INDIVIDUAL MCP TOOL
fingerprint_population_tool
The population behind a single client fingerprint: how many source IPs carry it, across how many networks (ASNs) and countries, the ports they hit, the top networks and a sample of the IPs, plus a read on whether it is concentrated (a likely coordinated operation, many IPs on few networks) or spread thin (a common client).
Input schema
{}Risk classification
Inferred read-only · medium confidence · heuristic, not a guarantee.
- No write-capable action terms were found; this is not proof that invocation has no side effects.
Parent endpoint
CONNECT WITH APPROVAL
Client installation
Review this server and its permissions before adding it. Secret placeholders must be set locally.
Codex
~/.codex/config.toml
[mcp_servers.honeylabs-threat-intelligence]
url = "https://mcp.honeylabs.net/mcp"
enabled = true
Claude Code
.mcp.json
{
"mcpServers": {
"honeylabs-threat-intelligence": {
"type": "http",
"url": "https://mcp.honeylabs.net/mcp"
}
}
}
Claude Desktop
Settings → Connectors → Add custom connector
Name: honeylabs-threat-intelligence
Remote MCP URL: https://mcp.honeylabs.net/mcp
Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.
Cursor
.cursor/mcp.json
{
"mcpServers": {
"honeylabs-threat-intelligence": {
"url": "https://mcp.honeylabs.net/mcp"
}
}
}
Visual Studio Code
.vscode/mcp.json
Add to Visual Studio Code{
"servers": {
"honeylabs-threat-intelligence": {
"type": "http",
"url": "https://mcp.honeylabs.net/mcp"
}
}
}
Generic MCP
Client-specific MCP configuration
{
"name": "honeylabs-threat-intelligence",
"transport": "streamable-http",
"url": "https://mcp.honeylabs.net/mcp"
}
MCP Inspector
Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.
Related tools
search_events_tool— Return individual raw honeypot events with all fields.top_attackers_tool— Ranked leaderboard of attack sources.ioc_lookup_tool— Look up any IP address or domain in the honeypot dataset.payload_search_tool— Full-text search across HTTP URL paths and user agents in attack traffic.attack_timeline_tool— Attack volume over time, bucketed by hour or day.asn_enrich_tool— Full honeypot profile for an ASN (autonomous system / hosting provider).fingerprint_search_tool— Search honeypot activity by TLS, HTTP, or SSH fingerprint.