HoneyLabs

Name: HoneyLabs
Author: net.honeylabs

MCP serverMCP

Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.

by net.honeylabsrepository ↗homepage ↗v1.1.0

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"honeylabs","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability109/109 checks ok

when	check	result	http	latency	detail
3 h ago	mcp initialize	ok	200	31 ms	server HoneyLabs Threat Intelligence 1.0.0 · protocol 2025-06-18 · 11 tools
10 h ago	mcp initialize	ok	200	21 ms	server HoneyLabs Threat Intelligence 1.0.0 · protocol 2025-06-18 · 11 tools
17 h ago	mcp initialize	ok	200	22 ms	server HoneyLabs Threat Intelligence 1.0.0 · protocol 2025-06-18 · 11 tools
23 h ago	mcp initialize	ok	200	27 ms	server HoneyLabs Threat Intelligence 1.0.0 · protocol 2025-06-18 · 11 tools
29 h ago	mcp initialize	ok	200	50 ms	server HoneyLabs Threat Intelligence 1.0.0 · protocol 2025-06-18 · 11 tools
2 d ago	mcp initialize	ok	200	41 ms	server HoneyLabs Threat Intelligence 1.0.0 · protocol 2025-06-18 · 11 tools
2 d ago	mcp initialize	ok	200	47 ms	server HoneyLabs Threat Intelligence 1.0.0 · protocol 2025-06-18 · 11 tools
2 d ago	mcp initialize	ok	200	27 ms	server HoneyLabs Threat Intelligence 1.0.0 · protocol 2025-06-18 · 11 tools
2 d ago	mcp initialize	ok	200	57 ms	server HoneyLabs Threat Intelligence 1.0.0 · protocol 2025-06-18 · 11 tools
3 d ago	mcp initialize	ok	200	32 ms	server HoneyLabs Threat Intelligence 1.0.0 · protocol 2025-06-18 · 11 tools

Tools observed via MCP handshake

search_events_tool — Return individual raw honeypot events with all fields. Use when the user wants to see actual records: 'show me events from this IP', 'what hit port 443 last wee
top_attackers_tool — Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top attacking countries', 'most targeted ports', 'most common user agents', 'top A
ioc_lookup_tool — Look up any IP address, CIDR network, set of networks, or domain in the honeypot dataset. Use this FIRST whenever the user asks: 'is this IP malicious?'
cve_lookup_tool — Who is probing a specific CVE. Use whenever the user names a CVE: 'is CVE-2024-4577 being exploited in the wild?', 'who is scanning for this CVE?', 'show me act
payload_search_tool — Literal substring search over captured request text: URL path, request body, request headers and event summary. Use for: 'find attacks targeting /wp-admin', 'fi
attack_timeline_tool — Attack volume over time, bucketed by hour or day. Use for: 'show attack trends this week', 'was there a spike on port 22?', 'how has SSH scanning changed?', 'at
asn_enrich_tool — Full honeypot profile for an ASN (autonomous system / hosting provider). Use for: 'tell me about AS202425', 'what is Vultr doing in my honeypots?', 'attacks fro
fingerprint_search_tool — Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks: 'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?',
fingerprint_similar_tool — Request shapes within a few headers of an Akin HTTP fingerprint, with what those clients ask for and call themselves, plus the family the token belongs to. Use
fingerprint_population_tool — The population behind a single client fingerprint: how many source IPs carry it, across how many networks (ASNs) and countries, the ports they hit, the top netw
udp_activity_tool — UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use when a use

Declared by sources

What the publisher says

Attributed to the source that supplied each field. Treated as claims, not facts.

No long description beyond the summary.

kind Official MCP Registry

name Official MCP Registry

repoUrl Official MCP Registry

summary Official MCP Registry

version Official MCP Registry

description Official MCP Registry

homepageUrl Official MCP Registry

publisherName Official MCP Registry

Provenance

Where this record came from

Every source is kept verbatim. Field changes are logged as events.

Official MCP Registrynet.honeylabs/mcp

first seen 1 mo ago · fetched 31 h agoopen ↗

Field history (7 recent events)

1 mo ago · declared · summary → "Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints."
1 mo ago · declared · description → "Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints."
1 mo ago · declared · publisherName → "net.honeylabs"
1 mo ago · declared · homepageUrl → "https://honeylabs.net"
1 mo ago · declared · repoUrl → "https://github.com/honeylabshq/honeylabs-mcp"
1 mo ago · declared · version → "1.1.0"
1 mo ago · declared · protocols → ["mcp"]

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from