# HoneyLabs (remote · mcp.honeylabs.net)

Query 90 days of honeypot probe data: IP reputation, scanners, CVE probing, TLS/SSH fingerprints.

- Trust score: 73/100 (medium)
- Change this week: +8
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.honeylabs.net`: 73/100 (this document), [markdown](https://verifymcp.io/servers/net-honeylabs-mcp/mcp.md), [page](https://verifymcp.io/servers/net-honeylabs-mcp/mcp)

## Channel facts

- Endpoint: `https://mcp.honeylabs.net/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 94/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 57/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2017 tokens (~224/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 67/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http net-honeylabs-mcp https://mcp.honeylabs.net/mcp
```

### Codex

```toml
[mcp_servers.net-honeylabs-mcp]
url = "https://mcp.honeylabs.net/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "net-honeylabs-mcp": {
      "type": "remote",
      "url": "https://mcp.honeylabs.net/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add net-honeylabs-mcp --url https://mcp.honeylabs.net/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  net-honeylabs-mcp:
    url: "https://mcp.honeylabs.net/mcp"
```

### Other

```json
{
  "mcpServers": {
    "net-honeylabs-mcp": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 71, +5)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 66, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 67, +1)

- [security] Tool “search_events_tool” rewrote its description, which is the text the model reads
- [cosmetic] “search_events_tool” dropped the optional parameter “community_id”

### 2026-07-28 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 65, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 64)

First indexed and scored.

## MCP tools (9)

### `search_events_tool` (~391 tokens)

Return individual raw honeypot events with all fields. Use when the user wants to see
actual records: 'show me events from this IP', 'what hit port 443 last week', 'events from
Russia yesterday'. Filters: source_ip, country (2-letter code), asn (e.g. 'AS12345'),
dest_port, protocol ('tls' or '' = the coarse TLS/raw-TCP signal),
app_protocol (nDPI L7 protocol label: 'bittorrent', 'ssh', 'rdp', 'mssql-tds', 'mining',
'rtsp', 'smbv1', ... — find everything speaking a protocol regardless of port),
http_method, request_header (substring of the masked
HTTP request headers), ja4/ja3 (exact TLS client fingerprint),
has_client_cert (true = only events where the client presented an mTLS cert),
ip_version (4 or 6 = only IPv4 or IPv6 sources).
since/until are ISO-8601 UTC strings. Each record includes: source_ip, country, asn,
dest_port, user_agent, url_path, http_request_headers, tls_client_ja4, tls_client_ja3,
http_request_ja4h, ssh_client_hassh, tls_client_cert_subject/issuer,
event_sequence, event_duration, source_bytes/dest_bytes/network_bytes, network_protocol,
application_protocol, timestamp.

Input parameters:

- `app_protocol`
- `asn`
- `country`
- `dest_port`
- `has_client_cert`
- `http_method`
- `ip_version`
- `ja3`
- `ja4`
- `limit` (integer)
- `protocol`
- `request_header`
- `since` (string, required)
- `source_ip`
- `until` (string, required)

### `top_attackers_tool` (~264 tokens)

Ranked leaderboard of attack sources. Use for: 'who is attacking the most?', 'top
attacking countries', 'most targeted ports', 'most common user agents', 'top ASNs by
attack volume', 'top IPs from China', 'top attackers hitting port 22'.
'by' controls grouping: ip, asn, country, port, user_agent, ja4, url_path, domain, cve.
by='cve' answers 'what CVEs are being mass-scanned right now' and returns
value (the CVE id), title, severity, actively_exploited and counts; drill into any of
them with cve_lookup. by='cve' does not accept the country/dest_port/asn filters.
Optional filters: country (2-letter ISO, e.g. 'CN'), dest_port, asn (e.g. 'AS12345').
Adding a filter is required for large time ranges to stay within memory limits.
since/until are ISO-8601 UTC strings.

Input parameters:

- `asn`
- `by` (string)
- `country`
- `dest_port`
- `limit` (integer)
- `since` (string, required)
- `until` (string, required)

### `ioc_lookup_tool` (~233 tokens)

Look up any IP address or domain in the honeypot dataset. Use this FIRST whenever the
    user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?',
    'what does this IP do?', 'when was it last seen?', 'is this IP in your data?'. Returns:
    total_events (0 = never observed), first_seen, last_seen, country, ASN, the 50 most-hit
ports plus ports_targeted_count for the true total,
    top user agents, top URL paths, TLS/HTTP/SSH fingerprints. Covers both IPv4 and domains.
    Also returns our own judgement: `verdict` (human sentence) with `verdict_key` (stable
    machine value to alert on) and `verdict_why`; `scanner` (benign-scanner identity from our
    classification table, or null) so research traffic can be told apart from real attacks;
    and `cve_probes`, the CVE signatures this address was seen probing.

Input parameters:

- `ioc` (string, required)

### `cve_lookup_tool` (~214 tokens)

Who is probing a specific CVE. Use whenever the user names a CVE: 'is CVE-2024-4577
being exploited in the wild?', 'who is scanning for this CVE?', 'show me actors probing
CVE-2023-1389'. Returns severity, KEV (actively_exploited), event and unique-IP counts,
the top probing IPs with country/ASN/scanner tag, top ASNs, exploiter fingerprints,
sample request paths and a daily timeline. window: 24h, 7d, 30d or 90d.
\`observed: false` with a note means we hold no detection pattern for that CVE, which is
NOT the same as nobody scanning it. Do not use payload_search for a CVE id: the id is
our tag for a pattern and never appears in the payload text.

Input parameters:

- `cve_id` (string, required)
- `limit` (integer)
- `window` (string)

### `payload_search_tool` (~301 tokens)

Literal substring search over captured request text: URL path, request body,
request headers and event summary. Use for: 'find attacks targeting /wp-admin',
'find requests with this user agent string', 'what payloads hit port 80 last week'.

It matches text that literally appeared in the request, and nothing else. These do
NOT work and will return an empty list:
  \- a CVE id ('CVE-2024-4577'), which is our tag for a pattern, never payload text.
    Use cve_lookup instead. This tool rejects them rather than answering emptily.
  \- a product or vendor name ('Cisco FMC', '7-Zip'), which appears in an advisory,
    not in the request. Search the endpoint it exposes instead, e.g. '/ccmadmin' or
    the vulnerable path.
  \- a description of behaviour ('SQL injection attempts'). Search a marker that
    occurs in the traffic, e.g. 'UNION SELECT' or '../'.

An empty list is a real answer: it means no captured request in that window
contained the string. Widen since/until before concluding the activity does not
exist. Free to call; volume is metered like every other tool.
since/until are ISO-8601 UTC strings.

Input parameters:

- `limit` (integer)
- `query` (string, required)
- `since` (string, required)
- `until` (string, required)

### `attack_timeline_tool` (~141 tokens)

Attack volume over time, bucketed by hour or day. Use for: 'show attack trends this
week', 'was there a spike on port 22?', 'how has SSH scanning changed?', 'attack volume
from China over 30 days'. bucket: 'hour' or 'day'. Optional filters: filter_protocol
('tls'/'''), filter_country (2-letter code), filter_dest_port. since/until ISO-8601 UTC.

Input parameters:

- `bucket` (string)
- `filter_country`
- `filter_dest_port`
- `filter_protocol`
- `since` (string, required)
- `until` (string, required)

### `asn_enrich_tool` (~134 tokens)

Full honeypot profile for an ASN (autonomous system / hosting provider). Use for:
'tell me about AS202425', 'what is Vultr doing in my honeypots?', 'attacks from this
hosting provider', 'attribute this IP to its network'. asn format: 'AS12345'.
Returns: total events, unique IPs, top targeted ports, top source countries, top user
agents, org name. since/until are ISO-8601 UTC strings.

Input parameters:

- `asn` (string, required)
- `since` (string, required)
- `until` (string, required)

### `fingerprint_search_tool` (~162 tokens)

Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks:
'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?', 'how
common is this HASSH?', 'find all scanners with this SSH client fingerprint'. fp_type:
'ja4' (TLS client), 'ja3' (legacy TLS client, MD5 — still keyed by many TI feeds),
'ja4h' (HTTP client), 'hassh' (SSH client). since/until are ISO-8601 UTC strings.

Input parameters:

- `fingerprint` (string, required)
- `fp_type` (string, required)
- `limit` (integer)
- `since` (string, required)
- `until` (string, required)

### `fingerprint_population_tool` (~177 tokens)

The population behind a single client fingerprint: how many source IPs carry it,
across how many networks (ASNs) and countries, the ports they hit, the top networks
and a sample of the IPs, plus a read on whether it is concentrated (a likely
coordinated operation, many IPs on few networks) or spread thin (a common client).
Use when a user asks: 'is this JA4 one botnet or a common tool?', 'how many networks
use this HASSH?', 'how specific / concentrated is this fingerprint?'. fp_type: 'ja4'
(TLS), 'ja4h' (HTTP), 'hassh' (SSH). Covers the full retained window (no date range).

Input parameters:

- `fingerprint` (string, required)
- `fp_type` (string, required)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/net-honeylabs-mcp/mcp#diagnostics

## Score history

- 2026-08-03: 73
- 2026-08-02: 72
- 2026-08-01: 72
- 2026-07-31: 71
- 2026-07-30: 66
- 2026-07-29: 67
- 2026-07-28: 66
- 2026-07-27: 65
- 2026-07-26: 64

## Links

- Remote endpoint: https://mcp.honeylabs.net/mcp
- Authorisation metadata: https://mcp.honeylabs.net/.well-known/oauth-protected-resource/mcp
- Repository: https://github.com/honeylabshq/honeylabs-mcp
- Website: https://honeylabs.net/
- Changelog RSS feed: https://verifymcp.io/servers/net-honeylabs-mcp/mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/net-honeylabs-mcp/mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/net-honeylabs-mcp/mcp