Categories › Security › Code & dependency scanning
Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.
Remote server: your requests and data go to mcp.honeylabs.net. Claude Code: claude mcp add --transport http honeylabs https://mcp.honeylabs.net/mcp · Claude app: Settings → Connectors → Add custom connector.
The tools this server listed when we connected to it, in its own words.
search_events_tool — Individual honeypot events with every field, newest first, filtered by source, network, port, protocol or fingerprint. Use when the user wantop_attackers_tool — Ranked leaderboard over a time window: the top source addresses, networks, countries, destination ports, user agents, JA4 fingerprints, URL ioc_lookup_tool — Everything the sensors hold on one IP address, a CIDR range, several ranges at once, or a domain, with our verdict and the reasons for it. Scve_lookup_tool — Who is probing one named CVE, and how: counts, top probing addresses, networks, countries, fingerprints, sample request paths and a daily tipayload_search_tool — Literal substring search, ignoring case, over captured request text: URL path, request body, request headers and event summary. Use for "finattack_timeline_tool — Event counts over time, in hourly or daily buckets, optionally filtered by protocol, country or destination port. Use for "show the trend thasn_enrich_tool — Profile of one autonomous system (a hosting provider, ISP or company network) over a time window: total events, unique addresses, top targetfingerprint_search_tool — Events and sources that carried one client fingerprint in a time window. Use for "have you seen this JA4", "which IPs share this TLS fingerpfingerprint_similar_tool — HTTP request shapes within a few headers of one Akin fingerprint, with what those clients request and call themselves, and the family the fifingerprint_population_tool — The population behind one client fingerprint over the full retained window: how many source addresses carry it, across how many networks andudp_activity_tool — UDP datagrams sent to the sensors: DNS questions, QUIC client fingerprints and other UDP probes, with the ports, networks and countries invointeractive_credentials_tool — Plaintext logins captured by the interactive sensors (sensors that answer as a real service and hold the session): username, password, the sinteractive_files_tool — Files clients handed to the interactive sensors: uploads, mail attachments, published messages and other artifacts, by SHA-256, with name, sinteractive_sessions_tool — Sessions one address or range held with the interactive sensors: when, which port and protocol, the service the sensor answered as, the sessNot tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.