{"name":"net.honeylabs/mcp","slug":"honeylabs-mcp","title":"HoneyLabs","description":"Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.","url":"https://mcp.market/server/honeylabs-mcp","rating":null,"grade":"A","score":88,"certified":false,"status":"active","category":"security","tags":["security"],"presence":{"score":28,"stars":2,"forks":0,"downloads_week":null,"last_push_at":"2026-10-29T14:16:21.000Z","license":"MIT"},"uptime":{"percent":100,"checks":28,"ok":28,"last_checked_at":"2026-11-05T13:26:01.399Z","last_ok_at":"2026-11-05T13:26:01.399Z","latency_ms":173},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/honeylabshq/honeylabs-mcp","website":"https://honeylabs.net","version":"1.2.0","remotes":[{"type":"streamable-http","url":"https://mcp.honeylabs.net/mcp","headers":[{"description":"Bearer <hlk_…> API key from https://honeylabs.net/dashboard. Clients that support OAuth 2.1 need no key: the server advertises Dynamic Client Registration via WWW-Authenticate and /.well-known/oauth-protected-resource.","isRequired":true,"isSecret":true,"name":"Authorization"}]}],"packages":[],"tools":[{"name":"asn_enrich_tool","description":"Profile of one autonomous system (a hosting provider, ISP or company network)\nover a time window: total events, unique addresses, top targeted ports, source\ncountries, top user agents and the organisation name.\n\nUse for \"tell me about AS202425\", \"what is this hosting provider doing\", \"is\nthis network a source of scanning\". To attribute one address to its network,\nioc_lookup_tool already returns the ASN; call this one afterwards for the\nnetwork's wider behaviour. To rank networks against each other, use\ntop_attackers_tool with by='asn'.\n\nasn: 'AS12345' or '12345'. since and until are ISO-8601 UTC within the plan's\nquery window.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"asn":{"type":"string"},"since":{"type":"string"},"until":{"type":"string"}},"required":["asn","since","until"],"additionalProperties":false}},{"name":"attack_timeline_tool","description":"Event counts over time, in hourly or daily buckets, optionally filtered by\nprotocol, country or destination port.\n\nUse for \"show the trend this week\", \"was there a spike on port 22\", \"how has\nSSH scanning changed over 30 days\". Do not use it to find who caused a spike\n(follow up with top_attackers_tool on the same window and filter) or to see\nthe events themselves (use search_events_tool).\n\nbucket: 'hour' or 'day' (default). filter_protocol: 'tls', or '' for raw TCP.\nfilter_country: ISO two-letter code. filter_dest_port: a port number. since\nand until are ISO-8601 UTC within the plan's query window. Counts are raw\ntotals from the first-contact sensors.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"since":{"type":"string"},"until":{"type":"string"},"bucket":{"default":"day","type":"string"},"filter_protocol":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"filter_country":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"filter_dest_port":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null}},"required":["since","until"],"additionalProperties":false}},{"name":"cve_lookup_tool","description":"Who is probing one named CVE, and how: counts, top probing addresses, networks,\ncountries, fingerprints, sample request paths and a daily timeline.\n\nUse whenever the user names a CVE: \"is CVE-2024-4577 being exploited in the\nwild\", \"who scans for CVE-2023-1389\", \"has anyone probed this before it was\npublished\". Do not pass a CVE id to payload_search_tool: the id is our label\nfor a detection pattern and never appears in request text. For the list of\nCVEs being probed right now, use top_attackers_tool with by='cve'.\n\nReturns title, severity, actively_exploited and kev (the CISA KEV entry with\ndate_added, or null), event and unique-address counts across both sensor\ntypes (first_contact_events and interactive_requests split them; an address\nboth saw counts once), up to `limit` top probing addresses (1 to 25, default\n25) with country, ASN and scanner (name and kind of a recognised research or\nvendor scanner, else null), top networks and countries, exploiter\nfingerprints, sample paths, a daily timeline and `interactive` (what the\ninteractive sensors recorded of the probes).\n\nwindow: 24h, 7d (default), 30d or 90d, and on plans with the full history also\n180d, 365d or all. observed: false with a note means we hold no detection\npattern for that CVE, which is not evidence that nobody is scanning for it.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"cve_id":{"type":"string"},"window":{"default":"7d","type":"string"},"limit":{"default":25,"type":"integer"}},"required":["cve_id"],"additionalProperties":false}},{"name":"fingerprint_population_tool","description":"The population behind one client fingerprint over the full retained window:\nhow many source addresses carry it, across how many networks and countries,\nthe ports they hit, the top networks, a sample of addresses, and a read on its\nshape.\n\nUse for \"is this JA4 one botnet or a common tool\", \"how many networks use this\nHASSH\", \"how concentrated is this fingerprint\". The concentration field says\nconcentrated (many addresses on few networks), dispersed (many networks in one\nshort burst on one or two ports, a coordinated operation spread thinly on\npurpose), spread (a common client) or mixed; concentrated and dispersed both\npoint to one operator. For the individual events, use\nfingerprint_search_tool with a time window.\n\nfp_type: 'ja4' (TLS; a QUIC JA4 starting with q is answered from UDP traffic,\nwhose sources can be forged), 'akin' (HTTP request shape) or 'hassh' (SSH).\nNo date range: it reads everything retained.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"fingerprint":{"type":"string"},"fp_type":{"type":"string"}},"required":["fingerprint","fp_type"],"additionalProperties":false}},{"name":"fingerprint_search_tool","description":"Events and sources that carried one client fingerprint in a time window.\n\nUse for \"have you seen this JA4\", \"which IPs share this TLS fingerprint\",\n\"find every scanner with this SSH client fingerprint\". For how widespread a\nfingerprint is and whether it is one operation or a common client, use\nfingerprint_population_tool. For HTTP request shapes a few headers away from an\nAkin fingerprint, use fingerprint_similar_tool. A JA4 that starts with q comes\nfrom QUIC over UDP and is answered by udp_activity_tool.\n\nfp_type: 'ja4' (TLS client), 'ja3' (legacy TLS client hash, still keyed by\nmany feeds), 'akin' (HTTP request shape, such as b11cun030_00040014_54d07b6d)\nor 'hassh' (SSH client). since and until are ISO-8601 UTC within the plan's\nquery window. limit is 1 to 200, default 50.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"fingerprint":{"type":"string"},"fp_type":{"type":"string"},"since":{"type":"string"},"until":{"type":"string"},"limit":{"default":50,"type":"integer"}},"required":["fingerprint","fp_type","since","until"],"additionalProperties":false}},{"name":"fingerprint_similar_tool","description":"HTTP request shapes within a few headers of one Akin fingerprint, with what\nthose clients request and call themselves, and the family the fingerprint\nbelongs to.\n\nUse when an unfamiliar request shape turns up in your own web server, WAF or\nproxy logs and you want to know whether it is a known tool or a variant of\none: \"what is close to this fingerprint\", \"is this the same scanner with one\nheader added\". Only Akin fingerprints work here, because a hashed fingerprint\nsuch as JA4 changes completely when one header is added. For the sources that\ncarried the exact fingerprint, use fingerprint_search_tool.\n\nfingerprint: an Akin token such as b11cun030_00040014_54d07b6d. max_distance:\n1 to 4 headers, default 2. limit: 1 to 25 neighbours, default 8.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"fingerprint":{"type":"string"},"max_distance":{"default":2,"type":"integer"},"limit":{"default":8,"type":"integer"}},"required":["fingerprint"],"additionalProperties":false}},{"name":"interactive_credentials_tool","description":"Plaintext logins captured by the interactive sensors (sensors that answer as a\nreal service and hold the session): username, password, the service they were\ntried on, the outcome and the source address, newest first, plus the pairs\ntried most and a per-service breakdown.\n\nUse for \"what passwords are attackers trying on SSH\", \"which credentials did\nthis IP try\", \"what logins hit MySQL this week\". For whether an address is\nhostile overall, use ioc_lookup_tool; for the rest of what it did in its\nsessions, use interactive_sessions_tool.\n\nservice: a service name such as ssh-password, telnet-login, mysql-login,\nrdp-credssp or smb-ntlmssp, or empty for all. source: an address or CIDR, or\nempty for all. window: 24h, 7d (default) or 30d, capped at the plan's query\nwindow. limit: 1 to 200, default 50. These records feed no verdict, and\nioc_lookup_tool does not include them.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"service":{"default":"","type":"string"},"source":{"default":"","type":"string"},"window":{"default":"7d","type":"string"},"limit":{"default":50,"type":"integer"}},"additionalProperties":false}},{"name":"interactive_files_tool","description":"Files clients handed to the interactive sensors: uploads, mail attachments,\npublished messages and other artifacts, by SHA-256, with name, size, MIME\ntype, the sessions that carried them and the VirusTotal verdict when one is\nknown.\n\nUse for \"have you seen this hash\", \"what files did this IP upload\", \"which\nmalware samples reached the honeypots this month\". For files referenced by\nURL in exploit payloads rather than delivered in a session, use\npayload_search_tool with the URL or path.\n\nsha256: one hash, or empty for every file in the window. source: an address\nor CIDR, or empty. window: 24h, 7d or 30d (default), capped at the plan's\nquery window. limit: 1 to 200, default 50.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"sha256":{"default":"","type":"string"},"source":{"default":"","type":"string"},"window":{"default":"30d","type":"string"},"limit":{"default":50,"type":"integer"}},"additionalProperties":false}},{"name":"interactive_sessions_tool","description":"Sessions one address or range held with the interactive sensors: when, which\nport and protocol, the service the sensor answered as, the session verdict\n(scan, credential or exploit), labels, turns, bytes, duration, CVE ids proven\nby the payload, path-only CVE candidates and the download URLs the client\nnamed, newest first, with verdict, service and port breakdowns.\n\nUse after ioc_lookup_tool when the question is what an address did inside a\nsession: \"what did this IP do on the honeypots\", \"did this range get past a\nlogin\", \"which exploits did it try\". For the logins alone, use\ninteractive_credentials_tool; for files it delivered, interactive_files_tool.\n\nsource is required: an address or CIDR. window: 24h, 7d (default) or 30d,\ncapped at the plan's query window. limit: 1 to 200, default 50.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"source":{"type":"string"},"window":{"default":"7d","type":"string"},"limit":{"default":50,"type":"integer"}},"required":["source"],"additionalProperties":false}},{"name":"ioc_lookup_tool","description":"Everything the sensors hold on one IP address, a CIDR range, several ranges at\nonce, or a domain, with our verdict and the reasons for it. Start here for any\nquestion about a specific indicator.\n\nUse for \"is this IP malicious\", \"is this a known scanner\", \"have you seen this\naddress\", \"when was it last seen\", \"have any of this vendor's ranges touched\nyou\". Do not use it to rank many sources (use top_attackers_tool), to profile a\nwhole ASN (use asn_enrich_tool), or to list raw events (use\nsearch_events_tool). For what an address did inside sessions with the\ninteractive sensors, follow up with interactive_sessions_tool.\n\nReturns total_events (0 means never observed in the window), first_seen,\nlast_seen, country, ASN, the 50 most-hit ports with ports_targeted_count, top\nuser agents and URL paths, TLS/HTTP/SSH fingerprints, cve_probes (the CVE\nsignatures it was seen probing), verdict (a sentence), verdict_key (a stable\nvalue to alert on: scanner, tor, malicious, scanning, probing or none),\nverdict_why (the signals behind it) and scanner (the identity of a recognised\nresearch scanner, else null). Report the verdict with its reasons. A high\ncount from a recognised scanner is research traffic, not an attack. A single\naddress may also carry udp_unverified: UDP traffic that claimed it as source,\nwhich can be forged and never counts against it.\n\ndays limits the lookback. Leave it unset for a single address to read every\nretained event. A CIDR or domain defaults to 90 days because neither can use\nan index; pass days to change that. The response names the window it used in\n`window`; quote it with any count.\n\nPass ranges as one string separated by commas, spaces or newlines\n('103.66.28.0/22, 8.34.210.32/27'). Never expand a range into addresses and\nloop: one call answers it, and looping burns the daily credits. A range answer\nhas query_type 'cidr' or 'cidr_set', per_range counts and top_source_ips.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"ioc":{"type":"string"},"days":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null}},"required":["ioc"],"additionalProperties":false}},{"name":"payload_search_tool","description":"Literal substring search, ignoring case, over captured request text: URL path,\nrequest body, request headers and event summary.\n\nUse for \"find requests to /wp-admin\", \"which requests carried this user agent\nstring\", \"who sent '../../etc/passwd' last week\". It matches text that\nappeared in the request and nothing else, so these return nothing:\n  - a CVE id ('CVE-2024-4577'). Use cve_lookup_tool; this tool rejects CVE ids.\n  - a product or vendor name ('Cisco FMC'). Search the path the product\n    exposes instead, such as '/ccmadmin'.\n  - a description of behaviour ('SQL injection'). Search a marker that\n    occurs in the traffic, such as 'UNION SELECT'.\nFor a fingerprint use fingerprint_search_tool; for events from one source use\nsearch_events_tool.\n\nAn empty list is a real answer: no captured request in the window contained\nthe string. Widen since and until before concluding the activity does not\nexist. since and until are ISO-8601 UTC within the plan's query window. limit\nis 1 to 100, default 50.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"query":{"type":"string"},"since":{"type":"string"},"until":{"type":"string"},"limit":{"default":50,"type":"integer"}},"required":["query","since","until"],"additionalProperties":false}},{"name":"search_events_tool","description":"Individual honeypot events with every field, newest first, filtered by source,\nnetwork, port, protocol or fingerprint.\n\nUse when the user wants to see the records themselves: \"show me the events from\nthis IP\", \"what hit port 443 yesterday\", \"every request carrying this JA4\",\n\"all RDP traffic regardless of port\". Do not use it to judge one address (use\nioc_lookup_tool), to rank or count (use top_attackers_tool or\nattack_timeline_tool), to search request text (use payload_search_tool), or for\na CVE (use cve_lookup_tool).\n\nFilters, all optional and combined with AND: source_ip, country (ISO 3166\ntwo-letter code), asn ('AS12345'), dest_port, protocol ('tls', or '' for raw\nTCP), app_protocol (detected layer-7 protocol such as 'ssh', 'rdp',\n'mssql-tds', 'rtsp', 'smbv1', 'bittorrent' or 'mining', whatever the port),\nhttp_method, request_header (substring of the masked request headers),\nsource_domain (reverse DNS substring), ja4 or ja3 (exact TLS client\nfingerprint), akin (exact HTTP request fingerprint such as\nb11cun030_00040014_54d07b6d), has_client_cert (true for clients that presented\nan mTLS certificate), ip_version (4 or 6). limit is 1 to 500, default 100.\n\nsince and until are ISO-8601 UTC timestamps; the span between them may not\nexceed the query window of the caller's plan (https://honeylabs.net/pricing.json).\nEach record carries source_ip, country, asn, dest_port, user_agent, url_path,\nhttp_request_headers, tls_client_ja4, tls_client_ja3, tls_client_hello_hex (the\nraw ClientHello), ssh_client_hassh, tls_client_cert_subject and issuer,\nevent_sequence, event_duration, byte counts, network_protocol,\napplication_protocol and timestamp. TCP events from first-contact sensors only.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"since":{"type":"string"},"until":{"type":"string"},"source_ip":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"country":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"asn":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"dest_port":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null},"protocol":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"app_protocol":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"http_method":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"source_domain":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"request_header":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"ja4":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"ja3":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"akin":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"has_client_cert":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null},"ip_version":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null},"limit":{"default":100,"type":"integer"}},"required":["since","until"],"additionalProperties":false}},{"name":"top_attackers_tool","description":"Ranked leaderboard over a time window: the top source addresses, networks,\ncountries, destination ports, user agents, JA4 fingerprints, URL paths, reverse\nDNS domains or CVEs by event count.\n\nUse for \"who is attacking the most\", \"top countries hitting port 22\", \"most\ntargeted ports this week\", \"top networks by volume\", and with by='cve' for\n\"which CVEs are being scanned for right now\". Do not use it for one known\naddress (use ioc_lookup_tool), one known network (use asn_enrich_tool), one\nknown CVE (use cve_lookup_tool), or a trend over time (use\nattack_timeline_tool).\n\nby: ip, asn, country, port, user_agent, ja4, url_path, domain or cve (default\nip). limit is 1 to 100, default 20. Optional filters country (ISO code),\ndest_port and asn ('AS12345'); add one when the window is long, because an\nunfiltered ranking over many days can hit the query memory limit. by='cve'\ntakes no filters and returns value (the CVE id), title, severity,\nactively_exploited (on the CISA KEV catalogue), kev_date_added and counts.\nsince and until are ISO-8601 UTC, within the plan's query window.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"since":{"type":"string"},"until":{"type":"string"},"by":{"default":"ip","type":"string"},"limit":{"default":20,"type":"integer"},"country":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"dest_port":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null},"asn":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null}},"required":["since","until"],"additionalProperties":false}},{"name":"udp_activity_tool","description":"UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and\nother UDP probes, with the ports, networks and countries involved.\n\nUse for \"who is sending DNS ANY queries\", \"is anyone querying version.bind\",\n\"have you seen this QUIC JA4\", \"which UDP ports are probed\", \"what hits\n5060/udp\". Every other tool reads TCP only, so UDP questions belong here. A\nUDP source address can be forged: treat each address as claimed, never as\nevidence against it, and do not feed it to ioc_lookup_tool as proof.\n\nquery uses the /udp search grammar: 'qtype:ANY', 'qname:version.bind',\n'proto:quic', 'port:5060 country:CN',\n'ja4:q13d0310h3_55b375c5d22e_cd85d2d88918' or 'quic:3f1a9c2b7d40'; leave it\nempty for the overview. window: 24h, 7d (default) or 30d, shortened to the\nplan's query window when that is shorter (window_notice then says so).\nsamples: 0 to 25 example datagrams, default 10.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"query":{"default":"","type":"string"},"window":{"default":"7d","type":"string"},"samples":{"default":10,"type":"integer"}},"additionalProperties":false}}],"scan":{"score":88,"grade":"A","scanned_at":"2026-10-30T06:02:49.526Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-30T06:02:49.473Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 1641ms"]},"poisoning":{"score":15,"max":15,"notes":["14 tool descriptions checked"]},"auth":{"score":8,"max":15,"notes":["API key sent as a header"]},"maintenance":{"score":15,"max":15,"notes":["last push 1 days ago"]},"identity":{"score":8,"max":10,"notes":["endpoint served from the registry-verified namespace domain"]}},"findings":[],"inputs":{"probes":[{"url":"https://mcp.honeylabs.net/mcp","reachable":true,"authRequired":false,"latencyMs":1641,"serverInfo":{"name":"HoneyLabs Threat Intelligence","version":"1.2.0"}}],"packages":[],"repo":{"found":true,"owner":"honeylabshq","repo":"honeylabs-mcp","archived":false,"pushedAt":"2026-10-29T14:16:21Z","stars":2,"forks":0,"openIssues":2,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/263323790?v=4","ownerCreatedAt":"2026-02-23T08:37:36Z","license":"MIT"},"icon":{"url":"https://honeylabs.net/icon.svg?icon.14u05png-dvbx.svg","source":"registry"},"presence":{"stars":2,"forks":0,"downloadsWeek":null,"license":"MIT","lastPushAt":"2026-10-29T14:16:21.000Z","score":28}}}},"grade_history":[{"kind":"restore","fromGrade":"B","toGrade":"A","reason":"score 88","createdAt":"2026-10-30T06:02:52.134Z"}],"reviews":[]}