HoneyLabs is Needs Work to agents.
Discry independently scored how well an AI agent can discover and understand the HoneyLabs API from what’s public — not whether it’s usable. Below: every signal we checked, what’s costing the score, and what to change.
SCORED UNDER RUBRIC 1.2 · A full re-launch under Discry Score 2.5 — a new behavioral instrument, not comparable to these scores — is in progress.
Discovery
45% of score · 29/100Comprehension
55% of score · 90/100What we found
- An AI agent can connect to HoneyLabs with zero glue code: it ships a first-class remote MCP server (streamable HTTP at mcp.honeylabs.net/mcp) with OAuth 2.1/PKCE and is already listed on the Glama MCP registry — this is one of the most genuinely agent-native APIs in the set.
- The /mcp page hands an agent a clean tool catalog (ioc_lookup, top_attackers, search_events, payload_search, attack_timeline, asn_enrich, fingerprint_search, scanner_lookup, port_spikes) with task-oriented one-liners plus six copy-paste SOC workflow prompts — comprehension scored an A (90/100).
- Despite excellent human-and-agent docs, an agent doing pure machine discovery finds almost nothing: llms.txt, llms-full.txt, .well-known/mcp.json, and an OpenAPI spec all 404, and there is no AGENTS.md in the public GitHub repos — the entire discovery layer rests on robots.txt, sitemap.xml, and the registry listing (29/100, F).
- Examples are unusually good for agents: realistic RFC 5737 documentation IPs, real CVEs (CVE-2024-4577), real ASNs (AS14061 = DigitalOcean), copy-paste curl commands, and trimmed JSON response samples throughout, with a consistent snake_case field vocabulary and documented field aliases.
- robots.txt allows all AI crawlers (it only blocks SEO bots like AhrefsBot/SemrushBot), so nothing stops an agent from reading the docs — the gap is purely the absence of the machine-readable index files that would let an agent discover capabilities without scraping JS-rendered pages.
What to change
Prioritized by impact on discoverability. You (or your docs platform) deploy these — Discry never touches your API.
- 01Add an llms.txt at the domain root that names the API, links /docs and /mcp, and lists the MCP tool catalog — this is the single highest-impact discovery fix and would move the discovery score most (currently a hard fail plus an auto-fail on llms.txt quality).
- 02Publish an OpenAPI (or at least a JSON-RPC method) spec for the HTTP surface (/lookup, /api/showcase, /api/stats, /api/cves, /api/ports) so agents can enumerate endpoints and parameters without reverse-engineering the search grammar.
- 03Add an AGENTS.md to the public GitHub repos (honeylabshq/spip-go, honeylabshq/loom, and the MCP server repo) describing how a coding agent should call the service — a rising standard now weighted 3/21.
- 04Serve a .well-known/mcp.json declaring the remote MCP endpoint, transport, tool list, and auth (OAuth 2.1/PKCE + Bearer) so MCP-aware clients can auto-discover the server instead of relying on copy-paste config.
- 05Add a short error-handling section to /docs: document the error response shape and give explicit recovery steps for the common cases (e.g. on 429 back off / add a key to switch to the credit budget; on out-of-window time ranges upgrade to Pro for 30d/90d).
Execution coverage · INFORMATIONAL, UNSCORED
Whether an agent can actually complete a call and recover from errors is the deeper Audit layer — documented here, but not part of the Discry Score.
Read-only query API. Auth is a Bearer API key (hlk_ token from the dashboard) for HTTP, or OAuth 2.1 with PKCE for the MCP connector. Rate limits are documented with specific numbers (10 req/min, 100 req/hr per source IP for anonymous use; keyed requests use a daily credit budget where 1 credit = 1 row). Error response format, pagination, and idempotency are not explicitly documented — though read-only GET semantics make idempotency implicit.