HoneyLabs MCP

Query HoneyLabs honeypot threat intelligence from your AI assistant. 14 tools to look up IPs, CVEs, ASNs and client fingerprints, search attack events and payloads, see top attackers and attack timelines, and inspect interactive honeypot sessions, credentials and dropped files. Remote streamable HTTP with OAuth 2.1 or API key; free tier available.

View on honeylabs.net

Hosted MCP Server

npx add-mcp 'https://mcp.honeylabs.net/mcp'

Installs into Claude Code, Codex, Cursor and more

Documentation

Ask your AI about an IP.

HoneyLabs ships a first-class Model Context Protocol server. Wire it into Claude, Cursor, or any MCP-compatible assistant once and your AI can answer questions about live honeypot telemetry directly. No glue code, no JSON juggling.

Add it to your AI tool

One click for Cursor and VS Code, or copy the config for everything else. Works with Claude Code, Claude Desktop, Cursor, VS Code, Cline, and any client that speaks MCP.

claude mcp add honeylabs \
  --transport http \
  https://mcp.honeylabs.net/mcp \
  --header "Authorization: Bearer <hlk_…>"

Key from your dashboard, or drop the --header line and sign in via OAuth on first connect.

One click for Cursor and VS Code. Sign in on first use (OAuth), nothing to paste.

Claude Desktop / claude.ai

Customize, Connectors, Add connector. Paste https://mcp.honeylabs.net/mcp and authenticate.

{
  "mcpServers": {
    "honeylabs": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp",
      "headers": {
        "Authorization": "Bearer <hlk_…>"
      }
    }
  }
}

Replace <hlk_…> with a key from your dashboard. Every tool call needs one, so a config without the Authorization header will connect and list the tools, then fail on the first query.

Remote streamable HTTP at https://mcp.honeylabs.net/mcp. If your client speaks OAuth 2.1 with PKCE, drop the headers block and sign in on first connect instead.

Try these prompts

Six real questions a defender would ask their AI on a Monday morning. Click any to copy.

Tools the server exposes

You don't call these directly; your AI does, based on whatever you ask. Listed here so you know what's in reach.

ToolWhat it does
ioc_lookupStart here. An IP or domain with our verdict, whether it is a recognised benign scanner, and the CVEs it probed.
cve_lookupWho is probing a named CVE: severity, KEV status, top actors, fingerprints, daily timeline.
top_attackersLeaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (by='cve').
search_eventsRaw events with every field. Use when you want fingerprints in the response.
payload_searchSubstring search across request paths, bodies and headers. Never a CVE id.
attack_timelineHourly or daily attack volume over a window.
asn_enrichFull profile for an ASN: top sources, ports, paths, fingerprints.
fingerprint_searchFind activity by TLS, HTTP, or SSH fingerprint.
fingerprint_populationThe population behind one fingerprint: how many IPs carry it and where they sit.
fingerprint_similarAkin request shapes within a few headers of one fingerprint, and the family it belongs to.
udp_activityUDP datagrams: DNS questions, QUIC client fingerprints and other probes. Source addresses unverified.
interactive_credentialsLogins tried against the interactive sensors: the pairs tried most per service, and whether the password was ever sent.
interactive_filesFiles clients handed to the interactive sensors, by SHA-256, with the VirusTotal verdict when there is one.
interactive_sessionsSessions one address or range held with the interactive sensors: verdicts, services posed as, ports and what the client did.

Next