honey

module
v0.3.7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 2, 2026 License: MIT

README

honey logo

honey

Alpha software — APIs, config schema, and CLI flags may change between releases without notice.

CLI to search GCP, AWS, Kubernetes, Docker, Consul, Proxmox, and TrueNAS instances in parallel, then SSH, docker exec, or run recipes against results via a TUI, web UI, or MCP server.

Prerequisites

  • Go 1.26.2+ (for building from source)
  • Credentials for each backend — see Providers

Install

Homebrew (macOS):

brew install --cask shareed2k/tap/honey

Debian/Ubuntu (.deb):

# grab the .deb for your arch from the latest release, then:
dpkg -i honey_*_linux_amd64.deb        # or _arm64

Installs honey to /usr/bin, a systemd service (honey.service, runs as an unprivileged honey user), an example config at /etc/honey/config.yaml, and the honey-plugin-init shim (for docker plugins). Then:

sudoedit /etc/honey/config.yaml        # configure backends / mesh
systemctl enable --now honey
journalctl -u honey -f

For docker: steps / docker plugins, honey needs to reach the Docker socket. This is not granted on install (docker-group membership is root-equivalent) — opt in explicitly:

usermod -aG docker honey && systemctl restart honey

The package recommends tmux (recordings), shellcheck and python3-flake8 (recipe linting) — apt installs them automatically. tun2proxy (for honey egress --tun) isn't in apt; grab it from its releases if you need transparent-proxy mode.

Build from source:

go build -o honey ./cmd/honey

Quick start

# Interactive TUI — search all configured backends
honey search

# Filter by name substring
honey search my-host

# JSON output, AWS + Kubernetes only
honey search --json --provider aws,k8s web

Documentation

Feature Guide
Providers (GCP, AWS, K8s, Consul, Proxmox, …) Providers
Docker & auto-discover on cloud VMs Docker auto-discover
Macros (honeyfile) Macros
MCP server (Cursor, LM Studio, OpenCode) MCP Server
Session recordings Recordings
Web UI & AI assist Web UI
Run the web UI in Docker (auth token) contrib/docker/README.md
CUE recipes CUE Recipes
Anomaly detection Anomaly Detection
Plugin development Plugins
Add a new backend Add new backend

Full docs: shareed2k.github.io/honey

Credits & Licenses

This project leverages state-of-the-art research algorithms to deliver real-time, context-aware operational intelligence:

  1. LogLSHD Algorithm (Proposed by Shu-Wei Huang et al.):

    • Description: Locality-Sensitive Hashing with Sequence-Alignment Clustering used for real-time log template mining.
    • License: Creative Commons Attribution 4.0 International (CC BY 4.0).
    • Citations: Huang, S.W., et al. "LogLSHD: Real-Time Log Template Mining via Locality-Sensitive Hashing and Dynamic Time Warping."

  2. LLMLog Algorithm (Proposed by Fei Teng, Haoyang Li, and Lei Chen):

  3. CoLA Two-Tier Pre-Screening (Proposed by Tang et al.):

    • Description: Model collaboration pipeline filtering obvious logs via fast prescreeners to optimize LLM performance and reduce costs.
    • License: Creative Commons Attribution 4.0 International (CC BY 4.0).
    • Citations: Tang, et al. "CoLA: Model Collaboration for Log-based Anomaly Detection" (Proceedings of the VLDB Endowment, VLDB 2025).

License

MIT

Directories

Path Synopsis
cmd
honey command
Package main is the honey CLI entrypoint.
 Package main is the honey CLI entrypoint.
honey-plugin-init command
Package main is the honey-plugin-init HTTP shim that runs arbitrary argv commands in a container, capturing stdout/stderr and exit codes for the dockerTransport.
 Package main is the honey-plugin-init HTTP shim that runs arbitrary argv commands in a container, capturing stdout/stderr and exit codes for the dockerTransport.
honey-transfer-agent command
Package main implements the honey-transfer-agent: upload/download cloud objects with short-lived credentials (JWE or env), optional interactive setup, and a JSON session mode.
 Package main implements the honey-transfer-agent: upload/download cloud objects with short-lived credentials (JWE or env), optional interactive setup, and a JSON session mode.
internal
aichat
Package aichat performs OpenAI-compatible chat HTTP calls for local recipe summarization.
 Package aichat performs OpenAI-compatible chat HTTP calls for local recipe summarization.
alerts
Package alerts dispatches anomaly notifications with TTL-cache deduplication.
 Package alerts dispatches anomaly notifications with TTL-cache deduplication.
alertwebhook
Package alertwebhook implements an Alertmanager-compatible webhook receiver.
 Package alertwebhook implements an Alertmanager-compatible webhook receiver.
anomaly
Package anomaly provides log anomaly detection using ONNX models or a built-in heuristic fallback.
 Package anomaly provides log anomaly detection using ONNX models or a built-in heuristic fallback.
approval
Package approval holds pending recipe runs that an OPA policy flagged as require_approval, until an authorized actor approves or denies them.
 Package approval holds pending recipe runs that an OPA policy flagged as require_approval, until an authorized actor approves or denies them.
apps
Package apps provides structures and validation for configuring target proxy applications in honey.yaml.
 Package apps provides structures and validation for configuring target proxy applications in honey.yaml.
appsecret
Package appsecret handles decryption of secure:v1 app upstream DSNs.
 Package appsecret handles decryption of secure:v1 app upstream DSNs.
audit
Package audit provides a durable, append-only audit event log.
 Package audit provides a durable, append-only audit event log.
cli
Package cli implements the honey Cobra commands.
 Package cli implements the honey Cobra commands.
cloudtransfer
Package cloudtransfer resolves short-lived cloud credentials for staging (S3 / GCS).
 Package cloudtransfer resolves short-lived cloud credentials for staging (S3 / GCS).
cmdgate
Package cmdgate is the single decision point for whether a command may run on a host.
 Package cmdgate is the single decision point for whether a command may run on a host.
commandrisk
Package commandrisk analyzes recipe commands for dangerous patterns.
 Package commandrisk analyzes recipe commands for dangerous patterns.
config
Package config loads optional YAML settings and backend definitions for honey.
 Package config loads optional YAML settings and backend definitions for honey.
cuetry
Package cuetry parses, validates, and resolves CUE remote recipes for honey.
 Package cuetry parses, validates, and resolves CUE remote recipes for honey.
cuetry/secrets
Package secrets resolves CUE recipe secret refs.
 Package secrets resolves CUE recipe secret refs.
cuetry/secrets/stack
Package stack implements symmetric secure:v1 encryption for recipe secrets.
 Package stack implements symmetric secure:v1 encryption for recipe secrets.
cuetry/secrets/stackunwrap
Package stackunwrap unwraps stack data keys from secretsprovider URLs (KMS, keyring, age, etc.).
 Package stackunwrap unwraps stack data keys from secretsprovider URLs (KMS, keyring, age, etc.).
devmtls
Package devmtls holds the process-wide device mTLS client credential used to reach honey servers behind an mTLS gateway.
 Package devmtls holds the process-wide device mTLS client credential used to reach honey servers behind an mTLS gateway.
engine
Package engine implements the CUE recipe execution loop, decoupled from UI.
 Package engine implements the CUE recipe execution loop, decoupled from UI.
hostapi
Package hostapi implements shared host search and backend listing for HTTP and MCP surfaces.
 Package hostapi implements shared host search and backend listing for HTTP and MCP surfaces.
hostexec
Package hostexec defines the execution surface (HostClient, Executor) shared by the TUI, web server, CUE runner, and provider-specific transports.
 Package hostexec defines the execution surface (HostClient, Executor) shared by the TUI, web server, CUE runner, and provider-specific transports.
hosts
Package hosts defines the host search record model and pluggable cloud backends.
 Package hosts defines the host search record model and pluggable cloud backends.
inventory
Package inventory converts honey host records into Ansible-compatible JSON inventory.
 Package inventory converts honey host records into Ansible-compatible JSON inventory.
jsonutil
Package jsonutil wraps goccy/go-json as a drop-in for encoding/json.
 Package jsonutil wraps goccy/go-json as a drop-in for encoding/json.
k8sdebug
Package k8sdebug provides utilities for Kubernetes debug containers.
 Package k8sdebug provides utilities for Kubernetes debug containers.
logger
Package logger provides global debug logging initialization via go.uber.org/zap.
 Package logger provides global debug logging initialization via go.uber.org/zap.
macros
Package macros loads and validates honeyfile.yaml macro sets.
 Package macros loads and validates honeyfile.yaml macro sets.
mcpserver
Package mcpserver implements the Model Context Protocol (stdio) server for honey.
 Package mcpserver implements the Model Context Protocol (stdio) server for honey.
meshnet
Package meshnet holds the process-wide libp2p Host used to reach (and be reached by) honey backends flagged mesh: true, even when they sit behind NAT/CGNAT with no port-forward.
 Package meshnet holds the process-wide libp2p Host used to reach (and be reached by) honey backends flagged mesh: true, even when they sit behind NAT/CGNAT with no port-forward.
metrics
Package metrics provides Prometheus instrumentation for honey web.
 Package metrics provides Prometheus instrumentation for honey web.
plugincache
Package plugincache provides a shared, reference-counted plugin manager that survives config reloads without disrupting in-flight requests.
 Package plugincache provides a shared, reference-counted plugin manager that survives config reloads without disrupting in-flight requests.
plugins
Package plugins loads Extism WASM plugins for honey (CUE transforms, custom steps, secret ref backends, and local hooks).
 Package plugins loads Extism WASM plugins for honey (CUE transforms, custom steps, secret ref backends, and local hooks).
plugins/api/v1
Package v1 defines the honey.plugins/v1 JSON contract between the host and WASM plugins.
 Package v1 defines the honey.plugins/v1 JSON contract between the host and WASM plugins.
policy
Package policy evaluates Open Policy Agent (OPA) rego policies for honey's authorization decisions: recipe admission, API gating, in-recipe checks, and host-list filtering.
 Package policy evaluates Open Policy Agent (OPA) rego policies for honey's authorization decisions: recipe admission, API gating, in-recipe checks, and host-list filtering.
postgres
Package postgres runs host-mediated PostgreSQL queries via pgx on the operator.
 Package postgres runs host-mediated PostgreSQL queries via pgx on the operator.
provider/all
Package all provides all native honey provider factories.
 Package all provides all native honey provider factories.
provider/awsprovider
Package awsprovider lists EC2 instances as honey host records.
 Package awsprovider lists EC2 instances as honey host records.
provider/backendruntime
Package backendruntime provides a shared, thread-safe named-lookup registry for provider runtime configs (API credentials, exec mode).
 Package backendruntime provides a shared, thread-safe named-lookup registry for provider runtime configs (API credentials, exec mode).
provider/consulprovider
Package consulprovider lists Consul catalog nodes as honey host records.
 Package consulprovider lists Consul catalog nodes as honey host records.
provider/dockerprovider
Package dockerprovider implements the honey Docker Engine search backend.
 Package dockerprovider implements the honey Docker Engine search backend.
provider/gcp
Package gcp lists Compute Engine VMs as honey host records.
 Package gcp lists Compute Engine VMs as honey host records.
provider/honeyprovider
Package honeyprovider implements the remote honey backend integration.
 Package honeyprovider implements the remote honey backend integration.
provider/k8sprovider
Package k8sprovider lists Kubernetes nodes or pods as honey host records.
 Package k8sprovider lists Kubernetes nodes or pods as honey host records.
provider/localprovider
Package localprovider provides the ability to manage and search manually defined hosts.
 Package localprovider provides the ability to manage and search manually defined hosts.
provider/proxmoxprovider
Package proxmoxprovider provides Proxmox search capabilities for honey.
 Package proxmoxprovider provides Proxmox search capabilities for honey.
provider/truenasprovider
Package truenasprovider discovers TrueNAS SCALE hosts via the WebSocket JSON-RPC API.
 Package truenasprovider discovers TrueNAS SCALE hosts via the WebSocket JSON-RPC API.
proxy
Package proxy manages background connections, tunnels, and active sessions for applications.
 Package proxy manages background connections, tunnels, and active sessions for applications.
proxy/reverseproxy
Package reverseproxy provides a Teleport-inspired HTTP reverse proxy.
 Package reverseproxy provides a Teleport-inspired HTTP reverse proxy.
pvelxc
Package pvelxc implements Proxmox VE LXC and QEMU serial console (termproxy/vncwebsocket) bridging for the web UI and TUI.
 Package pvelxc implements Proxmox VE LXC and QEMU serial console (termproxy/vncwebsocket) bridging for the web UI and TUI.
queue
Package queue provides asynchronous task execution interfaces and implementations.
 Package queue provides asynchronous task execution interfaces and implementations.
recipenotify
Package recipenotify wires github.com/nikoksr/notify from environment variables for CUE recipe step notifications.
 Package recipenotify wires github.com/nikoksr/notify from environment variables for CUE recipe step notifications.
recordings
Package recordings parses session .hrec.jsonl files used by the web UI and TUI replay.
 Package recordings parses session .hrec.jsonl files used by the web UI and TUI replay.
safepath
Package safepath constrains filesystem paths for user-controlled inputs (cache roots, config discovery, recipe files) and performs reads/writes via os.Root where appropriate.
 Package safepath constrains filesystem paths for user-controlled inputs (cache roots, config discovery, recipe files) and performs reads/writes via os.Root where appropriate.
scheduler
Package scheduler provides a cron-based trigger layer for CUE recipe apps.
 Package scheduler provides a cron-based trigger layer for CUE recipe apps.
searchrun
Package searchrun wires CLI flags and YAML config to host search and caching.
 Package searchrun wires CLI flags and YAML config to host search and caching.
snippets
Package snippets stores reusable web-UI exec snippets (saved commands/scripts) behind a pluggable Store interface.
 Package snippets stores reusable web-UI exec snippets (saved commands/scripts) behind a pluggable Store interface.
sshclient
Package sshclient provides SSH client dialing, SFTP, tunnels, and known_hosts helpers for honey.
 Package sshclient provides SSH client dialing, SFTP, tunnels, and known_hosts helpers for honey.
stepkv
Package stepkv implements a tiny loopback HTTP key/value API backed by an in-memory TTL cache.
 Package stepkv implements a tiny loopback HTTP key/value API backed by an in-memory TTL cache.
transferagent
Package transferagent resolves and cross-builds honey-transfer-agent binaries for target GOOS/GOARCH and optional cloud flavor (S3/GCS/full).
 Package transferagent resolves and cross-builds honey-transfer-agent binaries for target GOOS/GOARCH and optional cloud flavor (S3/GCS/full).
transferagent/presign
Package presign generates short-lived presigned URLs for transferring files to/from S3 or GCS without requiring an agent binary on the remote host.
 Package presign generates short-lived presigned URLs for transferring files to/from S3 or GCS without requiring an agent binary on the remote host.
truenasshell
Package truenasshell bridges honey web terminals to TrueNAS /websocket/shell.
 Package truenasshell bridges honey web terminals to TrueNAS /websocket/shell.
tun
Package tun manages transparent VPN tunnels via tun2proxy-bin subprocess.
 Package tun manages transparent VPN tunnels via tun2proxy-bin subprocess.
udprelaywire
Package udprelaywire is the shared datagram-frame codec and target validator for the UDP relay bridge between honeyprovider (client) and webserver (server).
 Package udprelaywire is the shared datagram-frame codec and target validator for the UDP relay bridge between honeyprovider (client) and webserver (server).
ui
Package ui implements the bubbletea TUI, SSH helpers, and CUE recipe execution for honey.
 Package ui implements the bubbletea TUI, SSH helpers, and CUE recipe execution for honey.
webauthn
Package webauthn provides WebAuthn (passkey) registration and assertion for biometric step-up, plus a short-lived signed token minted on a successful assertion.
 Package webauthn provides WebAuthn (passkey) registration and assertion for biometric step-up, plus a short-lived signed token minted on a successful assertion.
webserver
Package webserver provides the embedded HTTP server for honey.
 Package webserver provides the embedded HTTP server for honey.
webserver/cmd/swag2openapi command
Command swag2openapi converts swag-generated Swagger 2.0 JSON to OpenAPI 3.x JSON for honey web.
 Command swag2openapi converts swag-generated Swagger 2.0 JSON to OpenAPI 3.x JSON for honey web.
webserver/recipestore
Package recipestore provides extensible storage abstractions for managing recipe content.
 Package recipestore provides extensible storage abstractions for managing recipe content.
webserver/swaggerdocs
webserver/workspacestore
Package workspacestore persists the studio workspace layout blob on disk.
 Package workspacestore persists the studio workspace layout blob on disk.
pkg
mobile
Package mobile provides the gomobile bindings for honey.
 Package mobile provides the gomobile bindings for honey.
pluginpdk
Package pluginpdk provides helpers for honey WASM plugins built with the Extism Go PDK.
 Package pluginpdk provides helpers for honey WASM plugins built with the Extism Go PDK.
plugins
bash command
copy command
cve-scanner command
cve-scanner is a honey WASM plugin for CVE scanning and security patching.
 cve-scanner is a honey WASM plugin for CVE scanning and security patching.
cve-scanner/cvescan
Package cvescan holds the pure, host-testable logic of the cve-scanner plugin: config types, scanner/patch shell-script construction, and parsing of scanner output into a normalized report.
 Package cvescan holds the pure, host-testable logic of the cve-scanner plugin: config types, scanner/patch shell-script construction, and parsing of scanner output into a normalized report.
file command
helm command
Package main implements the Honey helm WASM plugin.
 Package main implements the Honey helm WASM plugin.
js command
js is a honey WASM plugin that runs a user JavaScript snippet in an embedded goja interpreter, exposing a capability-gated host API (remote_exec, kv, log).
 js is a honey WASM plugin that runs a user JavaScript snippet in an embedded goja interpreter, exposing a capability-gated host API (remote_exec, kv, log).
js/jsrun
Package jsrun holds the pure, host-testable core of the js plugin: it runs a user JavaScript snippet in an embedded goja interpreter, exposing a narrow, capability-gated host API (remote_exec, kv, log) injected by the caller.
 Package jsrun holds the pure, host-testable core of the js plugin: it runs a user JavaScript snippet in an embedded goja interpreter, exposing a narrow, capability-gated host API (remote_exec, kv, log) injected by the caller.
postgres command
prometheus command
Package main implements the Honey prometheus WASM plugin.
 Package main implements the Honey prometheus WASM plugin.
rclone command
Package main implements the honey rclone RC WASM plugin action registry.
 Package main implements the honey rclone RC WASM plugin action registry.
service command
shell command
sqlite command
Package main implements the Honey SQLite WASM plugin.
 Package main implements the Honey SQLite WASM plugin.
template command

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.