Security & Testing

honeylabs.net

Provides tools to query and analyze honeypot attack data, including event search, attacker ranking, IOC lookup, payload search, and attack timelines.

1 endpoint9 known toolsFirst detected July 23, 2026Last detected September 3, 2026

ENDPOINT 1

https://mcp.honeylabs.net/mcp

No auth detected

MCP server metadata

Name: HoneyLabs Threat Intelligence
Version: 1.0.0

Capabilities

tools

Known tools 9

search_events_tool

Return individual raw honeypot events with all fields.

Inferred read-only

top_attackers_tool

Ranked leaderboard of attack sources.

Inferred read-only

ioc_lookup_tool

Look up any IP address, CIDR network, set of networks, or domain in the honeypot dataset.

Inferred read-only

cve_lookup_tool

Who is probing a specific CVE.

Inferred read-only

payload_search_tool

Literal substring search over captured request text: URL path, request body, request headers and event summary.

Inferred read-only

attack_timeline_tool

Attack volume over time, bucketed by hour or day.

Inferred read-only

asn_enrich_tool

Full honeypot profile for an ASN (autonomous system / hosting provider).

Inferred read-only

fingerprint_search_tool

Search honeypot activity by TLS, HTTP, or SSH fingerprint.

Inferred read-only

fingerprint_population_tool

The population behind a single client fingerprint: how many source IPs carry it, across how many networks (ASNs) and countries, the ports they hit, the top networks and a sample of the IPs, plus a read on whether it is concentrated (a likely coordinated operation, many IPs on few networks) or spread thin (a common client).

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.honeylabs-threat-intelligence]
url = "https://mcp.honeylabs.net/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "honeylabs-threat-intelligence": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: honeylabs-threat-intelligence
Remote MCP URL: https://mcp.honeylabs.net/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "honeylabs-threat-intelligence": {
      "url": "https://mcp.honeylabs.net/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "honeylabs-threat-intelligence": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "honeylabs-threat-intelligence",
  "transport": "streamable-http",
  "url": "https://mcp.honeylabs.net/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Trust Data Available

BuiltWith Trust API v2 evidence for honeylabs.net was fetched 2026-07-26T08:11:56.244Z and is being refreshed.

Trust status Trusted

honeylabs.net is assessed as Trusted: Domain has an established technology history spanning over a year.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.