Honey Labs MCP Server

Honeypot threat intelligence as MCP tools. Query 90 days of probe data from our honeypot sensor network: IP reputation, scanner classification, CVE probing trends, TLS/SSH fingerprints (JA4, JA3, JA4H, HASSH), mTLS client certificates, Community ID flow hashes, and attack timelines. Use it straight from Claude, Cursor, Gemini, Cline, or any other Model Context Protocol client. Its 8 documented tools cluster into ioc, top, read & search, attack. It is available as a remote MCP endpoint.

Teams that want a hosted security endpoint instead of running a local process. The project is written in Python.

VERIFIED ACTIVE

LAST COMMIT 2026-08-19 · ★ 2 · #155 OF 182 MAINTAINED SECURITY · VERIFIED 2026-08-25

MIT · Python servers · how we verify → /methodology

01 · Install Honey Labs

Claude Code

claude mcp add honeylabshq-honeylabs-mcp --transport http https://mcp.honeylabs.net/mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "honeylabshq-honeylabs-mcp": {
      "url": "https://mcp.honeylabs.net/mcp"
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

https://mcp.honeylabs.net/mcp

transport: streamable-http

endpoint alive - responded to MCP initialize · probed 2026-08-25

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as remote - your agent's requests go to mcp.honeylabs.net

endpoint auth accepted our unauthenticated MCP initialize - no credentials needed to connect

license MIT - declared in the repository

registry vendor namespace net.honeylabs - domain-verified with the official MCP registry

03 · What Honey Labs can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

An agent gets 8 documented tools across ioc, top, read & search, including ioc_lookup, top_attackers, search_events, attack_timeline.

Capability map

Tools grouped from the project's README - what Honey Labs lets an agent do.

Ioc

1 tool - e.g. Is this IP / domain known to be probing? Returns our verdict, whether it is a recognised benign scanner, the CVEs it probed, plus ports / paths / fingerprints.

ioc_lookup

Top

1 tool - e.g. Ranked leaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (by='cve') over a time window.

top_attackers

read & search

1 tool - e.g. Raw honeypot events matching filters (IP, ASN, country, dest_port, protocol, http_method, ja4/ja3, community_id, has_client_cert).

search_events

Attack

1 tool - e.g. Hourly / daily attack volume over a window, with protocol / country / port filters.

attack_timeline

Asn

1 tool - e.g. Full profile for an ASN: total events, unique IPs, top ports, source countries, user-agents, org name.

asn_enrich

Fingerprint

1 tool - e.g. Search by TLS JA4 / JA3 / HTTP JA4H / SSH HASSH fingerprint to find shared infrastructure.

fingerprint_search

Cve

1 tool - e.g. Who is probing a named CVE: severity, KEV status, top probing IPs with ASN and scanner tag, fingerprints, sample paths, daily timeline.

cve_lookup

Payload

1 tool - e.g. Full-text URL-path + user-agent search across attack traffic.

payload_search

Latest releases

v1.0.0 · 2026-05-31

04 · Who maintains Honey Labs

HoneyLabs is maintained by honeylabshq. It's the only MCP server we track from this author; the repo dates to May 2026.

05 · Facts

repository: github.com/honeylabshq/honeylabs-mcp
website: https://honeylabs.net/
category: security - ranked #155 of 182 actively-maintained security servers as of 2026-08-25.
release cadence: 1 release in the last 90 days (latest 2026-05-31)
registry: net.honeylabs/mcp (active, first published 2026-05-20)

06 · Honey Labs FAQ

Is Honey Labs still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-19 and it shipped 1 release in the last 90 days. We re-verify nightly.

What can Honey Labs do?

An agent gets 8 documented tools across ioc, top, read & search, including ioc_lookup, top_attackers, search_events, attack_timeline.

How do I install Honey Labs?

Run `claude mcp add honeylabshq-honeylabs-mcp --transport http https://mcp.honeylabs.net/mcp`. You can also paste the ready-made client config above.

Does Honey Labs require authentication?

No - the endpoint accepted our unauthenticated MCP initialize when probed on 2026-08-25; you can connect without credentials.

07 · Alternatives to Honey Labs

Alternatives to Honey Labs

Maintained security servers if Honey Labs isn't the fit.

Pairs well with

Servers that cover what Honey Labs doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · Q Ring · IdentArk Gateway · Thumb Gate · Inkog · Ironclaw

More Python MCP servers · Horizun PBI MCP · Archy · Claude Real Video · Onsense · Hummingbot MCP Server · see all