HoneyLabs MCP server

• Registry namenet.honeylabs/mcpverified in the MCP registry

The registry name sits under honeylabs.net. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

• Stateanswerschecked 2026-10-26
• Tools14
• Server calls itselfHoneyLabs Threat Intelligence
• Server version1.0.0
• Protocol version2025-06-18

On 2026-10-26 the server answered initialize and tools/list without a sign-in. First answer in 482 ms.

• Its tools do check an IP address or network against captured attacker activity, but not push captured scanning and login data into existing SIEM tools.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

• INITE MCP score74 of 100answers 100 · does the job 50 · definitions 83 · context 87 · use 12 · connects 100
• What an agent can do with it1 of 2 use cases
• Use2 GitHub stars
• Answered100% of days10 of 10 daily checks
• Median first answer498 ms
• Space in an agent's context≈ 4,884 tokensthe definitions of all its tools (14), which an agent carries on every turn
• Tool definitionsB · 83 of 100
• Typed results14 of 14 toolsdeclared outputSchema: results come typed, read once

• Parameters without a description: in 14 of 14

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

• search_events_tool

  Return individual raw honeypot events with all fields. Use when the user wants to see actual records: 'show me events from this IP', 'what hit port 443 last week', 'events from Russia yesterday'. Filters: source_ip, country (2-letter…

• top_attackers_tool

  Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top attacking countries', 'most targeted ports', 'most common user agents', 'top ASNs by attack volume', 'top IPs from China', 'top attackers hitting port 22'…

• ioc_lookup_tool

  Look up any IP address, CIDR network, set of networks, or domain in the honeypot dataset. Use this FIRST whenever the user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?', 'what does this IP do?', 'when…

• cve_lookup_tool

  Who is probing a specific CVE. Use whenever the user names a CVE: 'is CVE-2024-4577 being exploited in the wild?', 'who is scanning for this CVE?', 'show me actors probing CVE-2023-1389'. Returns title, severity, KEV status…

• payload_search_tool

  Literal substring search over captured request text: URL path, request body, request headers and event summary. Use for: 'find attacks targeting /wp-admin', 'find requests with this user agent string', 'what payloads hit port 80 last…

• attack_timeline_tool

  Attack volume over time, bucketed by hour or day. Use for: 'show attack trends this week', 'was there a spike on port 22?', 'how has SSH scanning changed?', 'attack volume from China over 30 days'. bucket: 'hour' or 'day'. Optional…

• asn_enrich_tool

  Full honeypot profile for an ASN (autonomous system / hosting provider). Use for: 'tell me about AS202425', 'what is Vultr doing in my honeypots?', 'attacks from this hosting provider', 'attribute this IP to its network'. asn format…

• fingerprint_search_tool

  Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks: 'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?', 'how common is this HASSH?', 'find all scanners with this SSH client…

• fingerprint_similar_tool

  Request shapes within a few headers of an Akin HTTP fingerprint, with what those clients ask for and call themselves, plus the family the token belongs to. Use when one odd request shape turns up in your own web, WAF or proxy logs and you…

• fingerprint_population_tool

  The population behind a single client fingerprint: how many source IPs carry it, across how many networks (ASNs) and countries, the ports they hit, the top networks and a sample of the IPs, plus a read on its shape: concentrated (many IPs…

• udp_activity_tool

  UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use when a user asks: 'who is sending DNS ANY queries?', 'is anyone querying version.bind?'…

• feint_credentials_tool

  Plaintext logins captured by the interactive (Feint) sensors: username, password, the service they were tried on, the outcome and the source address, newest first, plus the pairs tried most and a per-service breakdown. Use when a user…

• feint_files_tool

  Files clients handed to the interactive (Feint) sensors: uploads, mail attachments, published messages and other artifacts, by SHA-256, with name, size, MIME type, the sessions that carried them and the VirusTotal verdict when the…

• feint_sessions_tool

  Sessions one address or range held with the interactive (Feint) sensors: when, which port and protocol, the persona answered as, the verdict (scan, credential, exploit), labels, turns, bytes, duration, CVE ids evidenced by the payload…