HoneyLabs MCP

npx add-mcp 'https://mcp.honeylabs.net/mcp'

Ask your AI about an IP.

HoneyLabs runs a Model Context Protocol server. Add it to Claude, Cursor or any MCP client once, and the assistant looks up addresses, CVEs and fingerprints in live honeypot data itself, without code on your side.

Add it to your AI tool

One click for Cursor and VS Code, or copy the config for everything else. Works with Claude Code, Claude Desktop, Cursor, VS Code, Cline, and any client that speaks MCP.

claude mcp add honeylabs \
  --transport http \
  https://mcp.honeylabs.net/mcp \
  --header "Authorization: Bearer <hlk_…>"

Key from your dashboard, or drop the --header line and sign in via OAuth on first connect.

One click for Cursor and VS Code. Sign in on first use (OAuth), nothing to paste.

Claude Desktop / claude.ai

Customize, Connectors, Add connector. Paste https://mcp.honeylabs.net/mcp and authenticate.

{
  "mcpServers": {
    "honeylabs": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp",
      "headers": {
        "Authorization": "Bearer <hlk_…>"
      }
    }
  }
}

Replace <hlk_…> with a key from your dashboard. Every tool call needs one, so a config without the Authorization header will connect and list the tools, then fail on the first query.

Remote streamable HTTP at https://mcp.honeylabs.net/mcp. If your client speaks OAuth 2.1 with PKCE, drop the headers block and sign in on first connect instead.

Try these prompts

Six real questions a defender would ask their AI on a Monday morning. Click any to copy.

Tools the server exposes

You don't call these directly; your AI does, based on whatever you ask. Listed here so you know what's in reach.

Tool	What it does
ioc_lookup	Start here. An IP or domain with our verdict, whether it is a recognised benign scanner, and the CVEs it probed.
cve_lookup	Who is probing a named CVE: severity, KEV status, top actors, fingerprints, daily timeline.
top_attackers	Leaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (by='cve').
search_events	Raw events with every field. Use when you want fingerprints in the response.
payload_search	Substring search across request paths, bodies and headers. Never a CVE id.
attack_timeline	Hourly or daily attack volume over a window.
asn_enrich	Full profile for an ASN: top sources, ports, paths, fingerprints.
fingerprint_search	Find activity by TLS, HTTP, or SSH fingerprint.
fingerprint_population	The population behind one fingerprint: how many IPs carry it and where they sit.
fingerprint_similar	Akin request shapes within a few headers of one fingerprint, and the family it belongs to.
udp_activity	UDP datagrams: DNS questions, QUIC client fingerprints and other probes. Source addresses unverified.
interactive_credentials	Logins tried against the interactive sensors: the pairs tried most per service, and whether the password was ever sent.
interactive_files	Files clients handed to the interactive sensors, by SHA-256, with the VirusTotal verdict when there is one.
interactive_sessions	Sessions one address or range held with the interactive sensors: verdicts, services posed as, ports and what the client did.

Next

• Get an API key Free to create. No card required.
• Full MCP reference in /docs JSON-RPC examples for plain HTTP callers.
• Plans with more headroom 50,000 credits a day and ninety days of history.