HoneyLabs

Qué puedes hacer con él

Todavía no escribimos un resumen sencillo para este. Abajo están los datos que leímos del registro.

• Conexión: Se ejecuta en la nube
• Transporte: Streamable HTTP
• Categoría: Otros
• Debes completar: Authorization

Instalación

Elige la app de IA que usas y copia la configuración.

Necesitas

• Se ejecuta en la nubeNo hay nada que instalar; se conecta por internet

¿Qué app usas?

claude mcp add --transport http honeylabs https://mcp.honeylabs.net/mcp --header 'Authorization: your-value'

{
  "mcpServers": {
    "honeylabs": {
      "url": "https://mcp.honeylabs.net/mcp",
      "headers": {
        "Authorization": "your-value"
      }
    }
  }
}

{
  "servers": {
    "honeylabs": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp",
      "headers": {
        "Authorization": "your-value"
      }
    }
  }
}

Tu elección se guarda en una cookie en este dispositivo; no necesitas cuenta.

Valores que debes completar

• Authorization secreto obligatorio HTTP header
  Bearer API key from https://honeylabs.net/dashboard. Clients that support OAuth 2.1 need no key: the server advertises Dynamic Client Registration via WWW-Authenticate and /.well-known/oauth-protecte…

Esta configuración se genera a partir de la ficha del creador en el registro. Si el README dice otra cosa, sigue el README.

Qué puede hacer

Nombres y descripciones de las herramientas tal como los informó el servidor el 7 nov 2026. Los escribió el creador, no nosotros; los mostramos como texto sin formato.

• search_events_tool

  Individual honeypot events with every field, newest first, filtered by source, network, port, protocol or fingerprint. Use when the user wants to see the records themselves: "show me the events from this IP", "what hit port 443 yesterday", "every request carrying this JA4", "all

• top_attackers_tool

  Ranked leaderboard over a time window: the top source addresses, networks, countries, destination ports, user agents, JA4 fingerprints, URL paths, reverse DNS domains or CVEs by event count. Use for "who is attacking the most", "top countries hitting port 22", "most targeted port

• ioc_lookup_tool

  Everything the sensors hold on one IP address, a CIDR range, several ranges at once, or a domain, with our verdict and the reasons for it. Start here for any question about a specific indicator. Use for "is this IP malicious", "is this a known scanner", "have you seen this addres

• cve_lookup_tool

  Who is probing one named CVE, and how: counts, top probing addresses, networks, countries, fingerprints, sample request paths and a daily timeline. Use whenever the user names a CVE: "is CVE-2024-4577 being exploited in the wild", "who scans for CVE-2023-1389", "has anyone probed

• payload_search_tool

  Literal substring search, ignoring case, over captured request text: URL path, request body, request headers and event summary. Use for "find requests to /wp-admin", "which requests carried this user agent string", "who sent '../../etc/passwd' last week". It matches text that app

• attack_timeline_tool

  Event counts over time, in hourly or daily buckets, optionally filtered by protocol, country or destination port. Use for "show the trend this week", "was there a spike on port 22", "how has SSH scanning changed over 30 days". Do not use it to find who caused a spike (follow up w

• asn_enrich_tool

  Profile of one autonomous system (a hosting provider, ISP or company network) over a time window: total events, unique addresses, top targeted ports, source countries, top user agents and the organisation name. Use for "tell me about AS202425", "what is this hosting provider doin

• fingerprint_search_tool

  Events and sources that carried one client fingerprint in a time window. Use for "have you seen this JA4", "which IPs share this TLS fingerprint", "find every scanner with this SSH client fingerprint". For how widespread a fingerprint is and whether it is one operation or a commo

• fingerprint_similar_tool

  HTTP request shapes within a few headers of one Akin fingerprint, with what those clients request and call themselves, and the family the fingerprint belongs to. Use when an unfamiliar request shape turns up in your own web server, WAF or proxy logs and you want to know whether i

• fingerprint_population_tool

  The population behind one client fingerprint over the full retained window: how many source addresses carry it, across how many networks and countries, the ports they hit, the top networks, a sample of addresses, and a read on its shape. Use for "is this JA4 one botnet or a commo

• udp_activity_tool

  UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use for "who is sending DNS ANY queries", "is anyone querying version.bind", "have you seen this QUIC JA4", "which UDP ports are probe

• interactive_credentials_tool

  Plaintext logins captured by the interactive sensors (sensors that answer as a real service and hold the session): username, password, the service they were tried on, the outcome and the source address, newest first, plus the pairs tried most and a per-service breakdown. Use for

• interactive_files_tool

  Files clients handed to the interactive sensors: uploads, mail attachments, published messages and other artifacts, by SHA-256, with name, size, MIME type, the sessions that carried them and the VirusTotal verdict when one is known. Use for "have you seen this hash", "what files

• interactive_sessions_tool

  Sessions one address or range held with the interactive sensors: when, which port and protocol, the service the sensor answered as, the session verdict (scan, credential or exploit), labels, turns, bytes, duration, CVE ids proven by the payload, path-only CVE candidates and the d

Revisiones básicasi

Revisamos información que cualquiera puede ver; no hemos leído el código. Las revisiones que no aplican no se cuentan. · Revisado el 7 nov 2026

• ✓ Superada

  El creador coincide con el repo

  El nombre en el registro se verificó con el dominio honeylabs.net (el registro comprueba quién es dueño del dominio)

• … Aún sin revisar

  Sigue en mantenimiento

  Todavía no hemos leído este repo en GitHub

• … Aún sin revisar

  Tiene licencia

  Todavía no hemos leído este repo en GitHub

• ✓ Superada

  El endpoint responde

  Respondió en 72 ms (HTTP 200)

• – No aplica

  Inicio de sesión con OAuth

  No hace falta iniciar sesión

• ✓ Superada

  Sin instrucciones ocultas en las descripciones de herramientas

  Leímos 14 descripciones de herramientas y no encontramos instrucciones ocultas para la IA

Comparado con otros en Otrosi

• Más estrellas que el 0% de los otros 32725 servidores de esta categoría
• Publicado en el registro más recientemente que el 79% de los otros 32725 servidores de esta categoría
• Revisiones básicas iguales o mejores que el 100% de los otros 32725 servidores de esta categoría

Comparado con todos los servidores activos de esta categoría en el registro. Las estrellas solo cuentan cuando quien lo publica es dueño del repo.

Alternativas

Servidores de la misma categoría hechos por otros creadores, ordenados por estrellas.

Cómo leer una tarjeta:★ Estrellas de GitHubiTres pilares: reseñas · revisiones · usoiActualizado = fecha en que se publicó la última versión en el registroi

README del creador

claude mcp add honeylabs \

{

gemini /mcp add honeylabs https://mcp.honeylabs.net/mcp