HoneyLabs — Claude Code MCP server: what it does, how to install
Connects agents to 90 days of honeypot telemetry. Lets you look up malicious IPs, track active CVE probes, and inspect TLS or SSH fingerprints.
claude mcp add --transport http honeylabs https://mcp.honeylabs.net/mcpWhat HoneyLabs does
HoneyLabs exposes raw sensor telemetry through a hosted HTTP endpoint at https://mcp.honeylabs.net/mcp. An AI assistant gets nine security tools out of the box. They handle reputation lookups on suspicious IPs (ioc_lookup), monitor CVE scanning activity (cve_lookup), and pull network profiles for target autonomous systems (asn_enrich).
The underlying sensors log connection attempts, HTTP paths, JA3/JA4 TLS signatures, and SSH HASSH fingerprints. Investigators can inspect attack timelines across specific ports or hunt for related infrastructure using Akin HTTP signatures and mTLS client certificates.
A free API key yields 500 response rows every day. Because each returned row consumes one credit, unrestricted event queries will burn through that allocation quickly.
What it helps with
- Check if an IP address belongs to known scanning infrastructure
- Identify networks probing a specific CVE across recent days
- Cluster malicious traffic using TLS JA4 and SSH HASSH hashes
- Filter honeypot attack traffic by port, ASN, or payload paths
Example prompts for the agent
- Inspect IP 80.82.77.202 with HoneyLabs and list the ports and CVEs it targeted recently.
- Show attack volume for CVE-2024-4577 over the past week grouped by ASN.
- List the top scanning sources on port 6379 and check their JA4 TLS fingerprints.
How to install HoneyLabs
Platform CLI: remote server
claude mcp add --transport http honeylabs https://mcp.honeylabs.net/mcpPlatform CLI: remote server
codex mcp add honeylabs --url https://mcp.honeylabs.net/mcpConfig file
{
"mcpServers": {
"honeylabs": {
"url": "https://mcp.honeylabs.net/mcp"
}
}
}Config file
{
"servers": {
"honeylabs": {
"type": "http",
"url": "https://mcp.honeylabs.net/mcp"
}
}
}Platform CLI: remote server
gemini mcp add -t http honeylabs https://mcp.honeylabs.net/mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about HoneyLabs
How do I install HoneyLabs in Claude Code?
Run claude mcp add --transport http honeylabs https://mcp.honeylabs.net/mcp. You can generate an access key in the HoneyLabs dashboard.
What intelligence does HoneyLabs supply?
It serves 90 days of live telemetry recorded by honeypots. The records include source IP addresses, targeted paths, CVE identifiers, and network fingerprints across TLS and SSH.
How does free tier usage billing work?
A free key provides 500 credits per day. Each individual row returned by any query consumes one credit.
