Honeylabs MCP

What honeylabshq/honeylabs-mcp MCP server does

The honeylabshq/honeylabs-mcp MCP server gives MCP-compatible agents access to HoneyLabs honeypot telemetry. The dataset contains probe activity collected from a sensor network over the most recent 90 days. Records include source IP, ASN, geographic information, TLS, HTTP, and SSH fingerprints, URL paths, and other connection details.

This is intended for threat-intelligence investigation rather than general vulnerability scoring. Agents can check whether an IP or domain has appeared as a probe source, identify activity associated with a CVE, rank sources by several dimensions, and inspect related fingerprints or payload patterns.

How it works

The honeylabshq/honeylabs-mcp MCP server is hosted at https://mcp.honeylabs.net/mcp and uses streamable HTTP. An MCP client sends tool calls to the endpoint and receives structured results. Authentication can use a HoneyLabs access key in a bearer header. The service also supports OAuth 2.1 with PKCE and dynamic client registration for compatible clients.

HoneyLabs records connections, TLS handshakes, and HTTP requests received by its honeypot fleet. The resulting data is exposed through the MCP interface rather than being limited to a static reputation list. Response usage is measured in credits by returned row; the documented free key includes 500 credits per day, with higher limits available under other plans.

Setup and configuration

The honeylabshq/honeylabs-mcp MCP server does not require a local package installation. Configure the remote URL in an MCP client and provide the bearer token through that client’s header configuration. HoneyLabs states that keys are available through its dashboard using magic-link sign-in.

Claude Desktop and Cursor can use a server entry with the endpoint URL and an Authorization: Bearer <your-key> header. Cline can use the same JSON configuration or its marketplace and OAuth options. Claude Code uses an HTTP MCP registration, while clients supporting standard OAuth can authenticate through the server’s OAuth flow. The key placeholder must be replaced with an actual HoneyLabs key when using bearer authentication.

Tools and capabilities

The honeylabshq/honeylabs-mcp MCP server provides these investigation tools:

• ioc_lookup checks an IP or domain and returns a verdict, benign-scanner recognition, observed CVEs, ports, paths, and fingerprints.
• top_attackers ranks IPs, ASNs, countries, ports, user-agents, or CVEs over a selected time window.
• search_events filters raw events by attributes such as IP, ASN, country, destination port, protocol, HTTP method, fingerprints, Community ID, and client-certificate presence.
• attack_timeline reports hourly or daily attack volume with protocol, country, and port filters.
• asn_enrich summarizes an ASN’s events, source IPs, ports, countries, user-agents, and organization.
• fingerprint_search finds activity sharing TLS JA4 or JA3, HTTP JA4H, or SSH HASSH fingerprints.
• cve_lookup identifies probing sources for a named CVE and includes severity, KEV status, source details, fingerprints, sample paths, and a daily timeline.
• payload_search searches URL paths and user-agents across attack traffic.

Limitations and notes

The retained dataset covers 90 days, so older activity is outside the stated MCP data window. All tools are available on the free access tier, but the amount of returned data is limited by credits rather than by tool availability. The repository describing the MCP and API surface is closed; the related honeypot fleet and enrichment pipeline are identified as separate public projects. The material does not state a software license for this repository.

The service is most suitable for investigating internet-originated probing observed by HoneyLabs sensors. It should not be treated as a complete record of all internet activity or as a replacement for telemetry from an organization’s own infrastructure.