Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Authorization not required, issuer https://mcp.honeylabs.net
Added "udp_activity_tool" (10 tools before, 11 now)
UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use when a user asks: 'who is sending DNS ANY queries?', 'is anyone querying version.bind?', 'have you seen this QUIC JA4?', 'which UDP ports are being probed?', 'what hits 5060/udp?'. query uses the /udp search grammar, for example 'qtype:ANY', 'qname:version.bind', 'proto:quic', 'port:5060 country:CN', 'ja4:q13d0310h3_55b375c5d22e_cd85d2d88918' or 'quic:3f1a9c2b7d40'; leave it empty for the overview. window is 24h, 7d or 30d. A UDP source address …
Changed the definition of "fingerprint_search_tool" and "search_events_tool"
⟨53 unchanged words⟩ feeds), 'akin' (HTTP request shape, e.g.a11cun030_00000049_54d07b6db11cun030_00040014_54d07b6d), 'hassh' (SSH client). since/until are ISO-8601 UTC strings.
⟨92 unchanged words⟩ , akin (exact HTTP request fingerprint, e.g.a11cun030_00000049_54d07b6db11cun030_00040014_54d07b6d), has_client_cert (true = only events where ⟨52 unchanged words⟩
Authorization not required, issuer https://mcp.honeylabs.net
Authorization not required, issuer https://mcp.honeylabs.net
Authorization not required, issuer https://mcp.honeylabs.net
Authorization not required, issuer https://mcp.honeylabs.net
Added "fingerprint_similar_tool"; changed the definition of "fingerprint_population_tool", "fingerprint_search_tool" and "search_events_tool" (9 tools before, 10 now)
⟨102 unchanged words⟩ concentrated is this fingerprint?'. fp_type: 'ja4' (TLS), 'akin' (HTTP request shape) or 'hassh' (SSH). Covers the full retained window(no date range).
⟨42 unchanged words⟩ client), 'ja3' (legacy TLS client, MD5—, still keyed by many TI feeds),
Authorization not required, issuer https://mcp.honeylabs.net
Authorization not required, issuer https://mcp.honeylabs.net
Changed the definition of "fingerprint_population_tool", "fingerprint_search_tool" and "search_events_tool"
⟨102 unchanged words⟩ concentrated is this fingerprint?'. fp_type: 'ja4' (TLS),'ja4h' (HTTP),or 'hassh' (SSH). Covers the full retained ⟨5 unchanged words⟩
⟨48 unchanged words⟩ — still keyed by many TI feeds),'ja4h' (HTTP client),'hassh' (SSH client). since/until are ISO-8601 UTC strings.
Authorization not required, issuer https://mcp.honeylabs.net
Changed the definition of "fingerprint_population_tool"
⟨55 unchanged words⟩ two ports, which is a coordinated operationbuying onespreadaddressthinlyperonnetworkpurpose), spread (a common client) or mixed. ⟨51 unchanged words⟩
Authorization not required, issuer https://mcp.honeylabs.net
Authorization not required, issuer https://mcp.honeylabs.net
Authorization not required, issuer https://mcp.honeylabs.net
Certificate recorded, valid to 2026-11-22
Authorization not required, issuer https://mcp.honeylabs.net
First tool surface recorded: 9 tools (server version 1.0.0)
Showing the latest 19 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed
⟨75 unchanged words⟩ substring of the masked HTTP request headers),ja4/ja3source_domain (reverse DNS name, substring), ja4/ja3 (exact TLS client fingerprint), akin (exact HTTP request fingerprint, e.g. a11cun030_00000049_54d07b6d), has_client_cert (true = only events where ⟨52 unchanged words⟩
{"additionalProperties":false,"properties":{"akin":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"app_protocol":{"anyOf":[{"type":"string ⟨88 unchanged words⟩ :null},"since":{"type":"string"},"source_domain":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"source_ip":{"anyOf":[{"type" ⟨13 unchanged words⟩
Request shapes within a few headers of an Akin HTTP fingerprint, with what those clients ask for and call themselves, plus the family the token belongs to. Use when one odd request shape turns up in your own web, WAF or proxy logs and you want to know whether it is a known tool with variants: 'what is close to this fingerprint', 'is this the same scanner with one header added', 'what does this client family go after'. max_distance is in headers, 1 to 4. Only Akin can answer this; a hashed fingerprint changes completely when a header is added.
⟨122 unchanged words⟩ user_agent, url_path, http_request_headers, tls_client_ja4, tls_client_ja3,http_request_ja4htls_client_hello_hex (the raw TLS ClientHello, for verifying or recomputing fingerprints), ssh_client_hassh, tls_client_cert_subject/issuer, event_sequence, event_duration, source_bytes/dest_bytes/network_bytes, network_protocol, application_protocol, timestamp.