# HoneyLabs

Connects agents to 90 days of honeypot telemetry. Lets you look up malicious IPs, track active CVE probes, and inspect TLS or SSH fingerprints.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 2
- Author: honeylabshq
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/honeylabshq/honeylabs-mcp
- Updated: 2026-10-18
- HTML: https://affpapa.org/en/nevibecode/mcp/honeylabs

## What it does

HoneyLabs exposes raw sensor telemetry through a hosted HTTP endpoint at `https://mcp.honeylabs.net/mcp`. An AI assistant gets nine security tools out of the box. They handle reputation lookups on suspicious IPs (`ioc_lookup`), monitor CVE scanning activity (`cve_lookup`), and pull network profiles for target autonomous systems (`asn_enrich`).

The underlying sensors log connection attempts, HTTP paths, JA3/JA4 TLS signatures, and SSH HASSH fingerprints. Investigators can inspect attack timelines across specific ports or hunt for related infrastructure using Akin HTTP signatures and mTLS client certificates.

A free API key yields 500 response rows every day. Because each returned row consumes one credit, unrestricted event queries will burn through that allocation quickly.

## Requirements
- Remote server: `https://mcp.honeylabs.net/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http honeylabs https://mcp.honeylabs.net/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add honeylabs --url https://mcp.honeylabs.net/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "honeylabs": {
            "url": "https://mcp.honeylabs.net/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "honeylabs": {
            "type": "http",
            "url": "https://mcp.honeylabs.net/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http honeylabs https://mcp.honeylabs.net/mcp
```

## When to use it
- Check if an IP address belongs to known scanning infrastructure
- Identify networks probing a specific CVE across recent days
- Cluster malicious traffic using TLS JA4 and SSH HASSH hashes
- Filter honeypot attack traffic by port, ASN, or payload paths

## Example prompts
- Inspect IP 80.82.77.202 with HoneyLabs and list the ports and CVEs it targeted recently.
- Show attack volume for CVE-2024-4577 over the past week grouped by ASN.
- List the top scanning sources on port 6379 and check their JA4 TLS fingerprints.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md