HoneyLabs

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

• 连接方式: 在云端运行
• 传输方式: Streamable HTTP
• 分类: 网络安全
• 你需要填写：Authorization

安装

选择你使用的 AI 应用，然后复制设置。

你需要

• 在云端运行无需安装任何东西，通过互联网连接

你用的是哪个应用？

claude mcp add --transport http honeylabs https://mcp.honeylabs.net/mcp --header 'Authorization: your-value'

{
  "mcpServers": {
    "honeylabs": {
      "url": "https://mcp.honeylabs.net/mcp",
      "headers": {
        "Authorization": "your-value"
      }
    }
  }
}

{
  "servers": {
    "honeylabs": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp",
      "headers": {
        "Authorization": "your-value"
      }
    }
  }
}

你的选择通过 Cookie 保存在这台设备上，无需账户。

需要你填写的值

• Authorization 机密 必填 HTTP header
  Bearer API key from https://honeylabs.net/dashboard. Clients that support OAuth 2.1 need no key: the server advertises Dynamic Client Registration via WWW-Authenticate and /.well-known/oauth-protecte…

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

工具名称和描述与服务器在 2026年11月7日 报告的完全一致。这些内容由作者撰写，不是我们写的；我们以纯文本形式显示。

• search_events_tool

  Individual honeypot events with every field, newest first, filtered by source, network, port, protocol or fingerprint. Use when the user wants to see the records themselves: "show me the events from this IP", "what hit port 443 yesterday", "every request carrying this JA4", "all

• top_attackers_tool

  Ranked leaderboard over a time window: the top source addresses, networks, countries, destination ports, user agents, JA4 fingerprints, URL paths, reverse DNS domains or CVEs by event count. Use for "who is attacking the most", "top countries hitting port 22", "most targeted port

• ioc_lookup_tool

  Everything the sensors hold on one IP address, a CIDR range, several ranges at once, or a domain, with our verdict and the reasons for it. Start here for any question about a specific indicator. Use for "is this IP malicious", "is this a known scanner", "have you seen this addres

• cve_lookup_tool

  Who is probing one named CVE, and how: counts, top probing addresses, networks, countries, fingerprints, sample request paths and a daily timeline. Use whenever the user names a CVE: "is CVE-2024-4577 being exploited in the wild", "who scans for CVE-2023-1389", "has anyone probed

• payload_search_tool

  Literal substring search, ignoring case, over captured request text: URL path, request body, request headers and event summary. Use for "find requests to /wp-admin", "which requests carried this user agent string", "who sent '../../etc/passwd' last week". It matches text that app

• attack_timeline_tool

  Event counts over time, in hourly or daily buckets, optionally filtered by protocol, country or destination port. Use for "show the trend this week", "was there a spike on port 22", "how has SSH scanning changed over 30 days". Do not use it to find who caused a spike (follow up w

• asn_enrich_tool

  Profile of one autonomous system (a hosting provider, ISP or company network) over a time window: total events, unique addresses, top targeted ports, source countries, top user agents and the organisation name. Use for "tell me about AS202425", "what is this hosting provider doin

• fingerprint_search_tool

  Events and sources that carried one client fingerprint in a time window. Use for "have you seen this JA4", "which IPs share this TLS fingerprint", "find every scanner with this SSH client fingerprint". For how widespread a fingerprint is and whether it is one operation or a commo

• fingerprint_similar_tool

  HTTP request shapes within a few headers of one Akin fingerprint, with what those clients request and call themselves, and the family the fingerprint belongs to. Use when an unfamiliar request shape turns up in your own web server, WAF or proxy logs and you want to know whether i

• fingerprint_population_tool

  The population behind one client fingerprint over the full retained window: how many source addresses carry it, across how many networks and countries, the ports they hit, the top networks, a sample of addresses, and a read on its shape. Use for "is this JA4 one botnet or a commo

• udp_activity_tool

  UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries involved. Use for "who is sending DNS ANY queries", "is anyone querying version.bind", "have you seen this QUIC JA4", "which UDP ports are probe

• interactive_credentials_tool

  Plaintext logins captured by the interactive sensors (sensors that answer as a real service and hold the session): username, password, the service they were tried on, the outcome and the source address, newest first, plus the pairs tried most and a per-service breakdown. Use for

• interactive_files_tool

  Files clients handed to the interactive sensors: uploads, mail attachments, published messages and other artifacts, by SHA-256, with name, size, MIME type, the sessions that carried them and the VirusTotal verdict when one is known. Use for "have you seen this hash", "what files

• interactive_sessions_tool

  Sessions one address or range held with the interactive sensors: when, which port and protocol, the service the sensor answered as, the session verdict (scan, credential or exploit), labels, turns, bytes, duration, CVE ids proven by the payload, path-only CVE candidates and the d

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日

• ✓ 通过

  作者与仓库一致

  注册名称已通过域名 honeylabs.net 验证（注册中心会核实域名所有权）

• … 尚未检查

  仍在维护

  我们还没有从 GitHub 读取这个仓库

• … 尚未检查

  有许可证

  我们还没有从 GitHub 读取这个仓库

• ✓ 通过

  端点有响应

  在 72 毫秒内响应（HTTP 200）

• – 不适用

  使用 OAuth 登录

  无需登录

• ✓ 通过

  工具描述中没有隐藏指令

  已读取 14 个工具描述，未发现针对 AI 的隐藏指令

与“网络安全”中的其他服务器比较i

• 星标数多于此分类中其他 995 个服务器的 0%
• 发布到注册中心的时间比此分类中其他 995 个服务器的 81% 更新
• 基础检查结果等于或优于此分类中其他 995 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

作者的 README

claude mcp add honeylabs \

{

gemini /mcp add honeylabs https://mcp.honeylabs.net/mcp