HoneyLabs MCP

npx add-mcp 'https://mcp.honeylabs.net/mcp'

Ask your AI about an IP

HoneyLabs runs a Model Context Protocol server. Add it to Claude, Cursor or another MCP client, and the assistant looks up addresses, CVEs and fingerprints in the sensors' records when you ask.

Add it to your AI tool

Pick your client. Cursor and VS Code install from a button, and the others take a command, an address or a settings block.

Run this in a terminal, with an API key from your dashboard.

claude mcp add honeylabs \
  --transport http \
  https://mcp.honeylabs.net/mcp \
  --header "Authorization: Bearer <hlk_...>"

To sign in with OAuth on first use, leave out the --header line.

Example prompts

Questions the server can answer. Click one to copy it.

Tools the server exposes

The assistant picks the tool from your question. The list shows what it can look up.

Tool	What it does
ioc_lookup	Start here. An IP or domain with our verdict, whether it is a recognised benign scanner, and the CVEs it probed.
cve_lookup	Who is probing a named CVE: severity, KEV status, top actors, fingerprints, daily timeline.
top_attackers	Leaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (by='cve').
search_events	Raw events with every field. Use when you want fingerprints in the response.
payload_search	Substring search across request paths, bodies and headers. Never a CVE id.
attack_timeline	Hourly or daily attack volume over a window.
asn_enrich	Full profile for an ASN: top sources, ports, paths, fingerprints.
fingerprint_search	Find activity by TLS, HTTP, or SSH fingerprint.
fingerprint_population	The population behind one fingerprint: how many IPs carry it and where they sit.
fingerprint_similar	Akin request shapes within a few headers of one fingerprint, and the family it belongs to.
udp_activity	UDP datagrams: DNS questions, QUIC client fingerprints and other probes. Source addresses unverified.
interactive_credentials	Logins tried against the interactive sensors: the pairs tried most per service, and whether the password was ever sent.
interactive_files	Files clients handed to the interactive sensors, by SHA-256, with the VirusTotal verdict when there is one.
interactive_sessions	Sessions one address or range held with the interactive sensors: verdicts, services posed as, ports and what the client did.