TheLeaf Threat Observatory

Overview

TheLeaf Threat Observatory is a Model Context Protocol server that provides read-only access to honeypot evidence including observed IPs, activity, sessions, and payloads. The data is delayed and made public to support threat intelligence workflows. As an MCP server, it integrates directly into AI assistants, exposing honeypot analysis capabilities as tools that models can invoke on your behalf.

TheLeaf Threat Observatory runs as a remote hosted service. Simply connect your MCP client to https://observatory.theleaf.ai/mcp and you're ready to go — no local installation needed. Authentication is not required. The current release is v1.0.0.

This server is listed in the Security category on mcp.site and works with MCP clients including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Zed, and others. If you maintain TheLeaf Threat Observatory for observatory.theleaf.ai, claim this listing to verify ownership, earn the Verified badge, and keep information current.

Installation

Settings → Connectors → Add custom connector
Name: TheLeaf Threat Observatory
URL:  https://observatory.theleaf.ai/mcp