Tor MCP Proxy
Provides a search tool that queries DuckDuckGo through its .onion service, enabling anonymous web searches without leaving the Tor network.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Tor MCP Proxysearch DuckDuckGo's onion site for secure email providers"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
English · Español
Tor MCP Proxy — Navegación web por Tor para agentes IA vía MCP
Dale a tu agente IA acceso a la web sin revelar tu IP. Servidor MCP open source que permite a Claude Code, Claude Desktop, Cursor, OpenCode y cualquier cliente compatible con Model Context Protocol navegar a través de Tor, incluidos los servicios
.onion. Usa un circuito nuevo en cada llamada, no tiene fugas de DNS y reintenta solo cuando un nodo de salida está bloqueado.
Tags: mcp-server · tor · onion · privacy · socks5 · ai-agents · claude-code · cursor · opencode · web-scraping · self-hosted
💡 Por qué existe
Los agentes IA navegan con tu IP. Así, cada sitio que consultan sabe quién eres, y muchos bloquean o limitan las peticiones automatizadas. Tor MCP Proxy resuelve esto con tres ideas simples:
Tu IP nunca sale. Todo el tráfico pasa por Tor, incluida la resolución DNS. No hay ninguna ruta directa de respaldo.
Un circuito nuevo en cada llamada. Cada tool usa una identidad SOCKS distinta, y Tor le asigna su propio nodo de salida, así que las llamadas no se pueden vincular entre sí. Si un nodo está bloqueado, se reintenta con otro.
Acceso a
.onionsin configuración extra. Funciona con servicios ocultos v3, también los que usan certificados autofirmados.
Related MCP server: sicry
⚡ Quickstart (3 comandos)
brew install tor && brew services start tor # o: sudo apt install tor
git clone https://github.com/GermaniU/tor-mcp-proxy.git && cd tor-mcp-proxy && npm ci
claude mcp add tor-proxy --scope user -- node "$PWD/index.js"Requiere Node.js 22.19+ y Tor escuchando en 127.0.0.1:9050. Para otros clientes, consulta docs/CLIENTS.md. Para otros sistemas operativos, consulta docs/INSTALL.md.
🔍 Diagnóstico
Este comando verifica Node.js, que Tor escuche, que el tráfico realmente salga por Tor y que cada llamada use un circuito distinto:
npm run doctor🛠 Tools MCP expuestas
Tool | Red | Para qué |
| Tor | Descarga una página (HTTP(S) o |
| Tor | Muestra la IP que ven los sitios, es decir, la del nodo de salida. |
| Tor | Busca en DuckDuckGo a través de su servicio |
| Tor | Guarda un documento, imagen o archivo comprimido en el directorio de descargas. Nunca sobrescribe archivos. |
| — | Lista los enlaces de un HTML; por defecto, solo los |
| — | Resume un HTML: título, encabezados, enlaces, formularios y metadatos. |
Los parámetros y ejemplos de uso de cada tool están en docs/CLIENTS.md.
🎯 Alcance actual
Tor MCP Proxy es deliberadamente pequeño. Hace una cosa bien: traer contenido web por Tor para un agente. No es un navegador ni un crawler.
Lo que SÍ hace
✅ Envía cada petición por Tor, con la resolución DNS incluida.
✅ Usa un circuito independiente por llamada y reintenta con otro nodo de salida si recibe 403, 429 o 5xx.
✅ Accede a servicios
.onionv3, también con HTTPS autofirmado.✅ Mantiene sesiones con cookies separadas por dominio para logins y formularios.
✅ Descarga archivos dentro de un directorio aislado (sandbox).
✅ Incluye protección SSRF y límites de tamaño en todas las respuestas.
Lo que NO hace (todavía)
❌ No ejecuta JavaScript. Las páginas que se construyen en el navegador devuelven poco texto.
❌ No es Tor Browser. El User-Agent es el de Tor Browser, pero la huella TLS es la de Node.js. Lee
SECURITY.md.❌ No elige país de salida. Tor asigna los nodos de salida al azar.
❌ No es rápido. Cuenta con 2–10 s por petición.
❌ No resuelve CAPTCHAs ni evade bloqueos deliberados.
Si necesitas algo de la lista del NO, abre un issue con un caso de uso real.
🔌 Conectar tu cliente
Tienes la configuración lista para copiar en docs/CLIENTS.md:
🟦 Claude Code:
claude mcp add tor-proxy --scope user -- node /ruta/a/tor-mcp-proxy/index.js🟫 Claude Desktop:
claude_desktop_config.json🟧 Cursor: Settings → MCP Servers
🟪 OpenCode:
opencode.json
Hay snippets listos en examples/.
⚙️ Configuración
Todo es opcional y se configura con variables de entorno. Estas son las más usadas:
Variable | Default | Para qué |
|
| Dirección del proxy de Tor. |
|
| El único directorio donde escribe |
|
| Cuántas veces reintentar con un circuito nuevo. |
| (desactivado) | Log de auditoría en formato JSONL. ⚠️ Registra URLs y búsquedas. |
La lista completa está en docs/INSTALL.md.
🧪 Smoke test contra Tor real
npm run smokeEste comando arranca el servidor por stdio, como lo haría un cliente MCP, y prueba las tools contra la red real:
check_exit_ip;fetch_pagesobre check.torproject.org y sobre el.onionde DuckDuckGo;search_onion.
🧱 Arquitectura (vertical slice)
┌─ tu agente (Claude Code / Cursor / OpenCode / …) ─┐
│ │ MCP stdio │
└───────────┼───────────────────────────────────────┘
▼
┌──────────────────┐ lib/features/<tool>/ ← una carpeta por tool
│ tor-mcp-proxy │ lib/shared/ ← red, HTML, MCP (sin estado global)
│ (Node.js) │ lib/app/ ← config + inyección de dependencias
└────────┬─────────┘
│ SOCKS5 (un circuito por llamada)
▼
┌──────────────────┐ ┌───────────────┐
│ Tor (local) │ ─────▶ │ nodo de salida │ ─────▶ sitio web / .onion
└──────────────────┘ └───────────────┘Cada tool vive en su propia carpeta (lib/features/<tool>/). Para añadir una tool basta crear una carpeta y añadir una línea en lib/features/index.js. Un test de arquitectura impide que las capas se mezclen.
El detalle técnico está en docs/ARCHITECTURE.md.
🔒 Seguridad y privacidad
Sin fugas de DNS. Los hostnames los resuelve Tor, nunca tu resolver local.
Cookies separadas por dominio en las sesiones, con
tough-cookiey la Public Suffix List.Las redirecciones no pueden sacarte de
.onionhacia clearnet.Descargas aisladas en
TOR_DOWNLOAD_DIR: no sobrescriben archivos y rechazan rutas.., archivos ocultos y symlinks.Protección SSRF: rechaza IPs privadas, loopback y de metadata de nubes.
El modelo de amenazas completo, con lo que este proxy no protege, está en SECURITY.md. Si encuentras una vulnerabilidad, repórtala de forma privada desde la pestaña Security del repo.
🤝 Contribuye
Tor MCP Proxy es MIT y sin trampas. PRs, issues y forks son bienvenidos.
Reglas (resumen):
Primero la privacidad. No se acepta ningún cambio que envíe tráfico o DNS fuera de Tor.
Clean Code · SOLID · KISS · YAGNI · Vertical slice · Tests primero. No se aceptan PRs sin tests.
Identificadores en inglés, commits en español. Usa Conventional Commits (
feat:,fix:,docs:, …).Una tool nueva = una carpeta nueva. No toques slices existentes salvo para corregir un bug.
DIP: las features usan
context.weby nunca importanundici. Lo verificatest/architecture.test.js.
El detalle completo está en CONTRIBUTING.md.
# Setup local de desarrollo (no necesita Tor)
npm ci
npm run lint # ESLint
npm run check # sintaxis de todos los archivos
npm test # unit + integración + protocolo MCP, ~2 s, sin red🩹 Troubleshooting
Could not connect to the Tor SOCKS5 proxy
Tor no está corriendo o escucha en otro puerto. Ejecuta
npm run doctor. Tor Browser usa el puerto9150; para usarlo, defineTOR_SOCKS5=socks5://127.0.0.1:9150.
HTTP 403 … (still failing after 4 attempts on independent Tor circuits)
El sitio bloquea a todos los nodos de salida de Tor. No es un bug: muchos sitios lo hacen. Busca el mismo contenido en otra fuente o en su versión
.onion.
Request timed out
La red Tor está lenta o el circuito es malo. Reintenta, o sube
TOR_REQUEST_TIMEOUT_MS(máximo 120000).
La página devuelve muy poco texto
Seguramente se construye con JavaScript en el navegador. Prueba con
raw: truepara ver el HTML real, o busca una versión sin JS del sitio.
download_file dice A file already exists
Es intencional: nunca se sobrescribe un archivo. Usa otro
output_path.
📚 Documentación
docs/INSTALL.md: instalación detallada, todas las variables y troubleshooting extendido.docs/CLIENTS.md: configuración por cliente y referencia de las tools.docs/ARCHITECTURE.md: decisiones técnicas y sus motivos.SECURITY.md: modelo de amenazas y cómo reportar vulnerabilidades.CONTRIBUTING.md: disciplinas, flujo de trabajo y cómo añadir una tool.CHANGELOG.md: historial de cambios.
📄 Licencia
MIT. Basado en DataImpulse-MCP (MIT) de Gentleman Programming.
Hecho por @GermaniU. Si te ha servido, una ⭐ ayuda a que más gente lo encuentre. Si algo se rompe, abre un issue y lo arreglamos.
Available Tools
6 toolscheck_exit_ipCheck Exit IPA
Return the public IP address that destinations see (the Tor exit node of a fresh circuit).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It usefully discloses that the result reflects a fresh circuit (so the IP may differ per call), which is real behavioral context beyond the name. However, it omits whether this makes a network request, its latency, or whether repeated calls rotate the exit node.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler. The core answer (the public IP destinations see) comes first and the qualifier is parenthetical.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters and no output schema, the description supplies what is needed: it names the returned value and its source. Slightly more on return type/format or circuit freshness semantics would make it fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which is the baseline-4 case; there is nothing for the description to disambiguate. The description correctly signals a no-input utility rather than leaving the empty schema unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb ('Return') plus precise resource ('the public IP address that destinations see'), with the parenthetical clarifying it is the Tor exit node. No sibling (fetch_page, search_onion, download_file, extract_links, page_metadata) performs this function, so the agent can distinguish it immediately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance and no named alternatives, but the purpose is self-evident enough that usage is strongly implied. A brief note such as 'call this to verify your apparent IP before fetching a page' would raise it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
download_fileDownload FileA
Download a document, image, archive or data file through Tor into the server's download directory (TOR_DOWNLOAD_DIR). output_path is relative to that directory; existing files are never overwritten.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | HTTP(S) or .onion URL of the file | |
| output_path | Yes | Relative path inside the download directory, e.g. reports/file.pdf |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose real behavior: transfers route through Tor, writes land in TOR_DOWNLOAD_DIR, and existing files are never overwritten (an important, non-obvious safety trait). It omits auth needs, size/time limits, timeout behavior, and failure modes, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with zero waste: destination and mechanism first, then the output_path semantics and overwrite policy. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers both parameters, the destination, transport, and overwrite policy, which is solid for a 2-param tool. However, with no output schema and no annotations, the description should say what the call returns (e.g. the saved path) and any practical limits, which it does not.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented, including that output_path is relative. The description largely restates that (relative to TOR_DOWNLOAD_DIR) and adds only the no-overwrite behavior; baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb (download), the resource types (document, image, archive, data file), the transport (through Tor), and the destination (TOR_DOWNLOAD_DIR). An agent can distinguish this from fetch_page, which retrieves page content rather than persisting a file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the mention of 'download directory' and 'through Tor' signals this is the file-persisting option versus fetch_page, but no explicit when-to-use, prerequisites, or alternative is named. Adequate but with a clear gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
extract_linksExtract LinksA
Extract links from HTML (no network access). By default only .onion links are returned; set filter_onion: false for all links. Pass base_url to resolve relative links. Results are deduplicated and grouped by host.
| Name | Required | Description | Default |
|---|---|---|---|
| html | Yes | HTML to scan | |
| base_url | No | Page URL, used to resolve relative links | |
| filter_onion | No | Only return .onion links (default true) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the no-network guarantee, the default .onion-only filtering, and the post-processing behavior ('deduplicated and grouped by host'). It stops short of error/edge-case behavior (malformed HTML, the 500k length cap), so not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with purpose and the most consequential constraint (no network access), then parameter guidance, then output shape. No filler and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-param, no-output-schema tool this is nearly complete: it covers the safety/scope trait, defaults, and result structure. Only minor edge-case behavior (input size limits, malformed input handling) is left unaddressed, which the schema partially covers via maxLength.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already documents all three parameters, including the filter_onion default and base_url's role. The description's restatement adds no syntax or format detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Extract links from HTML') and immediately scopes it with '(no network access)', which cleanly separates it from fetch_page/download_file in the sibling set. An agent can tell at a glance that this is pure parsing, not retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains how to steer behavior ('set filter_onion: false for all links', 'Pass base_url to resolve relative links'), which is useful operational guidance. However, it never says when to choose this tool over siblings such as page_metadata or fetch_page, nor any precondition beyond the implied need for HTML in hand.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_pageFetch PageA
Fetch an HTTP(S) or .onion page through Tor and return its text (or raw HTML). Supports GET/POST/PUT/PATCH and sticky sessions (same circuit + cookies) via session_id.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | Return raw HTML instead of extracted text (default false) | |
| url | Yes | HTTP(S) or .onion URL to fetch | |
| body | No | Request body; required for POST/PUT/PATCH | |
| method | No | HTTP method (default GET) | |
| session_id | No | Reuse the same Tor circuit and cookies across calls | |
| content_type | No | Body content type; required for POST/PUT/PATCH |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses Tor routing, text-vs-raw output, supported methods, and that session_id gives sticky circuits and cookies, but it omits rate limits, timeouts, error behavior, and whether requests are logged or authenticated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences that front-load the core action and return value, then append the method and session capabilities. No filler and no repetition of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, but the description does explain the return value (text or raw HTML), which is the key thing an agent needs. For a 6-param fetch tool the coverage is solid, though error/timeout behavior would round it out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter, making 3 the baseline. The description restates the method enum and raw/session behavior but adds little syntax or format meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource (fetch an HTTP(S)/.onion page through Tor) plus the return format (text or raw HTML). It implicitly separates itself from download_file and page_metadata by emphasizing page text retrieval, but it does not name or contrast any sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the capability statement; there is no explicit 'use this when...' guidance nor any mention of when to prefer extract_links, page_metadata, or download_file instead. An agent can infer the general context but must reason about the boundaries itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_metadataPage MetadataA
Summarise HTML (no network access): title, description, headings (H1/H2/H3), link counts (internal/external/.onion), forms and meta tags.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Page URL, used to classify links as internal/external | |
| html | Yes | HTML to analyse |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose a key behavioral trait: the tool performs no network access, making it a pure parse of supplied input. It also enumerates the extracted categories, effectively describing the return surface. It stops short of stating determinism, malformed-HTML handling, or size limits (the 500000 cap lives only in the schema).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that packs the operation, the constraint, and the output inventory with zero filler. Every clause earns its place and the most decision-relevant fact ('no network access') appears early.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a pure HTML-parsing utility with no output schema, the description covers the essentials: what it consumes, that it needs no network, and what it returns. The only gap is that the return values are named but not shaped, which is a minor omission for a summariser whose output is self-describing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented, including the url field's role in internal/external link classification. The description adds no syntax, format, or edge-case meaning beyond that. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Summarise') and resource ('HTML'), then enumerates exactly what is extracted (title, description, H1/H2/H3, link counts, forms, meta tags). The parenthetical 'no network access' cleanly distinguishes it from fetch_page, so an agent can route between them without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'No network access' implies the caller must already hold the HTML (i.e., fetch it via fetch_page first), but this is left to inference rather than stated. No sibling is named and no when-not-to-use condition is given. Adequate implied usage, but not explicit routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_onionSearch via DuckDuckGo onionA
Search the web through DuckDuckGo's .onion service, entirely inside Tor. Returns titles, URLs and snippets; results may include both clearnet and .onion sites.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results (default 20) | |
| query | Yes | Search query |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does usefully disclose that traffic stays entirely inside Tor and that results mix clearnet and .onion sites, plus the return shape (titles, URLs, snippets). It says nothing about rate limits, DuckDuckGo throttling/blocking, failure modes when Tor is down, or whether the call is a safe read-only operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, zero filler, and the mechanism/scope (Tor-only, .onion endpoint) is front-loaded before the return-value detail. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with full schema coverage and no output schema, the description covers the essentials: mechanism, routing, and return fields. It is only slightly short of complete because it omits operational caveats (Tor availability, rate limiting) that an agent might need to handle failures.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (query, limit) are documented in the schema with defaults and bounds. The description adds no further semantics about query syntax or limit behavior, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (search) and resource (the web, via DuckDuckGo's .onion service), so an agent immediately knows this is a search tool rather than a page-fetching tool. It does not explicitly contrast itself with siblings like fetch_page or extract_links, but the 'search' framing is unambiguous enough to separate it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the agent can infer you call this to discover URLs and then use fetch_page/extract_links on the results. There is no explicit when-to-use statement, no mention of prerequisites (e.g., that a working Tor circuit is required, which check_exit_ip hints at), and no guidance on when another sibling is preferable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.3.0- First observed
check_exit_ip - First observed
download_file - First observed
extract_links - First observed
fetch_page - First observed
page_metadata - First observed
search_onion
TDQS
Scored across 6 tools
Most tools target distinct actions: fetching pages, checking exit IP, searching onions, downloading files, extracting links, and summarizing metadata. The main overlap is between fetch_page and download_file, since both retrieve remote content, though download_file has a clear local-save distinction. Offline analysis tools extract_links and page_metadata are also related but produce different outputs.
Five of six tool names follow a clear verb_noun snake_case pattern: fetch_page, check_exit_ip, search_onion, download_file, extract_links. page_metadata deviates by using a noun phrase rather than a verb, but the overall convention remains readable and mostly consistent.
Six tools is well-scoped for a Tor proxy server, covering fetching, searching, downloading, link extraction, metadata extraction, and exit IP checking. Each tool has a clear place and there is no obvious redundancy or bloat.
The surface covers the core Tor browsing lifecycle: fetch pages, search onion services, download files, parse HTML offline, and verify exit IP. Minor gaps exist, such as no explicit session/cookie clearing or circuit rotation tool, but agents can largely work around these using existing capabilities.
Maintenance
Related MCP Connectors
Tor gateway for AI agents: fetch URLs and rotate circuits through Tor, Bitcoin-settled.
Stealth web browser for agents: search, fetch, click, download and type in persistent MCP sessions.
Scrape, crawl and search the web for AI agents via MCP.
Route HTTP requests through the Tor network. Rotating exit IPs, .onion support, no body logging.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables secure access to Tor/onion services with content filtering and safety guardrails for AI assistants.8MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to access Tor hidden services and the dark web through tools for search, fetch, and analysis over Tor.19MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to control Tor Browser with full anonymity preservation, including navigation, Tor circuit management, and traffic interception.MIT
- AlicenseNot gradedqualityCmaintenanceRoutes HTTP requests through the Tor network, enabling anonymous web fetching, exit IP checks, circuit renewal, and site reachability checks from MCP-compatible agents like Claude Desktop and Cursor.1MIT