{"serverId":"mcp-registry/net.honeylabs/mcp","tools":[{"name":"cve_lookup_tool","fixed":{"name":"cve_lookup_tool","description":"Who is probing a specific CVE. Use whenever the user names a CVE: 'is CVE-2024-4577\nbeing exploited in the wild?', 'who is scanning for this CVE?', 'show me actors probing\nCVE-2023-1389'. Returns title, severity, KEV status (actively_exploited, and `kev`: the\nCISA catalogue entry with date_added, or null), event and unique-IP counts\nover both sensor types (first_contact_events and interactive_requests split them; an\naddress both saw counts once), the top probing IPs with country/ASN and `scanner","inputSchema":{"type":"object","required":["cve_id"],"properties":{"limit":{"type":"integer","default":25},"cve_id":{"type":"string"},"window":{"type":"string","default":"7d"}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":210,"tokensAfter":210},{"name":"fingerprint_search_tool","fixed":{"name":"fingerprint_search_tool","description":"Search honeypot activity by TLS, HTTP, or SSH fingerprint. Use when a user asks:\n'have you seen this JA4 fingerprint?', 'which IPs share this TLS fingerprint?', 'how\ncommon is this HASSH?', 'find all scanners with this SSH client fingerprint'. fp_type:\n'ja4' (TLS client), 'ja3' (legacy TLS client, MD5, still keyed by many TI feeds),\n'akin' (HTTP request shape, e.g. b11cun030_00040014_54d07b6d), 'hassh' (SSH client).\nsince/until are ISO-8601 UTC strings.","inputSchema":{"type":"object","required":["fingerprint","fp_type","since","until"],"properties":{"limit":{"type":"integer","default":50},"since":{"type":"string"},"until":{"type":"string"},"fp_type":{"type":"string"},"fingerprint":{"type":"string"}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":221,"tokensAfter":221},{"name":"ioc_lookup_tool","fixed":{"name":"ioc_lookup_tool","description":"Look up any IP address, CIDR network, set of networks, or domain in the honeypot\n    dataset. Use this FIRST whenever the\n    user asks: 'is this IP malicious?', 'is this a known scanner?', 'have you seen this IP?',\n    'what does this IP do?', 'when was it last seen?', 'is this IP in your data?'. Returns:\n    total_events (0 = never observed), first_seen, last_seen, country, ASN, the 50 most-hit\nports plus ports_targeted_count for the true total,\n    top user agents, top URL paths, TLS/HTTP/SSH","inputSchema":{"type":"object","required":["ioc"],"properties":{"ioc":{"type":"string"},"days":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":205,"tokensAfter":205},{"name":"payload_search_tool","fixed":{"name":"payload_search_tool","description":"Literal substring search over captured request text: URL path, request body,\nrequest headers and event summary. Use for: 'find attacks targeting /wp-admin',\n'find requests with this user agent string', 'what payloads hit port 80 last week'.\n\nIt matches text that literally appeared in the request, and nothing else. These do\nNOT work and will return an empty list:\n  - a CVE id ('CVE-2024-4577'), which is our tag for a pattern, never payload text.\n    Use cve_lookup instead. This tool rejects them ","inputSchema":{"type":"object","required":["query","since","until"],"properties":{"limit":{"type":"integer","default":50},"query":{"type":"string"},"since":{"type":"string"},"until":{"type":"string"}},"additionalProperties":false},"annotations":{"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: false, destructiveHint: false, idempotentHint: false (inferred from the name).","verify":true}],"tokensBefore":219,"tokensAfter":219},{"name":"search_events_tool","fixed":{"name":"search_events_tool","description":"Return individual raw honeypot events with all fields. Use when the user wants to see\nactual records: 'show me events from this IP', 'what hit port 443 last week', 'events from\nRussia yesterday'. Filters: source_ip, country (2-letter code), asn (e.g. 'AS12345'),\ndest_port, protocol ('tls' or '' = the coarse TLS/raw-TCP signal),\napp_protocol (nDPI L7 protocol label: 'bittorrent', 'ssh', 'rdp', 'mssql-tds', 'mining',\n'rtsp', 'smbv1', ... — find everything speaking a protocol regardless of port),\nh","inputSchema":{"type":"object","required":["since","until"],"properties":{"asn":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"ja3":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"ja4":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"akin":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"limit":{"type":"integer","default":100},"since":{"type":"string"},"until":{"type":"string"},"country":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"protocol":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"dest_port":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null},"source_ip":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"ip_version":{"anyOf":[{"type":"integer"},{"type":"null"}],"default":null},"http_method":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"app_protocol":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"source_domain":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"request_header":{"anyOf":[{"type":"string"},{"type":"null"}],"default":null},"has_client_cert":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":null}},"additionalProperties":false},"annotations":{"readOnlyHint":true}},"changes":[{"kind":"annotations","detail":"Added readOnlyHint: true (inferred from the name).","verify":true}],"tokensBefore":492,"tokensAfter":492}],"toolsChanged":5,"tokensSaved":0,"todo":[{"tool":"asn_enrich_tool","params":["asn","since","until"]},{"tool":"attack_timeline_tool","params":["since","until","bucket","filter_country","filter_protocol","filter_dest_port"]},{"tool":"cve_lookup_tool","params":["limit","cve_id","window"]},{"tool":"feint_credentials_tool","params":["limit","source","window","service"]},{"tool":"feint_files_tool","params":["limit","sha256","source","window"]},{"tool":"feint_sessions_tool","params":["limit","source","window"]},{"tool":"fingerprint_population_tool","params":["fp_type","fingerprint"]},{"tool":"fingerprint_search_tool","params":["limit","since","until","fp_type","fingerprint"]},{"tool":"fingerprint_similar_tool","params":["limit","fingerprint","max_distance"]},{"tool":"ioc_lookup_tool","params":["ioc","days"]},{"tool":"payload_search_tool","params":["limit","query","since","until"]},{"tool":"search_events_tool","params":["asn","ja3","ja4","akin","limit","since","until","country","protocol","dest_port","source_ip","ip_version","http_method","app_protocol","source_domain","request_header","has_client_cert"]},{"tool":"top_attackers_tool","params":["by","asn","limit","since","until","country","dest_port"]},{"tool":"udp_activity_tool","params":["query","window","samples"]}],"note":"Deterministic fixes. Changes marked verify need a human look before shipping (renames, inferred annotations, inferred types, removed text). Parameter descriptions in `todo` need to be written by someone who knows the API."}