mcp-registry/net.honeylabs/mcp · v1.0.0
Also listed as awesome/honeylabshq/honeylabs-mcp
As of 2026-10-26 11:33 UTC, the Honeylabs MCP server is up with a Glimind reliability score of 90/100 (grade A). Over the last 30 days it answered 99.9% of Glimind's liveness checks. It had 19 outages in 90 days, with a median recovery of 2 minutes.
Honeypot probe data: IP reputation, scanners, CVE probing, TLS and SSH fingerprints.
Claude Code
claude mcp add --transport http honeylabs-mcp-server https://mcp.honeylabs.net/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"honeylabs-mcp-server": {
"type": "http",
"url": "https://mcp.honeylabs.net/mcp"
}
}
}
Third-party server, listed as discovered. Review its source before installing.
66 parameter(s) across 14 tool(s) have no description.
Add a "description" to each parameter with its format and an example ("ISO 8601 date, e.g. 2026-10-17"). This is the commonest cause of wrong arguments on the first call. How to fix →
14 of 14 tool(s) carry no readOnlyHint/destructiveHint annotations.
Annotate read-only tools with {"readOnlyHint": true}. Agents and gateways can then run them without a confirmation prompt, and route around destructive ones. How to fix →
No tool declares an outputSchema.
Declare outputSchema and return structuredContent (MCP 2025-06-18+). Agents can then parse results without guessing, and chain tools reliably. How to fix →
Paste-ready definitions with the problems above fixed. Changes marked verify need a human look. 14 tool(s) still need parameter descriptions written by someone who knows the API. All of them as JSON: /v1/readiness/mcp-registry%2Fnet.honeylabs%2Fmcp/fixes
{
"name": "cve_lookup_tool",
"description": "Who is probing a specific CVE. Use whenever the user names a CVE: 'is CVE-2024-4577\nbeing exploited in the wild?', 'who is scanning for this CVE?', 'show me actors probing\nCVE-2023-1389'. Returns title, severity, KEV status (actively_exploited, and `kev`: the\nCISA catalogue entry with date_added, or null), event and unique-IP counts\nover both sensor types (first_contact_events and interactive_requests split them; an\naddress both saw counts once), the top probing IPs with country/ASN and `scanner",
"inputSchema": {
"type": "object",
"required": [
"cve_id"
],
"properties": {
"limit": {
"type": "integer",
"default": 25
},
"cve_id": {
"type": "string"
},
"window": {
"type": "string",
"default": "7d"
}
},
"additionalProperties": false
},
"annotations": {
"readOnlyHint": true
}
}{
"name": "fingerprint_search_tool",
"description": "Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks:\n'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?', 'how\ncommon is this HASSH?', 'find all scanners with this SSH client fingerprint'. fp_type:\n'ja4' (TLS client), 'ja3' (legacy TLS client, MD5, still keyed by many TI feeds),\n'akin' (HTTP request shape, e.g. b11cun030_00040014_54d07b6d), 'hassh' (SSH client).\nsince/until are ISO-8601 UTC strings.",
"inputSchema": {
"type": "object",
"required": [
"fingerprint",
"fp_type",
"since",
"until"
],
"properties": {
"limit": {
"type": "integer",
"default": 50
},
"since": {
"type": "string"
},
"until": {
"type": "string"
},
"fp_type": {
"type": "string"
},
"fingerprint": {
"type": "string"
}
},
"additionalProperties": false
},
"annotations": {
"readOnlyHint": true
}
}{
"name": "ioc_lookup_tool",
"description": "Look up any IP address, CIDR network, set of networks, or domain in the honeypot\n dataset. Use this FIRST whenever the\n user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?',\n 'what does this IP do?', 'when was it last seen?', 'is this IP in your data?'. Returns:\n total_events (0 = never observed), first_seen, last_seen, country, ASN, the 50 most-hit\nports plus ports_targeted_count for the true total,\n top user agents, top URL paths, TLS/HTTP/SSH",
"inputSchema": {
"type": "object",
"required": [
"ioc"
],
"properties": {
"ioc": {
"type": "string"
},
"days": {
"anyOf": [
{
"type": "integer"
},
{
"type": "null"
}
],
"default": null
}
},
"additionalProperties": false
},
"annotations": {
"readOnlyHint": true
}
}Get an email or webhook when this server's readiness drops by 10+ points, tool-poisoning text appears, or a tool breaks:
curl -X POST https://glimind.com/v1/subscriptions -H 'content-type: application/json' -d '{"tools":["mcp-registry/net.honeylabs/mcp"],"email":"[email protected]"}'Agents: watch_tool({"toolId": "mcp-registry/net.honeylabs/mcp"}) over MCP.
search_events_tool ~492 tokenstop_attackers_tool ~278 tokensattack_timeline_tool ~232 tokensfeint_credentials_tool ~221 tokensfingerprint_search_tool ~221 tokensStatic checks of the advertised tools/list (schema, descriptions, annotations, tool-poisoning patterns, names, size) plus observed protocol, uptime, latency and contract changes. Read-only: no tool is ever called. Weights: schema 15, docs 20, safety 15, efficiency 15, compatibility 15, protocol 5, reliability 10, stability 5. Token counts are estimates (~3.6 characters per token).
Operator? Fix these, then re-check live. Embed the readiness badge:
[](https://glimind.com/server/mcp-registry%2Fnet.honeylabs%2Fmcp?ref=badge)
<a href="https://glimind.com/server/mcp-registry%2Fnet.honeylabs%2Fmcp?ref=badge"><img src="https://glimind.com/v1/readiness/badge/mcp-registry%2Fnet.honeylabs%2Fmcp.svg" alt="MCP agent-readiness"></a>
.. image:: https://glimind.com/v1/readiness/badge/mcp-registry%2Fnet.honeylabs%2Fmcp.svg :target: https://glimind.com/server/mcp-registry%2Fnet.honeylabs%2Fmcp?ref=badge :alt: MCP agent-readiness
Glimind records every version of this server's tool definitions in a signed, append-only transparency log. Current manifest sha256:c20cf04e023ecd12…, first seen 2026-10-17, included at leaf 13313 of 72,519. Version history · verify what your client received.
Compare: most reliable security servers · most reliable files servers · most reliable data servers · most reliable other servers
Glimind tells agents whether a server is up right now and how to call it, then fails over to a live alternative when it isn't.
Claude Code
claude mcp add --transport http glimind https://glimind.com/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"glimind": {
"type": "http",
"url": "https://glimind.com/mcp"
}
}
}
As of 2026-10-26 11:33 UTC, the Honeylabs MCP server is up with a Glimind reliability score of 90/100 (grade A). Over the last 30 days it answered 99.9% of Glimind's liveness checks. It had 19 outages in 90 days, with a median recovery of 2 minutes.
Honeylabs MCP server advertises 14 tools, including asn_enrich_tool, attack_timeline_tool, cve_lookup_tool, feint_credentials_tool, feint_files_tool.
Point your MCP client at this streamable-http endpoint: https://mcp.honeylabs.net/mcp
Glimind scanned all 14 tool definitions for tool-poisoning patterns — hidden or invisible characters, instructions that override the model, concealment from the user, requests to read credential or MCP config files, conversation exfiltration and cross-tool shadowing — and found none. This checks what the server tells the model, not what its code does; review the source before granting access to sensitive data.
Status page: 90-day uptime, every outage and how long it lasted.
Claim this listing to get the Verified operator marker, a remediation checklist and owner analytics, or embed the live badge from any of the tool pages above. Maintainers: alerts, deploy attestation and monthly reports.
Status is an automated estimate from Glimind's liveness checks (handshake and tool listing only; no tool is ever called) and may lag or differ from your network. Glimind is not affiliated with this server or its operator. Operator? Request a correction or opt out at https://glimind.com/opt-out.