net.honeylabs/mcp · v1.1.0 · security
HoneyLabs is healthy: it completed an MCP handshake in 1144 ms and exposes 14 tools.
Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.
Endpoint: https://mcp.honeylabs.net/mcp (streamable-http)
Repository · Website · JSON · Add to my inventory
| Users (last 30 days) | 0 |
| Handshake | Healthy |
| Auth needed | None |
| Tool count | 14 |
| Latency | 1144 ms |
| Last checked (UTC) | 2026-10-15T12:45:10.058Z |
| Checked (UTC) | Status | Latency | Error |
|---|---|---|---|
| 2026-10-15T12:45:10.058Z | Healthy | 1144 |
search_events_tool | Return individual raw honeypot events with all fields. Use when the user wants to see actual records: 'show me events from this IP', 'what hit port 443 last week', 'events from Russia yesterday'. Filters: source_ip, country (2-letter code), asn (e.g. 'AS12345'), dest_port, protocol ('tls' or '' = th |
top_attackers_tool | Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top attacking countries', 'most targeted ports', 'most common user agents', 'top ASNs by attack volume', 'top IPs from China', 'top attackers hitting port 22'. 'by' controls grouping: ip, asn, country, port, user_agent, ja |
ioc_lookup_tool | Look up any IP address, CIDR network, set of networks, or domain in the honeypot dataset. Use this FIRST whenever the user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?', 'what does this IP do?', 'when was it last seen?', 'is this IP in your data?'. R |
cve_lookup_tool | Who is probing a specific CVE. Use whenever the user names a CVE: 'is CVE-2024-4577 being exploited in the wild?', 'who is scanning for this CVE?', 'show me actors probing CVE-2023-1389'. Returns severity, KEV (actively_exploited), event and unique-IP counts over both sensor types (first_contact_eve |
payload_search_tool | Literal substring search over captured request text: URL path, request body, request headers and event summary. Use for: 'find attacks targeting /wp-admin', 'find requests with this user agent string', 'what payloads hit port 80 last week'. It matches text that literally appeared in the request, an |
attack_timeline_tool | Attack volume over time, bucketed by hour or day. Use for: 'show attack trends this week', 'was there a spike on port 22?', 'how has SSH scanning changed?', 'attack volume from China over 30 days'. bucket: 'hour' or 'day'. Optional filters: filter_protocol ('tls'/'''), filter_country (2-letter code) |
asn_enrich_tool | Full honeypot profile for an ASN (autonomous system / hosting provider). Use for: 'tell me about AS202425', 'what is Vultr doing in my honeypots?', 'attacks from this hosting provider', 'attribute this IP to its network'. asn format: 'AS12345'. Returns: total events, unique IPs, top targeted ports, |
fingerprint_search_tool | Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks: 'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?', 'how common is this HASSH?', 'find all scanners with this SSH client fingerprint'. fp_type: 'ja4' (TLS client), 'ja3' (legacy TLS client, M |
fingerprint_similar_tool | Request shapes within a few headers of an Akin HTTP fingerprint, with what those clients ask for and call themselves, plus the family the token belongs to. Use when one odd request shape turns up in your own web, WAF or proxy logs and you want to know whether it is a known tool with variants: 'what |
fingerprint_population_tool | The population behind a single client fingerprint: how many source IPs carry it, across how many networks (ASNs) and countries, the ports they hit, the top networks and a sample of the IPs, plus a read on its shape: concentrated (many IPs on few networks), dispersed (many networks but one short burs |
udp_activity_tool | UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use when a user asks: 'who is sending DNS ANY queries?', 'is anyone querying version.bind?', 'have you seen this QUIC JA4?', 'which UDP ports are being pr |
feint_credentials_tool | Plaintext logins captured by the interactive (Feint) sensors: username, password, the service they were tried on, the outcome and the source address, newest first, plus the pairs tried most and a per-service breakdown. Use when a user asks: 'what passwords are attackers trying on SSH?', 'which crede |
feint_files_tool | Files clients handed to the interactive (Feint) sensors: uploads, mail attachments, published messages and other artifacts, by SHA-256, with name, size, MIME type, the sessions that carried them and the VirusTotal verdict when the collector has one. Use when a user asks: 'have you seen this hash?', |
feint_sessions_tool | Sessions one address or range held with the interactive (Feint) sensors: when, which port and protocol, the persona answered as, the verdict (scan, credential, exploit), labels, turns, bytes, duration, CVE ids evidenced by the payload, path-only CVE candidates and the download URLs the client named, |