hp-viz
hp-viz is a terminal app for watching the HoneyPeer public attack visualizer in real time — live feed, incidents, peers, stats, and threat-intelligence blog posts, without opening a browser.
Default data source: viz.honeypeer.com
Download
Rolling binaries are always at the latest release — no version numbers; each push to main replaces the build.
Linux (amd64)
curl -fsSL -o hp-viz.tar.gz \
"https://git.ssh.surf/snxraven/honeypeer-viz-cli/releases/download/latest/hp-viz-linux-amd64.tar.gz"
tar -xzf hp-viz.tar.gz
sudo install -m755 hp-viz-linux-amd64 /usr/local/bin/hp-viz
macOS (Apple Silicon)
curl -fsSL -o hp-viz.tar.gz \
"https://git.ssh.surf/snxraven/honeypeer-viz-cli/releases/download/latest/hp-viz-darwin-arm64.tar.gz"
tar -xzf hp-viz.tar.gz
sudo install -m755 hp-viz-darwin-arm64 /usr/local/bin/hp-viz
Also available: hp-viz-linux-arm64, hp-viz-darwin-amd64. SHA256 checksums (.sha256) sit beside each archive on the release page.
Build from source
Requires Go 1.22+ and a truecolor terminal (COLORTERM=truecolor recommended).
git clone https://git.ssh.surf/snxraven/honeypeer-viz-cli.git
cd honeypeer-viz-cli
go build -o hp-viz ./cmd/hp-viz/
Quick start
# Live public feed
hp-viz
# Another HoneyPeer instance
hp-viz --url https://your-master.example.com
# Offline demo (bundled fixture)
hp-viz --fixture tests/fixtures/sse-sample.txt
Configuration
| Variable | Description |
|---|---|
HP_VIZ_URL |
Master base URL (default: https://viz.honeypeer.com) |
HP_VIZ_BUFFER |
In-memory feed size (default 1000) |
HP_VIZ_MOUSE |
Set 1 or true to enable mouse on startup |
Optional file: ~/.config/hp-viz/config.yaml (see config.yaml.example).
Precedence: flags → environment → config file → defaults.
| Flag | Description |
|---|---|
--url |
Master base URL |
--buffer |
Feed buffer size |
--fixture |
Replay SSE from a file (no network) |
--record |
Append live SSE events to JSONL |
--no-color |
Disable colors |
--bell |
Terminal bell on high-severity events |
Keyboard
| Key | Action |
|---|---|
j / k, ↑ / ↓ |
Move selection |
Tab |
Feed → Incidents → Peers → Stats → Blog |
Enter |
Open detail (or read blog post on Blog tab) |
Esc |
Close detail / back from blog post / cancel filter |
Ctrl+M |
Toggle mouse (off by default) |
f |
Toggle follow mode (auto-scroll to newest) |
/ |
Filter — text or service:ssh geo:cn peer:id since:1h |
PgUp |
Load older history (Feed / Incidents / Blog) |
PgDn |
Page down in list |
r |
Reconnect stream |
? |
Help overlay |
q |
Quit |
In the detail view, j/k or the mouse wheel scroll long content.
What you see
- Feed — live attacks, blocks, moderation events (masked IPs on the public feed)
- Incidents — grouped activity with drill-down detail
- Peers — mesh roster and connect/disconnect events
- Stats — aggregates and breakdowns
- Blog — published HoneyPeer threat briefings (markdown, tables, charts)
Timestamps use your local timezone.
Releases (maintainers)
Every push to main runs tests, then rebuilds and replaces the rolling latest release (fixed asset names, commit SHA in release notes). Requires the RELEASE_TOKEN Actions secret with release write access.
Tests
go test ./...
License
See repository license file.