HoneyLabs
net.honeylabs/mcp · v1.0.0 · MCP 2025-06-18
Query 90 days of honeypot probe data: IP reputation, scanners, CVE probing, TLS/SSH fingerprints.
Reachability
reachable
checked 2026-07-14 04:35 UTC
Registry status active
Tools pinned 8
6384f287ebee
Tools last changed
unchanged since first capture 2026-07-14
Provenance
Registry namespace net.honeylabs
(domain verified by the official registry)
Repository
github.com/honeylabshq/honeylabs-mcp
Website
https://honeylabs.net
Remote endpoints
https://mcp.honeylabs.net/mcp (streamable-http)
Observed changes
| When (UTC) | Event | Detail |
|---|---|---|
| 2026-07-14 03:29 | first capture | 8 tools pinned |
Pinned tool definitions (8)
| Tool | Description |
|---|---|
| search_events_tool | Return individual raw honeypot events with all fields. Use when the user wants to see actual records: 'show me events from this IP', 'what hit port 443 last week', 'events from Russia yesterday'. Filters: source_ip, country (2-letter... |
| top_attackers_tool | Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top attacking countries', 'most targeted ports', 'most common user agents', 'top ASNs by attack volume', 'top IPs from China', 'top attackers hitting port... |
| ioc_lookup_tool | Look up any IP address or domain in the honeypot dataset. Use this FIRST whenever the user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?', 'what does this IP do?', 'when was it last seen?', 'is this... |
| payload_search_tool | Full-text search across HTTP URL paths and user agents in attack traffic. Use for: 'find attacks targeting /wp-admin', 'show exploit attempts for CVE-2024-XXXX', 'find requests with this user agent string', 'what payloads hit port 80... |
| attack_timeline_tool | Attack volume over time, bucketed by hour or day. Use for: 'show attack trends this week', 'was there a spike on port 22?', 'how has SSH scanning changed?', 'attack volume from China over 30 days'. bucket: 'hour' or 'day'. Optional... |
| asn_enrich_tool | Full honeypot profile for an ASN (autonomous system / hosting provider). Use for: 'tell me about AS202425', 'what is Vultr doing in my honeypots?', 'attacks from this hosting provider', 'attribute this IP to its network'. asn format:... |
| fingerprint_search_tool | Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks: 'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?', 'how common is this HASSH?', 'find all scanners with this SSH client... |
| fingerprint_population_tool | The population behind a single client fingerprint: how many source IPs carry it, across how many networks (ASNs) and countries, the ports they hit, the top networks and a sample of the IPs, plus a read on whether it is concentrated (a... |
Status badge
[](https://toolpin.dev/servers/net.honeylabs/mcp)
Maintain this server? Add the badge to your README — it links your users to this live status page.