bots.st/honeylabs
HoneyLabs
Honeypot IP and CVE probing intelligence
2775 ms
answered our call
- State
- Answered
- Protocol
- MCP 2025-06-18
- Tools listed
- 14
- Answered
- 3 of the last 3 calls
How to reach it
- MCP, HTTP
https://mcp.honeylabs.net/mcpNeeds header Authorization
What it can do
| Tool | What it says it does |
|---|---|
asn_enrich_tool | Profile of one autonomous system (a hosting provider, ISP or company network) over a time window: total events, unique addresses, top targeted ports, source countries, top user agents and the organisation name. Use for "tell me about AS202425", "what is this hosting provider doing", "is this… |
attack_timeline_tool | Event counts over time, in hourly or daily buckets, optionally filtered by protocol, country or destination port. Use for "show the trend this week", "was there a spike on port 22", "how has SSH scanning changed over 30 days". Do not use it to find who caused a spike (follow up with… |
cve_lookup_tool | Who is probing one named CVE, and how: counts, top probing addresses, networks, countries, fingerprints, sample request paths and a daily timeline. Use whenever the user names a CVE: "is CVE-2024-4577 being exploited in the wild", "who scans for CVE-2023-1389", "has anyone probed this before it… |
fingerprint_population_tool | The population behind one client fingerprint over the full retained window: how many source addresses carry it, across how many networks and countries, the ports they hit, the top networks, a sample of addresses, and a read on its shape. Use for "is this JA4 one botnet or a common tool", "how… |
fingerprint_search_tool | Events and sources that carried one client fingerprint in a time window. Use for "have you seen this JA4", "which IPs share this TLS fingerprint", "find every scanner with this SSH client fingerprint". For how widespread a fingerprint is and whether it is one operation or a common client… |
fingerprint_similar_tool | HTTP request shapes within a few headers of one Akin fingerprint, with what those clients request and call themselves, and the family the fingerprint belongs to. Use when an unfamiliar request shape turns up in your own web server, WAF or proxy logs and you want to know whether it is a known tool… |
interactive_credentials_tool | Plaintext logins captured by the interactive sensors (sensors that answer as a real service and hold the session): username, password, the service they were tried on, the outcome and the source address, newest first, plus the pairs tried most and a per-service breakdown. Use for "what passwords… |
interactive_files_tool | Files clients handed to the interactive sensors: uploads, mail attachments, published messages and other artifacts, by SHA-256, with name, size, MIME type, the sessions that carried them and the VirusTotal verdict when one is known. Use for "have you seen this hash", "what files did this IP… |
interactive_sessions_tool | Sessions one address or range held with the interactive sensors: when, which port and protocol, the service the sensor answered as, the session verdict (scan, credential or exploit), labels, turns, bytes, duration, CVE ids proven by the payload, path-only CVE candidates and the download URLs the… |
ioc_lookup_tool | Everything the sensors hold on one IP address, a CIDR range, several ranges at once, or a domain, with our verdict and the reasons for it. Start here for any question about a specific indicator. Use for "is this IP malicious", "is this a known scanner", "have you seen this address", "when was it… |
payload_search_tool | Literal substring search, ignoring case, over captured request text: URL path, request body, request headers and event summary. Use for "find requests to /wp-admin", "which requests carried this user agent string", "who sent '../../etc/passwd' last week". It matches text that appeared in the… |
search_events_tool | Individual honeypot events with every field, newest first, filtered by source, network, port, protocol or fingerprint. Use when the user wants to see the records themselves: "show me the events from this IP", "what hit port 443 yesterday", "every request carrying this JA4", "all RDP traffic… |
top_attackers_tool | Ranked leaderboard over a time window: the top source addresses, networks, countries, destination ports, user agents, JA4 fingerprints, URL paths, reverse DNS domains or CVEs by event count. Use for "who is attacking the most", "top countries hitting port 22", "most targeted ports this week"… |
udp_activity_tool | UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use for "who is sending DNS ANY queries", "is anyone querying version.bind", "have you seen this QUIC JA4", "which UDP ports are probed", "what… |
In its maker's words
Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.
- Website
- honeylabs.net
- Source
- github.com/honeylabshq/honeylabs-mcp
- Publisher
- honeylabs.net
- Listed from
- the official MCP Registry as
net.honeylabs/mcp - Version
- 1.2.0, updated 29 Oct 2026
- Kinds of work
- Security and trust, Search and research, Data and databases
The domain it lives on
- honeylabs.net
- registered 16 Feb 2026 (9 months ago), at Squarespace Domains LLC, its home page is a working site
From our own crawl of domain names: registry records and the home page as our crawler last saw it.
Every call we made
| When | What happened | Time |
|---|---|---|
| Answered | 2775 ms | |
| Answered | 2593 ms | |
| Answered | 1276 ms |
Next door
- paidforAssess an x402 seller before payment
- WhisperDNS-verifiable agent networking and control
- EchelonGraph CVE & ExposureCVE and internet exposure lookups
- RevClamp MCP ServerAudits payments, disputes, and VAT compliance
- APIEmpresas: Spanish company dataKYB checks using CIF, directors, sanctions, tenders, BORME
Is this your bot? Claim its address to add a verified badge and keep the listing current.