Skip to main content
Glama
Sign In

Vysion

by ai.vysion.mcp
OverviewDiscussionsAdmin

Server Details

Darknet threat intelligence for AI assistants: leaked credentials, documents, Telegram and Discord chatter, and ransomware victims.

Ownership verified
Status
Healthy
Uptime
86.7% over the last 24 hours
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL
ChatGPT
–
Claude
–

TDQS

B3.2/5.0

Scored across 40 tools

Disambiguation4/5

Most tools target clearly distinct entities and actions across documents, IM, leaks, ransomware, and crypto. There is some overlap between generic searches (search_leaks, search_documents) and specialized 'by_*' lookup tools, but the descriptions generally make the intended use clear.

Naming Consistency5/5

The tool set follows a highly consistent snake_case verb_noun pattern: get_*, search_*, and entity/id qualifiers. Naming is predictable across all subdomains, with only minor redundancies such as 'by_channel_id' that do not break the pattern.

Tool Count2/5

With 40 tools, the surface is large for an MCP server and exceeds the practical range for quick agent selection. Many tools are convenience variants of broader search functions, making the set feel heavier than necessary even for a broad OSINT platform.

Completeness4/5

Coverage is strong across darknet documents, IM, leaks, ransomware, and crypto/onion feeds, including search, lookup, and detail retrieval. Minor gaps remain, such as no phone-number search in the IM database and no document lookup by username, but core investigation workflows are well supported.

Publisher details

Operator
Byron Labs · Publisher source
Operator website
Not applicable
Vendor relationship
Not applicable
Documentation
https://developers.vysion.ai/guides/mcp-server/
Trust center
https://byronlabs.io/en/privacy-policy
Restrictions
API Key is needed; contact Byron Labs. info@byronlabs.io

Available Tools

40 tools
get_cryptocurrency_feedCInspect

Get cryptocurrency wallet feed from Vysion filtered by platform. Platforms: all, darknet, telegram, discord.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: platform (required), gte, lte, page, +2 more.

get_document_by_idAInspect

Retrieve a specific document from Vysion by its unique ID. Use when you already have a document ID from a previous search.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: id (required).

get_document_by_urlAInspect

Look up a document in Vysion by the URL of the indexed page (clearnet, Tor .onion, or I2P), e.g. 'raidforums.im/Thread-X?page=2'. Use to check if a specific URL is indexed. Do NOT use for app.vysion.ai/document/ links: extract the and call get_document_by_id instead.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: url (required).

get_document_html_by_idBInspect

Retrieve the content of a darknet document from Vysion by its ID. By default returns the readable text of the page (format='text'); use format='html' only if you need the raw HTML markup.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: id (required), format, download.

get_documents_by_emailCInspect

Search Vysion for documents containing or linked to an email address. Use for OSINT and identity investigation.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: email (required), gte, lte, page, +1 more.

get_documents_by_phoneBInspect

Search Vysion for documents containing or linked to a phone number. Requires country code. Use for OSINT investigation.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: number (required), country_code (required), gte, lte, +2 more.

get_documents_by_tagCInspect

Retrieve all Vysion documents associated with a specific tag (e.g., ransomware, infoleak, exploit). Supports date filtering.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: tag (required), gte, lte, page, +1 more.

get_documents_by_walletCInspect

Search Vysion for documents linked to a cryptocurrency wallet. Specify chain (BTC, ETH) and address. Use for crypto investigation and tracing.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: chain (required), address (required), gte, lte, +2 more.

get_im_channel_by_channel_idCInspect

Get IM channel info by ID.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: platform (required), channel_id (required).

get_im_chat_by_channel_idCInspect

Get chat messages from a specific IM channel by ID.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: platform (required), channelId (required), gte, lte.

get_im_message_by_message_idCInspect

Retrieve a specific IM message by its unique ID.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: platform (required), message_id (required).

get_im_profile_by_user_idBInspect

Get IM user profile by user ID on a specific platform.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: user_id (required), platform (required).

get_im_server_by_server_idCInspect

Get Discord server info by ID.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: platform (required), server_id (required).

get_leak_by_idAInspect

Get full details of a specific leak by its unique ID, including a download URL to the leaked file. Use this after finding a leak ID from search results.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: id (required), search_highlight.

get_onion_feedBInspect

Get the Tor onion site feed from Vysion. Returns recently detected .onion domains. Requires batch as a date (for example, '2026-10-20'). Platforms: all, darknet, telegram, discord.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: batch (required), platform (required), gte, lte, +2 more.

get_phone_infoBInspect

Get information about a phone number using OSINT sources. Returns owner name, carrier, and source attribution if available.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: number (required), country_code (required).

get_ransomware_attacks_histogramBInspect

Get a histogram of ransomware attacks over time from Vysion. Use to visualize attack frequency trends. Supports date range and country filtering.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: gte, lte, countries.

get_ransomware_feedBInspect

Get the ransomware feed from Vysion: a timeline of attacks and victim publications. Use to monitor ransomware activity, track groups, and identify victims. Requires batch parameter (year like '2026' or date like '2026-01-01').

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: gte, lte, page, batch, +1 more.

get_ransomware_groups_histogramBInspect

Get a histogram of ransomware activity grouped by threat actor group over time. Use to track which groups are most active in a period.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: gte, lte, countries.

get_ransomware_misp_feed_manifestCInspect

Get the ransomware MISP feed manifest. Use for MISP threat intelligence platform integration.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: no named parameters.

get_ransomware_misp_reportCInspect

Get a specific ransomware MISP feed report by UUID. Use for MISP threat intelligence integration.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: uuid_json (required).

get_ransomware_stats_by_countryBInspect

Get ransomware attack statistics by country from Vysion. Use to see which countries are most targeted by ransomware.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: gte, lte, countries.

get_ransomware_stats_by_groupBInspect

Get ransomware attack statistics by threat actor group (LockBit, ALPHV, Qilin, etc.) from Vysion. Use to identify the most active ransomware groups.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: gte, lte, countries.

get_ransomware_stats_by_sectorBInspect

Get ransomware attack statistics by industry sector from Vysion. Use to see which industries are most affected by ransomware.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: gte, lte, countries.

get_ransomware_victimBInspect

Get full details of a specific ransomware victim from Vysion by their unique ID.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: id (required).

get_telegram_feedCInspect

Get Vysion's Telegram feed: messages and activity from monitored channels. Requires batch parameter (date like '2026-01-01').

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: gte, lte, page, batch, +1 more.

search_documentsAInspect

Search the Vysion darknet intelligence database for documents across Tor, I2P and clearnet. Covers darknet pages, forums, and marketplaces. Supports filters: date range, network type, language, and tags. Date window: when no start date (gte) is given, only the six months before lte (or before now) are searched. In that case, tell the user in your answer that the results only cover that six-month period, and ask whether they want the full history or a specific date range. When they ask for the full history or a period longer than six months, split it into sequential ranges of no more than six months (gte/lte) and run one search per range.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: q (required), gte, lte, page, +5 more.

search_email_in_im_databaseBInspect

Search IM database for an email address. Find if it appears in Telegram, Discord or other chats.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: email (required), gte, lte, page, +1 more.

search_im_channelsBInspect

Search Vysion's IM database for channels by keyword. Returns matching Telegram or Discord channels. Use to find channels related to a topic.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: q (required), gte, lte, page, +2 more.

search_im_messagesBInspect

Search Vysion's IM database for messages across Telegram, Discord and other platforms. Primary tool for chat investigation. Filter by platform, username, date.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: q (required), gte, lte, page, +3 more.

search_im_profilesCInspect

Search Vysion's IM database for user profiles by keyword. Returns matching Telegram or Discord user profiles.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: q (required), gte, lte, page, +2 more.

search_leaksAInspect

Search Vysion's leaked data database for any keyword, domain, email, username, IP, or credential. Primary tool for leak investigation. Searches across file content, emails, usernames, phone numbers, IP addresses, and wallet addresses. Results include highlighted snippets. IMPORTANT: keep page_size small (5-10) as results can be very large. Returns page_size results at a time. Check total in the response — if total exceeds page_size, call again with page=N to get subsequent pages.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: q (required), gte, lte, page, +1 more.

search_leaks_by_emailBInspect

Search Vysion's leak database for a specific email address. Returns all leaked files where this email was found. Keep page_size small (5-10) as results can be very large.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: email (required), gte, lte, page, +1 more.

search_leaks_by_hashBInspect

Search Vysion's leak database for a file by its hash. Automatically detects hash type: SHA256 (64 chars), SHA1 (40 chars), or MD5 (32 chars).

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: hash (required), gte, lte, page, +1 more.

search_leaks_by_ipBInspect

Search Vysion's leak database for an IP address (IPv4 or IPv6). Returns all leaked files where this IP was found.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: ip_address (required), gte, lte, page, +1 more.

search_leaks_by_phoneCInspect

Search Vysion's leak database for a phone number. Requires country code separately (e.g., '34' for Spain, '1' for US).

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: number (required), country_code (required), gte, lte, +2 more.

search_leaks_by_usernameBInspect

Search Vysion's leak database for a username. Returns all leaked files where this username was found.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: username (required), gte, lte, page, +1 more.

search_leaks_by_walletBInspect

Search Vysion's leak database for a cryptocurrency wallet address. Supported chains: BTC, ETH, XMR, XRP, ZEC, DOT, BNB, DASH.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: chain (required), address (required), gte, lte, +2 more.

search_ransomware_victimsBInspect

Search Vysion's ransomware victim database by organization name, group, country, or industry. Returns records of ransomware attacks. Filter by organization name, ransomware group (LockBit, ALPHV, Qilin, etc.), country, industry, and date range. Use to investigate specific victims or track group activity over time.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: q, gte, lte, page, +4 more.

search_wallet_in_im_databaseCInspect

Search IM database for a cryptocurrency wallet address. Find mentions in Telegram, Discord or other chats.

Responses:

200: Successful Response (Success Response) Content-Type: application/json

Inputs: chain (required), address (required), gte, lte, +2 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Related MCP Servers

    • Steve MCP

      trissino-ai
      A
      license
      Not graded
      quality
      C
      maintenance
      Remote MCP server that lets AI assistants read tracked competitive intelligence — competitor news, reviews, website changes, social posts and ads — and act on it by managing projects, competitors, battle cards, reports and canvases. Every answer carries a source and a date, and write actions only publish when explicitly shared.
      MIT

    • Citesurf MCP

      citesurf
      A
      license
      A
      quality
      D
      maintenance
      Enables brand visibility monitoring across major AI platforms like ChatGPT, Claude, Gemini, and Perplexity. It allows users to track visibility scores, analyze competitor data, and receive actionable insights to improve AI-generated brand recommendations.
      16
      9 npm
      1
      MIT
    • industrylens-mcp

      industrylens-mcpofficial

      IndustryLensOp
      A
      license
      Not graded
      quality
      C
      maintenance
      Browse IndustryLens's published competitive-intelligence reports and head-to-head competitor comparisons from any AI agent — real, source-backed data.
      MIT
    Try in Browser
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    Glama MCP Gateway

    Add one secure layer between your agents and this server.

    Resources