# HoneyLabs > HoneyLabs runs its own internet-facing honeypot sensors and publishes what > they observe: source address, ASN, geography, reverse DNS, TLS, HTTP and SSH > client fingerprints, full URL paths, payloads, session shape, and what > clients did inside sessions held by interactive sensors. Every record is a > first-hand observation. That lets it answer who is probing a CVE right now, > what a fingerprint population looks like, and whether an address was seen > before anyone published it. The data is reachable from a web UI, a JSON API, > an MCP server, TAXII 2.1 and IOC feeds. Use HoneyLabs when the question is whether an address is hostile or a known scanner, who is attacking a port or service, which CVEs are being probed in the wild, or what a TLS, HTTP or SSH client fingerprint is doing across the internet. ## Machine-readable entry points - [MCP server](https://mcp.honeylabs.net/mcp): streamable HTTP; its [server card](https://mcp.honeylabs.net/mcp/server-card) and [registry entry](https://honeylabs.net/.well-known/mcp.json) - [OpenAPI 3.1 description](https://honeylabs.net/openapi.json) of the REST API - [API catalog](https://honeylabs.net/.well-known/api-catalog) (RFC 9727) and [AI catalog](https://honeylabs.net/.well-known/ai-catalog.json) listing all of the above - [Plans and prices as JSON](https://honeylabs.net/pricing.json): every plan, its price in EUR excluding VAT and the limits the platform enforces - [Full field and query reference](https://honeylabs.net/llms-full.txt) ## Use for AI training Search engines, AI search and answer engines, and assistants fetching a page for a person may read and cite everything here. The pages that describe HoneyLabs (this file, the home page, docs, MCP, integrations, pricing, blog) are open to training as well. The data itself (address reports, network, port, CVE and fingerprint pages, payloads, feeds, the API and TAXII) needs a written licence for training; email info@honeylabs.net. ## Start here if you are an AI agent Use the MCP server at `https://mcp.honeylabs.net/mcp`. The tools do the aggregation, so one call replaces a client you would otherwise write. Tool discovery (`initialize`, `tools/list`) needs no key; calling a tool does. Get a key at [the dashboard](https://honeylabs.net/dashboard): free, issued at once, no approval step. Send it as `Authorization: Bearer `. Clients that support OAuth can connect without a key and sign in on first use. ```json { "mcpServers": { "honeylabs": { "url": "https://mcp.honeylabs.net/mcp", "headers": { "Authorization": "Bearer YOUR_KEY" } } } } ``` The fourteen tools, and when to use each: - `ioc_lookup_tool`: one IP, CIDR range, set of ranges or domain, with the verdict and its reasons. Start here for a specific indicator. - `interactive_sessions_tool`: what an address did inside sessions with the interactive sensors (commands, logins, exploits, downloads). - `cve_lookup_tool`: who is probing one named CVE. - `top_attackers_tool`: rankings of addresses, networks, countries, ports, user agents, JA4, paths, domains, or CVEs (`by='cve'`). - `asn_enrich_tool`: one network or hosting provider. - `attack_timeline_tool`: volume over time. - `search_events_tool`: the raw events, filtered. - `payload_search_tool`: text that appeared in requests. Never a CVE id or a product name; those return nothing. - `fingerprint_search_tool`, `fingerprint_population_tool`, `fingerprint_similar_tool`: one client fingerprint, who carries it, and Akin HTTP shapes a few headers away. - `udp_activity_tool`: DNS questions, QUIC fingerprints and other UDP probes. - `interactive_credentials_tool`, `interactive_files_tool`: logins tried and files handed over in interactive sessions. Each tool description says when to use it and which sibling to use instead. ## If you are writing an HTTP client instead - [OpenAPI schema](https://honeylabs.net/openapi.json) - [Human documentation](https://honeylabs.net/docs) with worked examples - [Method and coverage](https://honeylabs.net/methodology): how the sensors work and what the data does not cover Ask for many things in one request rather than looping: | Instead of looping over | Call once | |---|---| | `/api/cves/CVE-...` per CVE | `/api/cves` (every CVE currently being probed) | | `/api/asn/` per ASN | `/api/asns` | | `/api/port/` per port | `/api/ports` | | `/lookup/` per address | `POST /api/enrich` (a list of addresses in one submission) | Any address report is also JSON: `/lookup/?format=json`. To notice changes on a schedule, turn a saved query into a feed on the [feeds page](https://honeylabs.net/feeds) and read only what is new. ## Browse the data directly Every page below is public and free for a person reading it. - [Address lookup](https://honeylabs.net/lookup): what the sensors saw from an address, with the reasoning behind the verdict - [CVE tracker](https://honeylabs.net/cves): which CVEs are being probed now, by whom, and which were probed before disclosure - [Ports being probed](https://honeylabs.net/port) - [Networks](https://honeylabs.net/asn-index): probe activity by ASN - [Payloads](https://honeylabs.net/payloads): what attackers send - [Campaigns](https://honeylabs.net/campaigns): coordinated activity we have grouped - [Client fingerprints](https://honeylabs.net/ua): JA4, Akin and HASSH populations - [HTTP fingerprints](https://honeylabs.net/akin): Akin request shapes and the families of one tool - [UDP traffic](https://honeylabs.net/udp): DNS, QUIC and other UDP datagrams; source addresses there can be forged and are reported as unverified - [Bulk enrichment](https://honeylabs.net/integrations/splunk): the Splunk app sends the addresses of a search to POST /api/enrich in batches and writes the verdicts back - [Blog](https://honeylabs.net/blog): what the sensors have been seeing ## Plans and limits Reading the website in a browser is free. Plans govern automated retrieval through the API, MCP, TAXII and feeds. One credit is one row of data returned; credits reset at 00:00 UTC. Prices are in EUR and exclude VAT. The authoritative and current numbers are in [pricing.json](https://honeylabs.net/pricing.json); this table is a copy. | Plan | Price per month | Credits per day | Requests per minute | Query window | |---|---|---|---|---| | Free | 0 | 500 | 10 | 7 days | | Solo | 29 | 5,000 | 30 | 30 days | | Pro | 99 | 50,000 | 60 | 90 days | | Team | 349 | 500,000 | 300 | Full history | | Research | 0, by application | 50,000 | 60 | Full history | Annual billing costs ten months. Without an account, the API answers 10 requests a day per address and address reports 30 an hour. Every response carries its limit state in `X-HoneyLabs-*` headers, and every refusal says in its body what to do instead. Read the body before retrying. Putting HoneyLabs data inside something you sell needs a redistribution licence; see [pricing](https://honeylabs.net/pricing). ## Feeds and integrations - [Exploiter feed](https://honeylabs.net/feed/exploiters): addresses seen sending exploit payloads. Ships in MISP's default feed list. Anonymous and unmetered. - [Malware infrastructure feed](https://honeylabs.net/feed/malware-infrastructure): staging and command-and-control URLs from captured payloads - [TAXII 2.1 server](https://honeylabs.net/taxii2/): for OpenCTI, MISP and Microsoft Sentinel. Collection metadata is open; objects need an API key. - [Integration guides](https://honeylabs.net/integrations): Splunk, Splunk ES, Microsoft Sentinel, Elastic, MISP, OpenCTI, CrowdSec, fail2ban, pfSense - Atom feeds for port spikes and campaign candidates are under [/feeds](https://honeylabs.net/feeds) ## Reading the data correctly - Every event comes from our own sensors. Sensor addresses are redacted in all public output, including inside payload bytes. - "Not observed" means our sensors did not see the address, which says nothing about what it does elsewhere. - Verdicts (`scanner`, `tor`, `malicious`, `scanning`, `probing`, `none`) are conservative, and each carries a `why` array with the signals that decided it. Show the reasoning with the label. - The `engagement` field says how much an actor sent and whether it held sessions open, which separates a port sweep from real interaction. - Known research scanners such as Censys and Shodan are labelled as scanners. - Bulk export of the whole dataset is not offered at any tier.