INDIVIDUAL MCP TOOL

asn_enrich_tool

Full honeypot profile for an ASN (autonomous system / hosting provider).

honeylabs.netnone authenticationAvailability not checked

Input schema

{}

Inferred read-only · medium confidence · heuristic, not a guarantee.

No write-capable action terms were found; this is not proof that invocation has no side effects.

CONNECT WITH APPROVAL

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.honeylabs-threat-intelligence]
url = "https://mcp.honeylabs.net/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "honeylabs-threat-intelligence": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: honeylabs-threat-intelligence
Remote MCP URL: https://mcp.honeylabs.net/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "honeylabs-threat-intelligence": {
      "url": "https://mcp.honeylabs.net/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "honeylabs-threat-intelligence": {
      "type": "http",
      "url": "https://mcp.honeylabs.net/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "honeylabs-threat-intelligence",
  "transport": "streamable-http",
  "url": "https://mcp.honeylabs.net/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

search_events_tool — Return individual raw honeypot events with all fields.
top_attackers_tool — Ranked leaderboard of attack sources.
ioc_lookup_tool — Look up any IP address or domain in the honeypot dataset.
payload_search_tool — Full-text search across HTTP URL paths and user agents in attack traffic.
attack_timeline_tool — Attack volume over time, bucketed by hour or day.
fingerprint_search_tool — Search honeypot activity by TLS, HTTP, or SSH fingerprint.
fingerprint_population_tool — The population behind a single client fingerprint: how many source IPs carry it, across how many networks (ASNs) and countries, the ports they hit, the top networks and a sample of the IPs, plus a read on whether it is concentrated (a likely coordinated operation, many IPs on few networks) or spread thin (a common client).