / fingerprints.
- **top_attackers** — Ranked leaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (`by='cve'`) over a time window.
- **search_events** — Raw honeypot events matching filters (IP, ASN, country, dest_port, protocol, http_method, ja4/ja3, community_id, has_client_cert).
- **attack_timeline** — Hourly / daily attack volume over a window, with protocol / country / port filters.
- **asn_enrich** — Full profile for an ASN: total events, unique IPs, top ports, source countries, user-agents, org name.
- **fingerprint_search** — Search by TLS JA4 / JA3 / HTTP JA4H / SSH HASSH fingerprint to find shared infrastructure.
- **cve_lookup** — Who is probing a named CVE: severity, KEV status, top probing IPs with ASN and scanner tag, fingerprints, sample paths, daily timeline.
- **payload_search** — Full-text URL-path + user-agent search across attack traffic.

## Claude Desktop Quick Installation
Heuristic fallback — verify the package name and runner against the repository README before running it. Uses `npx` (confidence: low):

```json
"mcpServers": {
  "honeylabs-mcp": {
    "command": "npx",
    "args": ["-y","honeylabshq-honeylabs-mcp"]
  }
}
```

## Documentation

## What honeylabshq/honeylabs-mcp MCP server does

The honeylabshq/honeylabs-mcp MCP server gives MCP-compatible agents access to HoneyLabs honeypot telemetry. The dataset contains probe activity collected from a sensor network over the most recent 90 days. Records include source IP, ASN, geographic information, TLS, HTTP, and SSH fingerprints, URL paths, and other connection details.

This is intended for threat-intelligence investigation rather than general vulnerability scoring. Agents can check whether an IP or domain has appeared as a probe source, identify activity associated with a CVE, rank sources by several dimensions, and inspect related fingerprints or payload patterns.

## How it works

The honeylabshq/honeylabs-mcp MCP server is hosted at `https://mcp.honeylabs.net/mcp` and uses streamable HTTP. An MCP client sends tool calls to the endpoint and receives structured results. Authentication can use a HoneyLabs access key in a bearer header. The service also supports OAuth 2.1 with PKCE and dynamic client registration for compatible clients.

HoneyLabs records connections, TLS handshakes, and HTTP requests received by its honeypot fleet. The resulting data is exposed through the MCP interface rather than being limited to a static reputation list. Response usage is measured in credits by returned row; the documented free key includes 500 credits per day, with higher limits available under other plans.

## Setup and configuration

The honeylabshq/honeylabs-mcp MCP server does not require a local package installation. Configure the remote URL in an MCP client and provide the bearer token through that client’s header configuration. HoneyLabs states that keys are available through its dashboard using magic-link sign-in.

Claude Desktop and Cursor can use a server entry with the endpoint URL and an `Authorization: Bearer <your-key>` header. Cline can use the same JSON configuration or its marketplace and OAuth options. Claude Code uses an HTTP MCP registration, while clients supporting standard OAuth can authenticate through the server’s OAuth flow. The key placeholder must be replaced with an actual HoneyLabs key when using bearer authentication.

## Tools and capabilities

The honeylabshq/honeylabs-mcp MCP server provides these investigation tools:

- `ioc_lookup` checks an IP or domain and returns a verdict, benign-scanner recognition, observed CVEs, ports, paths, and fingerprints.
- `top_attackers` ranks IPs, ASNs, countries, ports, user-agents, or CVEs over a selected time window.
- `search_events` filters raw events by attributes such as IP, ASN, country, destination port, protocol, HTTP method, fingerprints, Community ID, and client-certificate presence.
- `attack_timeline` reports hourly or daily attack volume with protocol, country, and port filters.
- `asn_enrich` summarizes an ASN’s events, source IPs, ports, countries, user-agents, and organization.
- `fingerprint_search` finds activity sharing TLS JA4 or JA3, HTTP JA4H, or SSH HASSH fingerprints.
- `cve_lookup` identifies probing sources for a named CVE and includes severity, KEV status, source details, fingerprints, sample paths, and a daily timeline.
- `payload_search` searches URL paths and user-agents across attack traffic.

## Limitations and notes

The retained dataset covers 90 days, so older activity is outside the stated MCP data window. All tools are available on the free access tier, but the amount of returned data is limited by credits rather than by tool availability. The repository describing the MCP and API surface is closed; the related honeypot fleet and enrichment pipeline are identified as separate public projects. The material does not state a software license for this repository.

The service is most suitable for investigating internet-originated probing observed by HoneyLabs sensors. It should not be treated as a complete record of all internet activity or as a replacement for telemetry from an organization’s own infrastructure.

_Full upstream README: https://allmcps.com/mcp/honeylabshq-honeylabs-mcp/readme_