Honeylabs Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Honeylabs Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Honeypot threat intelligence as MCP tools. Query 90 days of probe data from our honeypot sensor network: IP reputation, scanner classification, CVE probing trends, TLS/HTTP/SSH fingerprints (JA4, JA3, Akin, HASSH), mTLS client certificates, Community ID flow hashes, and attack timelines. Use it straight from Claude, Cursor, Gemini, Cline, or any other Model Context Protocol client.
claude mcp add honeylabs \
--transport http \
https://mcp.honeylabs.net/mcp \
--header "Authorization: Bearer <your-key>"Get a key at https://honeylabs.net/dashboard?src=github (magic-link sign-in, no password).
Add to your MCP config:
{
"mcpServers": {
"honeylabs": {
"url": "https://mcp.honeylabs.net/mcp",
"headers": {
"Authorization": "Bearer <your-key>"
}
}
}
}Same JSON config as Claude Desktop / Cursor. Install via the MCP Marketplace listing or paste the config block above into your settings.
gemini /mcp add honeylabs https://mcp.honeylabs.net/mcp
gemini /mcp auth honeylabs # OAuth flow, no static keyOAuth 2.1 with PKCE + DCR is supported at /oauth/authorize. Any MCP client that speaks standard OAuth (Gemini, MCP Inspector, Smithery, Cline's OAuth flow) works out of the box.
| Tool | What it answers |
|---|---|
ioc_lookup | Is this IP / domain known to be probing? Returns our verdict, whether it is a recognised benign scanner, the CVEs it probed, plus ports / paths / fingerprints. |
top_attackers | Ranked leaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (by='cve') over a time window. |
search_events | Raw honeypot events matching filters (IP, ASN, country, dest_port, protocol, http_method, ja4/ja3/akin, community_id, has_client_cert). |
attack_timeline | Hourly / daily attack volume over a window, with protocol / country / port filters. |
asn_enrich | Full profile for an ASN: total events, unique IPs, top ports, source countries, user-agents, org name. |
fingerprint_search | Search by TLS JA4 / JA3, HTTP Akin or SSH HASSH fingerprint to find shared infrastructure. |
fingerprint_similar | Request shapes within a few headers of an Akin HTTP fingerprint, what those clients ask for, and the family the token belongs to. |
cve_lookup | Who is probing a named CVE: severity, KEV status, top probing IPs with ASN and scanner tag, fingerprints, sample paths, daily timeline. |
payload_search | Substring search across request paths, bodies and headers. Never a CVE id. |
fingerprint_population | How many addresses and networks carry one fingerprint, and whether it looks like one operation. |
udp_activity | DNS questions, QUIC client fingerprints and other UDP probes. UDP sources can be forged. |
interactive_credentials | Logins tried against the interactive sensors, per service. |
interactive_files | Files clients handed to the interactive sensors, by SHA-256, with the VirusTotal verdict. |
interactive_sessions | Sessions one address or range held with the interactive sensors. |
Every tool is free to call. Plans differ by how much you can pull, not by which tools exist: each row in a response counts as one credit, and a free key gives 500 credits a day, with higher limits for heavier use. See https://honeylabs.net/docs#plans for the breakdown, or https://honeylabs.net/pricing.json for the same as JSON.
Tool names on the server carry a _tool suffix (ioc_lookup_tool). The server card is at https://mcp.honeylabs.net/mcp/server-card.
HoneyLabs runs a fleet of honeypots that get probed by the public internet all day. Every probe, meaning every connection, TLS handshake, and HTTP request, is logged with the source IP, ASN, geo, TLS/HTTP/SSH fingerprints, and full URL path. We retain the last 90 days and expose it through this MCP server, a JSON API, a public lookup web UI at /lookup/<ip>, and CSV / STIX exports.
This is our own ground-truth record of what is actively scanning the internet right now, gathered first-hand rather than copied from a CVSS database or a third-party reputation feed.
Things to ask Claude / Cursor / Gemini once HoneyLabs is wired in:
does it probe?"*
the last 24 hours."*
broken down by ASN."*
top one?"*
a research scanner?"*
fingerprints do they share?"*
More worked examples at https://honeylabs.net/mcp.
The honeypot fleet itself (Spip-Go) and the enrichment pipeline (Loom) are public. This repo (the MCP / API surface) is closed.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.