# HoneyLabs (honeylabs.net)

Queries captured honeypot traffic by source address, port, CVE or payload, and exposes the results over an API and MCP server.

- Atlas card: https://inite.ai/en/atlas/honeylabs.net
- Site: https://honeylabs.net
- For: SOC and security teams who want honeypot threat intelligence in their SIEM, MISP, or AI assistant
- Use 0/100 · alive 100/100

## Used for

- check an IP address or network against captured attacker activity
- push captured scanning and login data into existing SIEM tools
- ask an AI assistant which commands attackers ran on sensors

## Price

- from 29 EUR/month, free plan (read 2026-10-26 on https://honeylabs.net/pricing)

## For developers

- OpenAPI: https://honeylabs.net/openapi.json (12 paths)
- MCP server: net.honeylabs/mcp (namespace; open on 2026-10-26, 14 tools)
- MCP server card: https://honeylabs.net/.well-known/mcp.json
- Read 2026-10-26

## MCP server, measured daily

Server: https://mcp.honeylabs.net/mcp, checked every day since 2026-10-26 (10 checks).

- Answered: 100% of daily checks
- Median first answer: 498 ms
- Sign-in: none
- Context its tool definitions take: about 4884 tokens (14 tools)
- Tool definitions: B, 83/100
- Failing "params_described": 14 of 14 tools
- Method: https://inite.ai/en/atlas/mcp/report

## Your data

- Certifications stated: gdpr
- Read 2026-10-26

---

Source: INITE Atlas, https://inite.ai/en/atlas/honeylabs.net. JSON: https://inite.ai/api/atlas/honeylabs.net. MCP: https://inite.ai/api/mcp (atlas_lookup).