Sherlock MCP Server

An official Model Context Protocol (MCP) server for the Covertlabs infostealer intelligence platform. Built with FastMCP.

What is Sherlock?

Sherlock provides access to Covertlabs' comprehensive database of infostealer logs, enabling security researchers and threat intelligence teams to:

• Search compromised credentials by email, domain, username, or password

• Investigate victims by IP address, country, or stealer family

• Retrieve detailed artifacts including credentials, cookies, and browser history

Related MCP server: Threat Intel MCP Server

Features

• 🔍 12 Search Tools - Comprehensive search capabilities across the infostealer database

• 🔐 Token Authentication - Secure access via Personal Access Tokens

• ⚡ Stateless HTTP - Scalable, load-balancer friendly architecture

• 🐳 Docker Ready - Production-ready containerization

Installation

Prerequisites

• Python 3.11+

• A Covertlabs account with API access

• Your Personal Access Token from app.covertlabs.io/cli/token

Quick Start

# Clone the repository
git clone https://github.com/covertlabs/sherlock-mcp.git
cd sherlock-mcp

# Create virtual environment
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Run the server
python server.py

Docker

docker compose up --build

Configuration

Configure via environment variables:

Client Configuration

Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "sherlock": {
      "url": "http://localhost:8080/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}

Claude Desktop

Add to your Claude Desktop MCP configuration:

{
  "mcpServers": {
    "sherlock": {
      "url": "http://localhost:8080/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN_HERE"
      }
    }
  }
}

Available Tools

See the docs/ folder for detailed documentation on each tool and response formats.

Search Tools

Victim Detail Tools

Authentication

This server uses Personal Access Token (PAT) authentication. Tokens are passed through to the Covertlabs API.

1. Log in to app.covertlabs.io

2. Navigate to CLI Token

3. Copy your token (format: cl_pat_V1_...)

4. Add to your MCP client configuration

API Endpoints

Documentation

• Tools Reference - Detailed tool documentation

• Response Formats - API response schemas

• Examples - Usage examples

Support

• Documentation: docs.covertlabs.io

• Issues: GitHub Issues

• Email: support@covertlabs.io

License

MIT License - see LICENSE for details.