honey

Alpha software — APIs, config schema, and CLI flags may change between releases without notice.

CLI to search GCP, AWS, Kubernetes, Docker, Consul, Proxmox, and TrueNAS instances in parallel, then SSH, docker exec, or run recipes against results via a TUI, web UI, or MCP server.

Prerequisites

• Go 1.26.2+ (for building from source)
• Credentials for each backend — see Providers

Install

Homebrew (macOS):

brew install --cask shareed2k/tap/honey

Debian/Ubuntu (.deb):

# grab the .deb for your arch from the latest release, then:
dpkg -i honey_*_linux_amd64.deb        # or _arm64

Installs honey to /usr/bin, a systemd service (honey.service, runs as an unprivileged honey user), an example config at /etc/honey/config.yaml, and the honey-plugin-init shim (for docker plugins). Then:

sudoedit /etc/honey/config.yaml        # configure backends / mesh
systemctl enable --now honey
journalctl -u honey -f

For docker: steps / docker plugins, honey needs to reach the Docker socket. This is not granted on install (docker-group membership is root-equivalent) — opt in explicitly:

usermod -aG docker honey && systemctl restart honey

The package recommends tmux (recordings), shellcheck and python3-flake8 (recipe linting) — apt installs them automatically. tun2proxy (for honey egress --tun) isn't in apt; grab it from its releases if you need transparent-proxy mode.

Build from source:

go build -o honey ./cmd/honey

Quick start

# Interactive TUI — search all configured backends
honey search

# Filter by name substring
honey search my-host

# JSON output, AWS + Kubernetes only
honey search --json --provider aws,k8s web

Documentation

Feature	Guide
Providers (GCP, AWS, K8s, Consul, Proxmox, …)	Providers
Docker & auto-discover on cloud VMs	Docker auto-discover
Macros (honeyfile)	Macros
MCP server (Cursor, LM Studio, OpenCode)	MCP Server
Session recordings	Recordings
Web UI & AI assist	Web UI
Run the web UI in Docker (auth token)	contrib/docker/README.md
CUE recipes	CUE Recipes
Anomaly detection	Anomaly Detection
Plugin development	Plugins
Add a new backend	Add new backend

Full docs: shareed2k.github.io/honey

Credits & Licenses

This project leverages state-of-the-art research algorithms to deliver real-time, context-aware operational intelligence:

1. LogLSHD Algorithm (Proposed by Shu-Wei Huang et al.):

   • Description: Locality-Sensitive Hashing with Sequence-Alignment Clustering used for real-time log template mining.
   • License: Creative Commons Attribution 4.0 International (CC BY 4.0).
   • Citations: Huang, S.W., et al. "LogLSHD: Real-Time Log Template Mining via Locality-Sensitive Hashing and Dynamic Time Warping."

2. LLMLog Algorithm (Proposed by Fei Teng, Haoyang Li, and Lei Chen):

   • Description: Greedy set-cover adaptive demonstration selection (Algorithm 3) used for contextual few-shot prompt assembly.
   • License: Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0).
   • Citations: Teng, F., Li, H., & Chen, L. "LLMLog: Advanced Log Template Generation via LLM-driven Multi-Round Annotation" (Proceedings of the VLDB Endowment, VLDB 2025).

3. CoLA Two-Tier Pre-Screening (Proposed by Tang et al.):

   • Description: Model collaboration pipeline filtering obvious logs via fast prescreeners to optimize LLM performance and reduce costs.
   • License: Creative Commons Attribution 4.0 International (CC BY 4.0).
   • Citations: Tang, et al. "CoLA: Model Collaboration for Log-based Anomaly Detection" (Proceedings of the VLDB Endowment, VLDB 2025).

License

MIT