HoneyLabs

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/honeylabs-net-mcp

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

6 read · 0 write · 0 delete · 8 not yet classified

Secrets

1 (API keys, tokens or passwords)

Install scripts

Nothing to install (hosted)

Runs as

Hosted (remote endpoint)

Tools (14)

As the server listed them on Oct 25, 2026. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• asn_enrich_tool

  Full honeypot profile for an ASN (autonomous system / hosting provider). Use for: 'tell me about AS202425', 'what is Vultr doing in my honeypots?', 'attacks from this hosting provider', 'attribute this IP to its network'. asn format: 'AS12345'. Returns: total events, unique IPs, top targeted ports, top source countries, top user agents, org name. since/until are ISO-8601 UTC strings.

• attack_timeline_tool

  Attack volume over time, bucketed by hour or day. Use for: 'show attack trends this week', 'was there a spike on port 22?', 'how has SSH scanning changed?', 'attack volume from China over 30 days'. bucket: 'hour' or 'day'. Optional filters: filter_protocol ('tls'/'''), filter_country (2-letter code), filter_dest_port. since/until ISO-8601 UTC.

• cve_lookup_tool

  Who is probing a specific CVE. Use whenever the user names a CVE: 'is CVE-2024-4577 being exploited in the wild?', 'who is scanning for this CVE?', 'show me actors probing CVE-2023-1389'. Returns title, severity, KEV status (actively_exploited, and `kev`: the CISA catalogue entry with date_added, or null), event and unique-IP counts over both sensor types (first_contact_events and interactive_requests split them; an address both saw counts once), the top probing IPs with country/ASN and `scanner` (name and kind when the address is a recognised research, commercial or vendor scanner, else null)…

• feint_credentials_tool

  Plaintext logins captured by the interactive (Feint) sensors: username, password, the service they were tried on, the outcome and the source address, newest first, plus the pairs tried most and a per-service breakdown. Use when a user asks: 'what passwords are attackers trying on SSH?', 'which credentials did this IP try?', 'what logins hit the MySQL honeypots this week?'. service is a Feint service name such as ssh-password, telnet-login, mysql-login, rdp-credssp or smb-ntlmssp (empty for all); source is an address or CIDR (empty for all); window is 24h, 7d or 30d. Feint data is kept apart fr…

• feint_files_tool

  Files clients handed to the interactive (Feint) sensors: uploads, mail attachments, published messages and other artifacts, by SHA-256, with name, size, MIME type, the sessions that carried them and the VirusTotal verdict when the collector has one. Use when a user asks: 'have you seen this hash?', 'what files did this IP upload?', 'which malware samples reached the honeypots this month?'. sha256 is one hash (empty for every file in the window); source is an address or CIDR; window is 24h, 7d or 30d.

• feint_sessions_tool

  Sessions one address or range held with the interactive (Feint) sensors: when, which port and protocol, the persona answered as, the verdict (scan, credential, exploit), labels, turns, bytes, duration, CVE ids evidenced by the payload, path-only CVE candidates and the download URLs the client named, newest first, with verdict, persona and port breakdowns. Use after ioc_lookup when a user asks what an address did inside a session: 'what did this IP do on the honeypots?', 'did this range get past a login?', 'which exploits did this IP try?'. source is required: an address or a CIDR; window is 24…

• fingerprint_population_tool

  The population behind a single client fingerprint: how many source IPs carry it, across how many networks (ASNs) and countries, the ports they hit, the top networks and a sample of the IPs, plus a read on its shape: concentrated (many IPs on few networks), dispersed (many networks but one short burst on one or two ports, which is a coordinated operation spread thinly on purpose), spread (a common client) or mixed. Concentrated and dispersed are both coordinated operations. Use when a user asks: 'is this JA4 one botnet or a common tool?', 'how many networks use this HASSH?', 'how specific / con…

• fingerprint_search_tool

  Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks: 'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?', 'how common is this HASSH?', 'find all scanners with this SSH client fingerprint'. fp_type: 'ja4' (TLS client), 'ja3' (legacy TLS client, MD5, still keyed by many TI feeds), 'akin' (HTTP request shape, e.g. b11cun030_00040014_54d07b6d), 'hassh' (SSH client). since/until are ISO-8601 UTC strings.

• fingerprint_similar_tool

  Request shapes within a few headers of an Akin HTTP fingerprint, with what those clients ask for and call themselves, plus the family the token belongs to. Use when one odd request shape turns up in your own web, WAF or proxy logs and you want to know whether it is a known tool with variants: 'what is close to this fingerprint', 'is this the same scanner with one header added', 'what does this client family go after'. max_distance is in headers, 1 to 4. Only Akin can answer this; a hashed fingerprint changes completely when a header is added.

• ioc_lookup_tool

  Look up any IP address, CIDR network, set of networks, or domain in the honeypot dataset. Use this FIRST whenever the user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?', 'what does this IP do?', 'when was it last seen?', 'is this IP in your data?'. Returns: total_events (0 = never observed), first_seen, last_seen, country, ASN, the 50 most-hit ports plus ports_targeted_count for the true total, top user agents, top URL paths, TLS/HTTP/SSH fingerprints. Covers both IPv4 and domains. Also returns our own judgement: `verdict` (human se…

• payload_search_tool

  Literal substring search over captured request text: URL path, request body, request headers and event summary. Use for: 'find attacks targeting /wp-admin', 'find requests with this user agent string', 'what payloads hit port 80 last week'. It matches text that literally appeared in the request, and nothing else. These do NOT work and will return an empty list: - a CVE id ('CVE-2024-4577'), which is our tag for a pattern, never payload text. Use cve_lookup instead. This tool rejects them rather than answering emptily. - a product or vendor name ('Cisco FMC', '7-Zip'), which appears in…

• search_events_tool

  Return individual raw honeypot events with all fields. Use when the user wants to see actual records: 'show me events from this IP', 'what hit port 443 last week', 'events from Russia yesterday'. Filters: source_ip, country (2-letter code), asn (e.g. 'AS12345'), dest_port, protocol ('tls' or '' = the coarse TLS/raw-TCP signal), app_protocol (nDPI L7 protocol label: 'bittorrent', 'ssh', 'rdp', 'mssql-tds', 'mining', 'rtsp', 'smbv1', ... — find everything speaking a protocol regardless of port), http_method, request_header (substring of the masked HTTP request headers), source_domain (reverse DN…

• top_attackers_tool

  Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top attacking countries', 'most targeted ports', 'most common user agents', 'top ASNs by attack volume', 'top IPs from China', 'top attackers hitting port 22'. 'by' controls grouping: ip, asn, country, port, user_agent, ja4, url_path, domain, cve. by='cve' answers 'what CVEs are being mass-scanned right now' and returns value (the CVE id), title, severity, actively_exploited (on the CISA KEV catalogue), kev_date_added and counts; drill into any of them with cve_lookup. by='cve' does not accept the country/dest_port/a…

• udp_activity_tool

  UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use when a user asks: 'who is sending DNS ANY queries?', 'is anyone querying version.bind?', 'have you seen this QUIC JA4?', 'which UDP ports are being probed?', 'what hits 5060/udp?'. query uses the /udp search grammar, for example 'qtype:ANY', 'qname:version.bind', 'proto:quic', 'port:5060 country:CN', 'ja4:q13d0310h3_55b375c5d22e_cd85d2d88918' or 'quic:3f1a9c2b7d40'; leave it empty for the overview. window is 24h, 7d or 30d. A UDP source address c…

Signals

Stars

2

Forks

0

Open issues

0

Last commit

Sep 24, 2026 (1 month ago)

Last release

Aug 28, 2026 (2 months ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

net.honeylabs/mcp

Version

1.1.0

Auth

Bearer token

License

MIT

Repository

github.com/honeylabshq/honeylabs-mcp

Website

honeylabs.net

First seen

Oct 24, 2026

Last checked

Oct 24, 2026

Source

Official MCP Registrygithub-graphql