Project Overview

Honeynet-bot is a functional proof-of-concept that wraps IntelOwl's threat-intelligence REST API behind a conversational MCP interface. A LangChain ReAct agent dynamically discovers 12 Zod-validated tools through MultiServerMCPClient and uses them to launch observable analyses on domains, IPs, URLs, and hashes, poll asynchronous job status with a five-minute hard timeout, and retrieve reports and scan history. Session-level conversational memory is maintained via LangGraph MemorySaver. The architecture is split into an agent client and an Express 5 MCP server that proxies requests to IntelOwl over Streamable HTTP. Responses stream in real time to an interactive CLI.