Honeylabs MCP

What honeylabshq/honeylabs-mcp does

HoneyLabs exposes first-hand honeypot observations through MCP for security investigation and threat-intelligence workflows. The dataset records internet probes received by HoneyLabs sensors, including source addresses, network ownership, geography, ports, protocols, request paths, user agents, TLS and SSH fingerprints, HTTP request shapes, CVE detections, and selected interactive-session activity. The retained first-contact data covers the most recent 90 days.

The service is useful when an agent needs evidence about active scanning rather than a generic reputation score. An IP or domain lookup can return when an indicator was seen, what it targeted, fingerprints associated with it, and a verdict with supporting signals. Recognised research scanners are identified separately, so high activity from one does not automatically imply malicious intent.

How it works

The MCP endpoint is available at https://mcp.honeylabs.net/mcp over streamable HTTP. Requests are authenticated with a HoneyLabs key or, for clients supporting the flow, OAuth 2.1 with PKCE and dynamic client registration. Tool names exposed by the server end in _tool, such as ioc_lookup_tool and search_events_tool.

Queries are constrained by the caller's plan. A free key provides 500 credits per day, while response rows consume credits and query windows vary by plan. Most TCP-oriented tools accept ISO-8601 UTC ranges or predefined windows. UDP activity has separate query handling, and UDP source addresses can be forged; they should be treated as claimed sources rather than proof of attribution.

Setup and configuration

Create an access key through the HoneyLabs dashboard, then add the remote endpoint to an MCP client with an Authorization: Bearer <your-key> header. Claude Desktop, Cursor, and Cline use a JSON server entry containing the URL and header. Claude Code can add the endpoint with its HTTP transport command. Gemini CLI can add the server and complete the OAuth flow instead of using a static key.

The service is remote, so no local package installation or runtime configuration is needed. Client configuration should preserve the exact endpoint URL and authentication method selected for the client.

Tools and capabilities

• ioc_lookup_tool investigates an IP, CIDR range, range set, or domain and returns observations, verdict signals, ports, paths, fingerprints, and CVE probes.
• search_events_tool returns individual matching honeypot records with filters such as address, ASN, country, port, protocol, fingerprint, and client-certificate presence.
• top_attackers_tool ranks sources, networks, countries, ports, user agents, URL paths, fingerprints, domains, or CVEs by event count.
• attack_timeline_tool groups first-contact event counts into hourly or daily buckets.
• asn_enrich_tool profiles one autonomous system, including organisation, volume, addresses, ports, countries, and user agents.
• cve_lookup_tool reports probing activity for a named CVE, including severity, CISA KEV status, sources, fingerprints, paths, and a daily timeline.
• payload_search_tool performs case-insensitive literal searches across captured paths, bodies, headers, and event summaries.
• fingerprint_search_tool, fingerprint_similar_tool, and fingerprint_population_tool find exact fingerprint matches, nearby Akin request shapes, and fingerprint distribution patterns.
• udp_activity_tool covers DNS, QUIC, and other UDP probes, including QUIC fingerprints and queried ports.
• interactive_credentials_tool, interactive_files_tool, and interactive_sessions_tool examine login attempts, transferred files with known VirusTotal results, and sessions handled by interactive sensors.

Limitations and notes

The dataset represents traffic received by HoneyLabs' sensors, not all internet activity. Query windows, result limits, and retained history depend on the plan. A CVE lookup with no detection pattern is not evidence that the CVE has never been scanned. UDP observations require extra caution because source addresses may be spoofed, and interactive credentials are recorded separately from indicator verdicts.