{
  "markdown": "# HoneyLabs\n\n**Honeypot threat intelligence as MCP tools.** Query 90 days of probe\ndata from our honeypot sensor network: IP reputation, scanner\nclassification, CVE probing trends, TLS/SSH fingerprints (JA4, JA3, JA4H,\nHASSH), mTLS client certificates, Community ID flow hashes, and attack\ntimelines. Use it straight from Claude, Cursor, Gemini, Cline, or any\nother Model Context Protocol client.\n\n- 🌐 **Web:** https://honeylabs.net\n- 🔌 **MCP endpoint:** https://mcp.honeylabs.net/mcp (streamable HTTP)\n- 🧰 **Tool catalog & worked prompts:** https://honeylabs.net/mcp\n- 📖 **Docs:** https://honeylabs.net/docs\n- 🔑 **Access:** free with a key, within fair-use limits\n\n---\n\n## Install\n\n### Claude Code\n\n```bash\nclaude mcp add honeylabs \\\n  --transport http \\\n  https://mcp.honeylabs.net/mcp \\\n  --header \"Authorization: Bearer <your-key>\"\n```\n\nGet a key at https://honeylabs.net/dashboard (magic-link sign-in, no\npassword).\n\n### Claude Desktop / Cursor\n\nAdd to your MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"honeylabs\": {\n      \"url\": \"https://mcp.honeylabs.net/mcp\",\n      \"headers\": {\n        \"Authorization\": \"Bearer <your-key>\"\n      }\n    }\n  }\n}\n```\n\n### Cline\n\nSame JSON config as Claude Desktop / Cursor. Install via the MCP\nMarketplace listing or paste the config block above into your settings.\n\n### Gemini CLI\n\n```bash\ngemini /mcp add honeylabs https://mcp.honeylabs.net/mcp\ngemini /mcp auth honeylabs    # OAuth flow, no static key\n```\n\nOAuth 2.1 with PKCE + DCR is supported at `/oauth/authorize`. Any MCP\nclient that speaks standard OAuth (Gemini, MCP Inspector, Smithery,\nCline's OAuth flow) works out of the box.\n\n---\n\n## Tools\n\n| Tool | What it answers |\n|---|---|\n| `ioc_lookup` | Is this IP / domain known to be probing? Returns our verdict, whether it is a recognised benign scanner, the CVEs it probed, plus ports / paths / fingerprints. |\n| `top_attackers` | Ranked leaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (`by='cve'`) over a time window. |\n| `search_events` | Raw honeypot events matching filters (IP, ASN, country, dest_port, protocol, http_method, ja4/ja3, community_id, has_client_cert). |\n| `attack_timeline` | Hourly / daily attack volume over a window, with protocol / country / port filters. |\n| `asn_enrich` | Full profile for an ASN: total events, unique IPs, top ports, source countries, user-agents, org name. |\n| `fingerprint_search` | Search by TLS JA4 / JA3 / HTTP JA4H / SSH HASSH fingerprint to find shared infrastructure. |\n| `cve_lookup` | Who is probing a named CVE: severity, KEV status, top probing IPs with ASN and scanner tag, fingerprints, sample paths, daily timeline. |\n| `payload_search` | Full-text URL-path + user-agent search across attack traffic. |\n\nEvery tool is free to call. Plans differ by how much you can pull, not by\nwhich tools exist: each row in a response counts as one credit, and a free\nkey gives 500 credits a day, with higher limits for heavier use. See\nhttps://honeylabs.net/docs#plans for the breakdown.\n\n---\n\n## What the data is\n\nHoneyLabs runs a fleet of honeypots that get probed by the public\ninternet all day. Every probe, meaning every connection, TLS\nhandshake, and HTTP request, is logged with the source IP, ASN,\ngeo, TLS/HTTP/SSH fingerprints, and full URL path. We retain the\nlast 90 days and expose it through this MCP server, a JSON API, a\npublic lookup web UI at `/lookup/<ip>`, and CSV / STIX exports.\n\nThis is our own ground-truth record of what is actively scanning the\ninternet right now, gathered first-hand rather than copied from a CVSS\ndatabase or a third-party reputation feed.\n\n---\n\n## Showcase prompts\n\nThings to ask Claude / Cursor / Gemini once HoneyLabs is wired in:\n\n- *\"Is 80.82.77.202 a known scanner? When was it last seen and what\n  does it probe?\"*\n- *\"Pull every IP that hit port 445 with a non-Windows User-Agent in\n  the last 24 hours.\"*\n- *\"Show CVE-2024-4577 probing volume per day for the last 7 days,\n  broken down by ASN.\"*\n- *\"Which CVEs are being mass-scanned this week, and who is behind the\n  top one?\"*\n- *\"167.94.146.63 is hammering my firewall logs. Is that an attack or\n  a research scanner?\"*\n- *\"For the top 10 attackers on port 6379 right now, what TLS JA4\n  fingerprints do they share?\"*\n\nMore worked examples at https://honeylabs.net/mcp.\n\n---\n\n## Open source\n\nThe honeypot fleet itself ([Spip-Go](https://github.com/honeylabshq/Spip-Go))\nand the enrichment pipeline ([Loom](https://github.com/honeylabshq/Loom))\nare public. This repo (the MCP / API surface) is closed.\n\n---\n\n## Contact\n\n- info@honeylabs.net\n- https://www.linkedin.com/company/honeylabsnet/\n",
  "bytes": 4622,
  "sha": "c1f884e4f25b7ad7d83f85fa94fd946b27a1b9c1182bbac69dcdfd8271a6e3d2",
  "repo_slug": "honeylabshq/honeylabs-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_net_honeylabs_mcp_68f9a95c/readme"
}