HoneyLabs MCP is an MCP server for cybersecurity and threat intelligence scenarios that exposes probe data collected by a honeypot network to various AI clients as tools. Users can directly call this data in Claude, Cursor, Gemini, Cline, or any client that supports the Model Context Protocol.
In terms of use, this service is mainly used to query and analyze active probing behavior against honeypots from the public internet. HoneyLabs operates a group of honeypots that record every connection, TLS handshake, and HTTP request from the public internet around the clock, and retain the most recent 90 days of data. The data includes source IP, ASN, geolocation, TLS/HTTP/SSH fingerprints, and full URL paths. The official description emphasizes that this data is first-hand, actually collected records, not copies from a CVSS database or third-party reputation sources.
Main capabilities include: IP reputation queries and scanner classification, CVE probing trend analysis, TLS/HTTP/SSH fingerprint identification (JA4, JA3, Akin, HASSH), mTLS client certificate information, Community ID flow hashes, and attack timelines. Taking an IP address as an example, you can query whether an IP is a known scanner, when it last appeared, and its probing behavior.
In terms of usage, the MCP endpoint is https://mcp.honeylabs.net/mcp（streamable HTTP), and supports standard MCP configuration to connect to clients such as Claude Desktop and Cursor. It supports OAuth 2.1 with PKCE and DCR, and the authorization endpoint is /oauth/authorize. It can be installed through the MCP Marketplace, or you can paste the configuration block directly. Users need to obtain a key at https://honeylabs.net/dashboard?src=github , using magic link login with no password required.
In terms of billing, all tools can be called for free; the difference between plans is the amount of data that can be pulled: each line in the response counts as one credit, a free key gets 500 credits per day, and higher usage has higher limits.
Applicable scenarios include: determining whether an IP is a known scanner, pulling a list of IPs by port and User-Agent conditions, viewing daily probe volume for a specific CVE broken down by ASN, identifying CVEs that were widely scanned this week and the entities behind them, and analyzing JA4 fingerprints shared by attackers targeting a specific port.
In terms of limitations, the data retention period is 90 days, and free keys have a daily credit cap. The honeypot cluster itself (Spip-Go) and the enrichment pipeline (Loom) are public projects, while this repository (MCP/API interface) is closed source. The official offering also includes a JSON API, a public lookup UI (/lookup/<ip>), and CSV / STIX export. Contact email info@honeylabs.net, LinkedIn is https://www.linkedin.com/company/honeylabsnet/。
