net.honeylabs/mcp

up checked 2026-11-11T15:37:44.782Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

HoneyLabs

Publisher-provided description

Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.

Summary by lookupd

Query honeypot probe data to check IP reputation, scanner activity, CVE probing, and TLS/SSH client fingerprints over time.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http mcp https://mcp.honeylabs.net/mcp

Codex, remote (streamable-http)

codex mcp add mcp --url https://mcp.honeylabs.net/mcp

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "mcp": {
      "url": "https://mcp.honeylabs.net/mcp"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (14 tools)

Publisher-provided text

• search_events_tool Individual honeypot events with every field, newest first, filtered by source, network, port, protocol or fingerprint. Use when the user wants to see the recor
• top_attackers_tool Ranked leaderboard over a time window: the top source addresses, networks, countries, destination ports, user agents, JA4 fingerprints, URL paths, reverse DNS d
• ioc_lookup_tool Everything the sensors hold on one IP address, a CIDR range, several ranges at once, or a domain, with our verdict and the reasons for it. Start here for any qu
• cve_lookup_tool Who is probing one named CVE, and how: counts, top probing addresses, networks, countries, fingerprints, sample request paths and a daily timeline. Use wheneve
• payload_search_tool Literal substring search, ignoring case, over captured request text: URL path, request body, request headers and event summary. Use for "find requests to /wp-a
• attack_timeline_tool Event counts over time, in hourly or daily buckets, optionally filtered by protocol, country or destination port. Use for "show the trend this week", "was ther
• asn_enrich_tool Profile of one autonomous system (a hosting provider, ISP or company network) over a time window: total events, unique addresses, top targeted ports, source cou
• fingerprint_search_tool Events and sources that carried one client fingerprint in a time window. Use for "have you seen this JA4", "which IPs share this TLS fingerprint", "find every
• fingerprint_similar_tool HTTP request shapes within a few headers of one Akin fingerprint, with what those clients request and call themselves, and the family the fingerprint belongs to
• fingerprint_population_tool The population behind one client fingerprint over the full retained window: how many source addresses carry it, across how many networks and countries, the port
• udp_activity_tool UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use for "who
• interactive_credentials_tool Plaintext logins captured by the interactive sensors (sensors that answer as a real service and hold the session): username, password, the service they were tri
• interactive_files_tool Files clients handed to the interactive sensors: uploads, mail attachments, published messages and other artifacts, by SHA-256, with name, size, MIME type, the
• interactive_sessions_tool Sessions one address or range held with the interactive sensors: when, which port and protocol, the service the sensor answered as, the session verdict (scan, c

Details

• Version: 1.2.0
• Transports: streamable-http
• Uptime (7 days): 100%
• Median latency: 876 ms
• First indexed: 2026-11-01T10:07:39.469Z
• Last seen in registry: 2026-11-01T10:07:39.487Z
• Repository: https://github.com/honeylabshq/honeylabs-mcp
• Website: https://honeylabs.net

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/net.honeylabs/mcp.svg)](https://lookupd.com/servers/net.honeylabs/mcp)

• 62071 servers
• Last crawl: 2026-11-11T16:17:25.167Z
• API base: https://api.lookupd.com
• MCP URL: https://api.lookupd.com/mcp