For AI assistants
Ask your AI about an IP.
HoneyLabs ships a first-class Model Context Protocol server. Wire it into Claude, Cursor, or any MCP-compatible assistant once and your AI can answer questions about live honeypot telemetry directly. No glue code, no JSON juggling.
Add it to your AI tool
One click for Cursor and VS Code, or copy the config for everything else. Works with Claude Code, Claude Desktop, Cursor, VS Code, Cline, and any client that speaks MCP.
claude mcp add honeylabs \ --transport http \ https://mcp.honeylabs.net/mcp \ --header "Authorization: Bearer <hlk_…>"
Key from your dashboard, or drop the --header line and sign in via OAuth on first connect.
One click for Cursor and VS Code. Sign in on first use (OAuth), nothing to paste.
Settings, Connectors, Add custom connector. Paste https://mcp.honeylabs.net/mcp and authenticate.
{
"mcpServers": {
"honeylabs": {
"type": "http",
"url": "https://mcp.honeylabs.net/mcp",
"headers": {
"Authorization": "Bearer <hlk_…>"
}
}
}
}Replace <hlk_…> with a key from your dashboard. Every tool call needs one, so a config without the Authorization header will connect and list the tools, then fail on the first query.
Remote streamable HTTP at https://mcp.honeylabs.net/mcp. If your client speaks OAuth 2.1 with PKCE, drop the headers block and sign in on first connect instead.
Try these prompts
Six real questions a defender would ask their AI on a Monday morning. Click any to copy.
Tools the server exposes
You don't call these directly; your AI does, based on whatever you ask. Listed here so you know what's in reach.
| Tool | What it does |
|---|---|
| ioc_lookup | Start here. An IP or domain with our verdict, whether it is a recognised benign scanner, and the CVEs it probed. |
| cve_lookup | Who is probing a named CVE: severity, KEV status, top actors, fingerprints, daily timeline. |
| top_attackers | Leaderboard of source IPs, ASNs, countries, ports, user-agents, or CVEs (by='cve'). |
| search_events | Raw events with every field. Use when you want fingerprints in the response. |
| payload_search | Substring search across URL paths and user-agents. |
| attack_timeline | Hourly or daily attack volume over a window. |
| asn_enrich | Full profile for an ASN: top sources, ports, paths, fingerprints. |
| fingerprint_search | Find activity by TLS, HTTP, or SSH fingerprint. |
| fingerprint_population | The population behind one fingerprint: how many IPs carry it and where they sit. |
Next
- Get an API key →Free to create. No card required.
- Full MCP reference in /docs →JSON-RPC examples for plain HTTP callers.
- Need more headroom? Request Pro →10k/day plus the port_spikes tool.