Which integrations are available for this server?

Provides access to abuse.ch's threat intelligence platforms (ThreatFox, URLhaus, MalwareBazaar) for searching malicious IOCs, URLs, and malware samples. Enables tracing Bitcoin transactions and querying blockchain data for cryptocurrency intelligence. Allows checking email addresses and domains against known data breaches and paste dumps through Have I Been Pwned. Integrates with the Tor network to fetch and search .onion hidden services via a SOCKS5 proxy for dark web intelligence.

How do I use darknet-mcp-server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@darknet-mcp-server Is my email in any known breaches?" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

darknet-mcp-server

by utrawal9185-cmd

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

The Problem

Dark web intelligence is the missing layer in every security investigation. Breach databases, ransomware trackers, Tor hidden services, malware sandboxes, stealer logs, blockchain forensics, exploit databases — the data you need is scattered across dozens of platforms, each with its own API, its own auth, its own rate limits, its own output format. Today you check HIBP in one tab, ThreatFox in another, browse ransomware leak sites through Tor, pull up MalwareBazaar for a hash, check blockchain transactions on a block explorer, and then spend an hour manually piecing it all together.

Traditional dark web intel workflow:
  check breach exposure           ->  HIBP web interface (paid API)
  search leaked credentials       ->  IntelligenceX web interface
  track ransomware groups         ->  ransomware.live + ransomlook.io (2 separate UIs)
  access .onion hidden services   ->  Tor Browser manually
  analyze malware samples         ->  Hybrid Analysis + MalwareBazaar (2 more UIs)
  check IP abuse history          ->  AbuseIPDB + GreyNoise (2 more UIs)
  trace cryptocurrency            ->  blockchain.info + ChainAbuse
  search for exploits             ->  Vulners web interface
  check phishing URLs             ->  PhishTank web interface
  correlate everything            ->  copy-paste into a report
  ────────────────────────────────
  Total: 60+ minutes per investigation, most of it switching contexts

darknet-mcp-server gives your AI agent 66 tools across 16 data sources via the Model Context Protocol. The agent queries all sources in parallel, correlates data across the surface and dark web, identifies threats, and presents a unified intelligence picture — in a single conversation.

With darknet-mcp-server:
  You: "Investigate the breach exposure and threat landscape for target.com"

  Agent: -> HIBP: 3 known breaches (Adobe 2013, LinkedIn 2021, Collection #1)
         -> ThreatFox: 2 IOCs associated with domain (C2 callback, phishing)
         -> URLhaus: 1 malicious URL hosted on subdomain
         -> Ransomware: No victim listings found (good)
         -> Stealer logs: 47 compromised employee credentials found
         -> OTX: 5 threat pulses referencing the domain
         -> AbuseIPDB: Primary IP has 12 abuse reports (brute force)
         -> "target.com has been in 3 data breaches exposing 2.1M records.
            47 employee credentials found in stealer logs — immediate
            password reset recommended. 2 active ThreatFox IOCs suggest
            ongoing targeting. No ransomware listings, but the abuse
            reports on the primary IP warrant investigation."

Related MCP server: wrg-mcp-server

How It's Different

Existing tools give you raw data one source at a time. darknet-mcp-server gives your AI agent the ability to reason across surface web and dark web intelligence simultaneously.

Quick Start

Option 1: npx (no install)

npx darknet-mcp-server

Free tools work immediately. No API keys required for ransomware tracking, breach listings, GreyNoise, blockchain, OTX, and more.

Option 2: Clone

git clone https://github.com/badchars/darknet-mcp-server.git
cd darknet-mcp-server
bun install

Environment variables (optional)

# Breach & credential intelligence
export HIBP_API_KEY=your-key           # Enables breach account search & paste search
export INTELX_API_KEY=your-key         # Enables 4 IntelligenceX tools

# Threat intelligence
export OTX_API_KEY=your-key            # Increases AlienVault OTX rate limits
export ABUSEIPDB_API_KEY=your-key      # Enables 4 AbuseIPDB tools
export ABUSECH_AUTH_KEY=your-key       # Higher rate limits for abuse.ch suite
export PULSEDIVE_API_KEY=your-key      # Higher rate limits for Pulsedive

# Stealer logs & credentials
export HUDSONROCK_API_KEY=your-key     # Enables 3 Hudson Rock stealer log tools

# Exploit & malware analysis
export VULNERS_API_KEY=your-key        # Enables Vulners search & exploit tools
export HYBRID_API_KEY=your-key         # Enables 3 Hybrid Analysis malware tools

# Phishing
export PHISHTANK_API_KEY=your-key      # Higher rate limits for PhishTank

# Tor SOCKS5 proxy (for .onion access)
export TOR_SOCKS_HOST=127.0.0.1       # Default: 127.0.0.1
export TOR_SOCKS_PORT=9050            # Default: 9050

All API keys are optional. Without them, you still get ransomware tracking, breach listings, GreyNoise, blockchain intelligence, OTX, Tor exit node checks, onion search, CIRCL onion lookup, and more.

Connect to your AI agent

# With npx
claude mcp add darknet-mcp-server -- npx darknet-mcp-server

# With local clone
claude mcp add darknet-mcp-server -- bun run /path/to/darknet-mcp-server/src/index.ts

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "darknet": {
      "command": "npx",
      "args": ["-y", "darknet-mcp-server"],
      "env": {
        "HIBP_API_KEY": "optional",
        "INTELX_API_KEY": "optional",
        "ABUSEIPDB_API_KEY": "optional",
        "HUDSONROCK_API_KEY": "optional",
        "HYBRID_API_KEY": "optional",
        "VULNERS_API_KEY": "optional"
      }
    }
  }
}

Same JSON config format. Point the command to npx darknet-mcp-server or your local installation path.

Tor setup (optional, for .onion access)

The 7 Tor tools (tor_fetch_onion, tor_scrape_onion, etc.) require a running Tor SOCKS5 proxy.

# macOS
brew install tor && brew services start tor

# Linux
sudo apt install tor && sudo systemctl start tor

# Docker
docker run -d -p 9050:9050 dperson/torproxy

# Verify connectivity
npx darknet-mcp-server --check-tor

Start querying

You: "Check if example.com has been in any data breaches and look for stealer logs"

That's it. The agent handles breach lookups, credential searches, threat correlation, and more automatically.

What The AI Can Do

Breach Investigation

You: "Check if example.com has been in any data breaches"

Agent: -> breachList {domain: "example.com"}
       -> breachSearch {account: "admin@example.com"}
       -> stealer_domain {domain: "example.com"}
       -> intelx_search {term: "example.com"}
       -> "example.com appears in 5 known breaches:
          - ExampleDB 2023: 4.2M records (emails, passwords, IPs)
          - Collection #1: credential stuffing list
          - Combolist 2024: 890K email:password pairs
          Stealer logs: 23 compromised machines with saved credentials
          for example.com found in Hudson Rock database.
          IntelligenceX: 47 results across paste sites and dark web."

Ransomware Tracking

You: "What ransomware groups are targeting healthcare?"

Agent: -> ransomwareBySector {sector: "healthcare"}
       -> ransomwareRecent {}
       -> ransomlookRecent {}
       -> "Healthcare sector ransomware activity:
          142 victims across 12 groups in the last 12 months.
          Top groups: LockBit3 (38 victims), BlackCat/ALPHV (24),
          Cl0p (19), Royal (15).
          Most recent: MedCorp Inc. listed by LockBit3 (2 days ago).
          3 new healthcare victims in the last week across
          ransomware.live and RansomLook feeds."

Dark Web Recon

You: "Search for mentions of our company on .onion sites"

Agent: -> tor_search_onion {query: "AcmeCorp"}
       -> intelx_search {term: "acmecorp.com"}
       -> onion_lookup {address: "relevant-onion-address.onion"}
       -> "Dark web search results for AcmeCorp:
          Ahmia.fi: 3 .onion pages mention AcmeCorp
          - Forum post discussing AcmeCorp employee list (leak forum)
          - Marketplace listing for AcmeCorp database (unverified)
          - Blog post referencing AcmeCorp breach
          IntelligenceX: 12 results on paste sites
          Recommendation: investigate the forum post and marketplace
          listing for potential active data sales."

Malware Analysis

You: "Analyze this file hash for malware indicators: abc123def456..."

Agent: -> malware_search {hash: "abc123def456..."}
       -> malware_overview {sha256: "abc123def456..."}
       -> bazaarHash {hash: "abc123def456..."}
       -> threatfoxSearch {searchTerm: "abc123def456..."}
       -> otx_hash {hash: "abc123def456..."}
       -> "Malware analysis for abc123def456:
          Hybrid Analysis: MALICIOUS (threat score 95/100)
          - Family: AgentTesla (info stealer)
          - MITRE ATT&CK: T1555 (Credential Access), T1071 (C2)
          - Network IOCs: 3 C2 domains, 2 IPs
          MalwareBazaar: First seen 2024-03-15, tagged 'AgentTesla'
          ThreatFox: 2 IOC entries linking to same campaign
          OTX: Referenced in 4 threat pulses"

Tools Reference (66 tools)

Tool	Description
`tor_status`	Check if the local Tor SOCKS5 proxy daemon is running and accessible
`tor_fetch_onion`	Fetch raw HTML from a .onion URL via Tor SOCKS5 proxy (DNS leak prevention via socks5h)
`tor_scrape_onion`	Fetch and parse a .onion site — returns structured data: title, links, body text
`tor_search_onion`	Search for .onion sites using Ahmia.fi search engine
`tor_exit_nodes`	Get current Tor exit node IP addresses from the official Tor Project bulk exit list
`tor_exit_check`	Check if a specific IP address is a known Tor exit node
`tor_exit_details`	Get detailed Tor exit node information including fingerprints and publish timestamps

Tool	Description
`ransomwareRecent`	Fetch the most recent ransomware victims from ransomware.live
`ransomwareGroups`	List all known ransomware groups tracked by ransomware.live
`ransomwareGroup`	Get a detailed profile for a specific ransomware group by name
`ransomwareGroupVictims`	Get all victims claimed by a specific ransomware group
`ransomwareSearch`	Search ransomware victims by keyword (company name, domain, etc.)
`ransomwareByCountry`	Get ransomware victims filtered by ISO 3166-1 alpha-2 country code
`ransomwareBySector`	Get ransomware victims filtered by sector/industry (healthcare, finance, etc.)
`ransomlookGroups`	List all 582+ ransomware groups tracked by RansomLook
`ransomlookRecent`	Fetch the most recent ransomware posts and victim claims from RansomLook

Tool	Description
`breachList`	List all known data breaches from HaveIBeenPwned, optionally filter by domain — free
`breachGet`	Get details of a specific data breach by name — free
`breachLatest`	Get the most recently added data breach — free
`breachDataClasses`	List all data classes (types of compromised data) known to HIBP — free
`breachPassword`	Check if a password has appeared in known breaches (k-anonymity, only 5-char SHA-1 prefix sent) — free
`breachSearch`	Search all breaches for a specific account (email/username) — requires `HIBP_API_KEY`
`breachPastes`	Search for an email address in publicly posted pastes — requires `HIBP_API_KEY`

Tool	Description
`threatfoxGetIocs`	Get recent IOCs from ThreatFox reported in the last N days
`threatfoxSearch`	Search ThreatFox IOCs by IP, domain, hash, or URL
`threatfoxTag`	Search ThreatFox IOCs by tag (e.g., Cobalt Strike, Emotet)
`threatfoxMalware`	Search ThreatFox IOCs by malware family using Malpedia naming
`urlhausLookup`	Look up a URL or host in URLhaus for malware distribution
`urlhausTag`	Search URLhaus entries by tag
`bazaarHash`	Look up a malware sample in MalwareBazaar by MD5, SHA1, or SHA256 hash
`bazaarRecent`	Get the most recently submitted malware samples from MalwareBazaar
`bazaarTag`	Search MalwareBazaar by tag or YARA signature name

Tool	Description
`otx_ip`	Look up threat intelligence for an IP address — pulse info, reputation, country, ASN
`otx_domain`	Look up threat intelligence for a domain — pulse info, whois, reputation
`otx_hash`	Look up threat intelligence for a file hash (MD5, SHA1, SHA256)
`otx_cve`	Look up threat intelligence for a CVE — related pulses and indicators
`otx_search_pulses`	Search OTX threat pulses by keyword

Tool	Description
`abuseipdb_check`	Check an IP address for abuse reports — confidence score, ISP, country, report count
`abuseipdb_reports`	Get individual abuse reports for an IP with detailed comments and categories
`abuseipdb_blacklist`	Get AbuseIPDB's blacklist of the most reported malicious IP addresses
`abuseipdb_check_block`	Check an entire CIDR network block for abuse reports

Tool	Description
`greynoise_ip`	Look up an IP on GreyNoise — classification (benign/malicious/unknown), scanner status
`greynoise_check`	Quick check: is this IP a known scanner or known benign service?

Tool	Description
`pulsedive_indicator`	Look up an indicator (IP, domain, URL, or hash) — risk level, threats, feeds
`pulsedive_search`	Search Pulsedive indicators by value
`pulsedive_explore`	Explore linked indicators using advanced queries (related IOCs with risk levels)

Tool	Description
`stealer_domain`	Search stealer log entries by domain — compromised machines, credentials, malware details
`stealer_email`	Search stealer logs by email address — compromised machines with that email in browser credentials
`stealer_ip`	Search stealer logs by IP address — compromised machines originating from that IP

Tool	Description
`vulners_search`	Search the Vulners vulnerability database using Lucene queries
`vulners_id`	Look up a specific vulnerability or exploit by ID (CVE, EDB, GHSA) — free
`vulners_exploit`	Search specifically for exploits (ExploitDB entries)

Tool	Description
`btc_address`	Look up a Bitcoin address — balance, transaction count, recent transactions
`btc_balance`	Get Bitcoin address balance in satoshi (quick check without full history)
`btc_tx`	Get detailed Bitcoin transaction information by hash — inputs, outputs, fees, block info
`btc_abuse_check`	Check a Bitcoin address for abuse reports on ChainAbuse — scam reports with categories

Tool	Description
`malware_search`	Search Hybrid Analysis sandbox by file hash — verdict, AV detection rate, analysis details
`malware_overview`	Full malware analysis overview — MITRE ATT&CK techniques, network indicators, processes
`malware_feed`	Get the latest malware detonation feed — recently analyzed samples with verdicts

Tool	Description
`onion_lookup`	Look up metadata for a .onion address via CIRCL AIL project — first/last seen, status, tags, certs, ports, BTC addresses

Tool	Description
`intelx_search`	Initiate a search on IntelligenceX for leaked data, dark web content, and more
`intelx_search_results`	Retrieve results for an IntelligenceX search by ID
`intelx_phonebook`	Phonebook search — find emails, domains, URLs associated with a term
`intelx_phonebook_results`	Retrieve phonebook search results by ID

Tool	Description
`phishing_check`	Check if a URL is a known phishing site via PhishTank

Tool	Description
`darknet_list_sources`	List all available data sources with configuration status, API key status, and tool counts

CLI Usage

# List all available tools
npx darknet-mcp-server --list

# Check Tor SOCKS5 proxy connectivity
npx darknet-mcp-server --check-tor

# Run any tool directly
npx darknet-mcp-server --tool breachList '{"domain":"adobe.com"}'
npx darknet-mcp-server --tool ransomwareRecent '{}'
npx darknet-mcp-server --tool tor_search_onion '{"query":"marketplace"}'
npx darknet-mcp-server --tool btc_address '{"address":"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa"}'

# Tools requiring API keys
HIBP_API_KEY=your-key npx darknet-mcp-server --tool breachSearch '{"account":"user@example.com"}'
HYBRID_API_KEY=your-key npx darknet-mcp-server --tool malware_search '{"hash":"abc123..."}'

Data Sources (16)

Source	Auth	Rate Limit	What it provides
Have I Been Pwned	`HIBP_API_KEY`	1 req/1.5s	Breach search, paste search, password check, breach listings
IntelligenceX	`INTELX_API_KEY`	1 req/s	Dark web content, leaked data search, phonebook (emails/domains/URLs)
AlienVault OTX	Optional	1 req/s	Threat intel for IPs, domains, hashes, CVEs; threat pulse search
AbuseIPDB	`ABUSEIPDB_API_KEY`	1 req/s	IP abuse reports, confidence scoring, blacklist, CIDR block check
abuse.ch (ThreatFox)	Optional	2 req/s	IOC search, malware family tracking, tag-based search
abuse.ch (URLhaus)	Optional	2 req/s	Malware distribution URL tracking, host/URL lookup
abuse.ch (MalwareBazaar)	Optional	2 req/s	Malware sample repository, hash lookup, YARA signature search
GreyNoise	None	1 req/s	IP classification (benign/malicious), internet scanner detection
Pulsedive	Optional	1 req/s	Indicator enrichment, risk scoring, linked IOC exploration
Hudson Rock Cavalier	`HUDSONROCK_API_KEY`	1 req/s	Stealer log search by domain, email, or IP
Vulners	Optional	1 req/s	Vulnerability/exploit database, CVE lookup, ExploitDB search
Blockchain.info	None	1 req/s	Bitcoin address lookup, balance, transaction details
ChainAbuse	None	1 req/s	Bitcoin address abuse/scam reports
Hybrid Analysis	`HYBRID_API_KEY`	1 req/s	Malware sandbox detonation, MITRE ATT&CK mapping, sample feed
CIRCL AIL (Onion Lookup)	None	0.5 req/s	.onion address metadata, first/last seen, associated BTC addresses
Tor Network	None	N/A	Exit node list, .onion fetching/scraping, Ahmia.fi search

Architecture

src/
  index.ts                # CLI entrypoint (--help, --list, --check-tor, stdio server)
  protocol/
    mcp-server.ts         # MCP server setup (stdio transport)
    tools.ts              # Tool registry — all 66 tools assembled here
  types/
    index.ts              # Shared types (ToolDef, ToolContext, ToolResult)
  utils/
    rate-limiter.ts       # Per-provider rate limiter
    cache.ts              # TTL cache for API responses
    tor-fetch.ts          # Tor SOCKS5 proxy HTTP client
    require-key.ts        # API key validation helper
  tor/                    # Tor Network tools (7)
  ransomware/             # Ransomware Intelligence tools (9)
  breach/                 # HIBP Breach tools (7)
  abusech/                # ThreatFox + URLhaus + MalwareBazaar tools (9)
  otx/                    # AlienVault OTX tools (5)
  abuseipdb/              # AbuseIPDB tools (4)
  greynoise/              # GreyNoise Community tools (2)
  pulsedive/              # Pulsedive tools (3)
  hudsonrock/             # Hudson Rock stealer log tools (3)
  vulners/                # Vulners exploit tools (3)
  blockchain/             # Blockchain Intelligence tools (4)
  hybrid/                 # Hybrid Analysis malware tools (3)
  onionlookup/            # CIRCL Onion Lookup tool (1)
  intelx/                 # IntelligenceX tools (4)
  phishing/               # PhishTank tool (1)
  meta/                   # Meta tools (1)

Design decisions:

16 providers, 1 server — Every data source is an independent module. The agent picks which tools to use based on the query.
Per-provider rate limiters — Each data source has its own RateLimiter instance calibrated to that API's limits. No shared bottleneck.
TTL caching — Ransomware data (15min), breach lists (10min), abuse.ch (5min) results are cached to avoid redundant API calls during multi-tool workflows.
Graceful degradation — Missing API keys don't crash the server. Tools return descriptive error messages: "Set HIBP_API_KEY to enable breach account search."
DNS leak prevention — Tor .onion tools use socks5h:// protocol to resolve DNS through Tor, preventing DNS leaks to the local resolver.
4 dependencies — @modelcontextprotocol/sdk, zod, socks-proxy-agent, and cheerio. All clearnet HTTP via native fetch. All Tor traffic via SOCKS5.

Limitations

HIBP account/paste search requires a paid API key ($3.50/month)
IntelligenceX, AbuseIPDB, Hudson Rock, and Hybrid Analysis require API keys for their tools
Tor .onion tools require a running Tor SOCKS5 proxy (not bundled)
abuse.ch free tier has lower rate limits without ABUSECH_AUTH_KEY
Ransomware.live and RansomLook data depends on upstream scraping frequency
Blockchain tools support Bitcoin only (no Ethereum/Monero)
PhishTank database can lag behind real-time phishing campaigns
macOS / Linux tested (Windows not tested)

Part of the MCP Security Suite

Project	Domain	Tools
hackbrowser-mcp	Browser-based security testing	39 tools, Firefox, injection testing
cloud-audit-mcp	Cloud security (AWS/Azure/GCP)	38 tools, 60+ checks
github-security-mcp	GitHub security posture	39 tools, 45 checks
cve-mcp	Vulnerability intelligence	23 tools, 5 sources
osint-mcp-server	OSINT & reconnaissance	37 tools, 12 sources
darknet-mcp-server	Dark web & threat intelligence	66 tools, 16 sources

Available Tools

66 tools

abuseipdb_blacklistB

Get AbuseIPDB's blacklist of the most reported malicious IP addresses. Requires ABUSEIPDB_API_KEY.

Inputs: limit, confidence.

abuseipdb_checkA

Check an IP address against AbuseIPDB for abuse reports. Returns confidence score, ISP, country, and report count. Requires ABUSEIPDB_API_KEY.

Inputs: ip (required), max_age, verbose.

abuseipdb_check_blockB

Check an entire CIDR network block for abuse reports on AbuseIPDB. Requires ABUSEIPDB_API_KEY.

Inputs: network (required), max_age.

abuseipdb_reportsA

Get individual abuse reports for an IP from AbuseIPDB. Returns detailed report comments and categories. Requires ABUSEIPDB_API_KEY.

Inputs: ip (required), limit, max_age.

bazaarHashA

Look up a malware sample in MalwareBazaar (abuse.ch) by hash. Accepts MD5, SHA1, or SHA256.

Inputs: hash (required).

bazaarRecentA

Get recent malware samples from MalwareBazaar (abuse.ch). Returns the most recently submitted samples.

Inputs: selector.

bazaarTagA

Search MalwareBazaar (abuse.ch) by tag or YARA signature name. Use 'tag' for tag-based search or 'signature' for signature-based search.

Inputs: tag, signature.

breachDataClassesA

List all data classes (types of compromised data) known to HaveIBeenPwned. Free endpoint, no API key required.

Inputs: no named parameters.

breachGetA

Get details of a specific data breach by name from HaveIBeenPwned. Free endpoint, no API key required.

Inputs: name (required).

breachLatestA

Get the most recently added data breach from HaveIBeenPwned. Free endpoint, no API key required.

Inputs: no named parameters.

breachListA

List all known data breaches from HaveIBeenPwned. Optionally filter by domain. Free endpoint, no API key required.

Inputs: domain.

breachPasswordA

Check if a password has appeared in known data breaches using the Pwned Passwords k-anonymity API. Only the first 5 characters of the SHA-1 hash are sent to the server. Free, no API key required.

Inputs: password (required).

breachPastesA

Search for an email address in publicly posted pastes (Pastebin, etc.) via HaveIBeenPwned. Requires HIBP_API_KEY (paid endpoint).

Inputs: email (required).

breachSearchA

Search all data breaches for a specific account (email or username) via HaveIBeenPwned. Requires HIBP_API_KEY (paid endpoint).

Inputs: account (required), truncateResponse, includeUnverified.

btc_abuse_checkA

Check a Bitcoin address for abuse reports on ChainAbuse. Returns scam reports with categories and descriptions.

Inputs: address (required).

btc_addressB

Look up a Bitcoin address on blockchain.info. Returns balance, transaction count, and recent transactions.

Inputs: address (required).

btc_balanceA

Get Bitcoin address balance in satoshi from blockchain.info. Quick balance check without full transaction history.

Inputs: address (required).

btc_txA

Get detailed Bitcoin transaction information by hash. Returns inputs, outputs, fees, and block info.

Inputs: txhash (required).

darknet_list_sourcesA

List all available darknet-mcp data sources with their configuration status, required API keys, and available tools.

Inputs: no named parameters.

greynoise_checkA

Quick GreyNoise check: is this IP a known scanner or known benign service? Returns simplified classification.

Inputs: ip (required).

greynoise_ipA

Look up an IP address on GreyNoise Community API. Returns classification (benign/malicious/unknown), scanner status, and last seen timestamp. Free, no API key required.

Inputs: ip (required).

intelx_phonebookA

Initiate a phonebook search on IntelligenceX — finds emails, domains, URLs associated with a term. Returns search ID. Requires INTELX_API_KEY.

Inputs: term (required), target, max_results.

intelx_phonebook_resultsA

Retrieve phonebook search results from IntelligenceX by ID. Use after intelx_phonebook. Requires INTELX_API_KEY.

Inputs: id (required), limit, offset.

intelx_searchA

Initiate a search on IntelligenceX for leaked data, dark web content, and more. Returns a search ID to retrieve results. Requires INTELX_API_KEY.

Inputs: term (required), max_results.

intelx_search_resultsA

Retrieve results for an IntelligenceX search by ID. Use after intelx_search to get actual data. Requires INTELX_API_KEY.

Inputs: id (required), limit, offset.

malware_feedA

Get the latest malware detonation feed from Hybrid Analysis. Returns recently analyzed samples with verdicts. Requires HYBRID_API_KEY.

Inputs: no named parameters.

malware_overviewA

Get full malware analysis overview from Hybrid Analysis for a SHA256 hash. Returns MITRE ATT&CK techniques, network indicators, processes, and extracted files. Requires HYBRID_API_KEY.

Inputs: sha256 (required).

malware_searchA

Search Hybrid Analysis sandbox by file hash (MD5, SHA1, SHA256). Returns verdict, AV detection rate, and analysis details. Requires HYBRID_API_KEY.

Inputs: hash (required).

onion_lookupA

Look up metadata for a .onion address via CIRCL AIL project. Returns first/last seen dates, status, tags, certificates, ports, and associated Bitcoin addresses.

Inputs: address (required).

otx_cveA

Look up threat intelligence for a CVE via AlienVault OTX. Returns related pulses and indicators.

Inputs: cve (required).

otx_domainA

Look up threat intelligence for a domain via AlienVault OTX. Returns pulse info, whois, reputation.

Inputs: domain (required).

otx_hashA

Look up threat intelligence for a file hash via AlienVault OTX. Supports MD5, SHA1, SHA256.

Inputs: hash (required).

otx_ipA

Look up threat intelligence for an IP address via AlienVault OTX. Returns pulse info, reputation, country, ASN.

Inputs: ip (required).

otx_search_pulsesA

Search AlienVault OTX threat pulses by keyword. Returns matching pulses with tags, malware families, and IOC counts.

Inputs: query (required), limit.

phishing_checkA

Check if a URL is a known phishing site via PhishTank. Returns whether the URL is in their database and if it has been verified.

Inputs: url (required).

pulsedive_exploreB

Explore linked indicators on Pulsedive using advanced queries. Returns related IOCs with risk levels.

Inputs: query (required).

pulsedive_indicatorB

Look up an indicator (IP, domain, URL, or hash) on Pulsedive. Returns risk level, threats, feeds, and properties.

Inputs: indicator (required).

pulsedive_searchA

Search Pulsedive indicators by value. Returns matching indicator IDs.

Inputs: query (required).

ransomlookGroupsA

List all ransomware groups tracked by RansomLook. Returns 582+ groups with names and associated onion/clear-web URLs. Complementary source to ransomware.live.

Inputs: no named parameters.

ransomlookRecentA

Fetch the most recent ransomware posts and victim claims from RansomLook. Returns group name, post title, URL, and discovery timestamp.

Inputs: no named parameters.

ransomwareByCountryA

Get ransomware victims filtered by country using ISO 3166-1 alpha-2 country code. Example codes: US, GB, DE, TR, FR, JP.

Inputs: countryCode (required).

ransomwareBySectorA

Get ransomware victims filtered by sector or industry. Examples: 'healthcare', 'finance', 'education', 'government', 'technology'.

Inputs: sector (required).

ransomwareGroupA

Get a detailed profile for a specific ransomware group by name. Includes description, known URLs, locations, and profile metadata.

Inputs: name (required).

ransomwareGroupsA

List all known ransomware groups tracked by ransomware.live. Returns group names, descriptions, onion URLs, and profile information.

Inputs: no named parameters.

ransomwareGroupVictimsA

Get all victims claimed by a specific ransomware group. Returns victim names, countries, sectors, and publication dates.

Inputs: name (required).

ransomwareRecentA

Fetch the most recent ransomware victims from ransomware.live. Returns victim name, group, country, sector, publication date, and associated URLs.

Inputs: no named parameters.

ransomwareSearchA

Search ransomware victims by keyword. Matches against victim names, descriptions, and other fields. Useful for checking if a specific company has been listed as a victim.

Inputs: keyword (required).

stealer_domainA

Search Hudson Rock Cavalier for stealer log entries by domain. Returns compromised machines, credentials, and malware details. Requires HUDSONROCK_API_KEY.

Inputs: domain (required).

stealer_emailA

Search Hudson Rock Cavalier stealer logs by email address. Returns compromised machines with that email in browser credentials. Requires HUDSONROCK_API_KEY.

Inputs: email (required).

stealer_ipA

Search Hudson Rock Cavalier stealer logs by IP address. Returns compromised machines originating from that IP. Requires HUDSONROCK_API_KEY.

Inputs: ip (required).

threatfoxGetIocsA

Get recent IOCs from ThreatFox (abuse.ch). Returns indicators of compromise reported in the last N days.

Inputs: days.

threatfoxMalwareA

Search ThreatFox IOCs by malware family using Malpedia naming convention (e.g., "win.cobalt_strike", "win.emotet").

Inputs: malware (required), limit.

threatfoxSearchB

Search ThreatFox IOCs by term. Accepts IP addresses, domain names, hashes (MD5/SHA256), or URLs.

Inputs: searchTerm (required).

threatfoxTagA

Search ThreatFox IOCs by tag (e.g., "Cobalt Strike", "Emotet", "AgentTesla").

Inputs: tag (required), limit.

tor_exit_checkA

Check if a specific IP address is a known Tor exit node. Uses cached exit node list.

Inputs: ip (required).

tor_exit_detailsB

Get detailed Tor exit node information including fingerprints, publish timestamps, and exit addresses.

Inputs: limit.

tor_exit_nodesA

Get a list of current Tor exit node IP addresses from the official Tor Project bulk exit list.

Inputs: limit.

tor_fetch_onionA

Fetch raw HTML from a .onion URL via Tor SOCKS5 proxy. Requires a running Tor daemon. Only .onion URLs are allowed (DNS leak prevention via socks5h).

Inputs: url (required).

tor_scrape_onionA

Fetch and parse a .onion site via Tor. Returns structured data: page title, all links, and visible body text. Requires running Tor daemon.

Inputs: url (required).

tor_search_onionA

Search for .onion sites using Ahmia.fi search engine. Returns titles, URLs, and descriptions of matching hidden services.

Inputs: query (required), limit.

tor_statusA

Check if the local Tor SOCKS5 proxy daemon is running and accessible. Returns connectivity status for .onion fetching.

Inputs: no named parameters.

urlhausLookupA

Look up a URL or host in URLhaus (abuse.ch). Provide either a full URL for URL lookup or a hostname/IP for host lookup.

Inputs: url, host.

urlhausTagA

Search URLhaus (abuse.ch) entries by tag (e.g., "Emotet", "Dridex", "elf").

Inputs: tag (required).

vulners_exploitA

Search specifically for exploits on Vulners (ExploitDB entries). Filters results to exploit type only.

Inputs: query (required), limit.

vulners_idA

Look up a specific vulnerability or exploit by ID on Vulners. Free, no API key required. Supports CVE, EDB, GHSA IDs.

Inputs: id (required).

vulners_searchA

Search the Vulners vulnerability database using Lucene queries. Returns CVEs, advisories, and exploits.

Inputs: query (required), limit.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.4/5.0

Scored 2026-08-06 16:25 across 66 tools

Disambiguation4/5

Most tools are clearly scoped by service and operation, such as breachGet vs breachSearch or otx_ip vs otx_domain. However, a few pairs like greynoise_ip vs greynoise_check and tor_fetch_onion vs tor_scrape_onion are similar enough to potentially confuse an agent.

Naming Consistency2/5

Naming is inconsistent: some tools use camelCase (breachPassword, ransomwareRecent) while others use snake_case (tor_status, otx_ip). Verb placement also varies (breachGet vs tor_fetch_onion), making it harder to predict tool names.

Tool Count1/5

With 66 tools, this server far exceeds the typical well-scoped limit. The broad scope of threat-intel sources explains the count, but it is overwhelming and includes many overlapping services, pushing the count to an extreme.

Completeness4/5

The server covers a wide range of darknet and threat-intel domains: breaches, Tor, ransomware, malware, IP reputation, vulnerabilities, Bitcoin, and dark web search. Most workflows have paired operations (initiate/get results), though a few sources like RansomLook lack detailed lookup endpoints.

Maintenance

ActivityInactive

ResponsivenessNo recent community issues

Resources

Related MCP Connectors

Crimson Crawler
com.crimsoncrawler
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Security Search Research & Data
1
https://crimsoncrawler.com/mcp/v1
Straelo RelayA
com.straelo
MCP tools for agents: web research, content extraction, email, DNS, and blockchain intelligence.
AI & Machine Learning Developer Tools Search
151
https://relay.straelo.com/mcp/
robotbase-web3A
io.github.wygogogo19
Agent MCP: 65 tools — 5-chain verification, risk, prediction & crypto trends, 17 web tools.
Web3 & Decentralized Tech Cryptocurrency Blockchain
701
https://web3.robotbase.cc/mcp
robotbase-mcpA
io.github.wygogogo19
Agent MCP: 65 tools — 5-chain verification, risk, prediction & crypto trends, 17 web tools.
Blockchain Cryptocurrency Browser Automation
701
https://robotbase.cc/mcp

Related MCP Servers

Oracle-42 DarkIntel MCP
Security AI & Machine Learning Vector Databases
mintmas
F
license
Not graded
quality
D
maintenance
Darknet threat intelligence MCP server with 10 tools powered by 12,000+ vectorized data points from IronClaw pipeline.
Updated 8 months ago (2026-03-23 18:34 UTC)
-
wrg-mcp-server
Security Penetration Testing Code Analysis
WRG-11
A
license
Not graded
quality
A
maintenance
An MCP server that exposes a 60+ tool security and threat-intel stack to AI agents, enabling secret scanning, Sigma rule generation, ransomware lookup, OSINT, and deep research.
Updated 5 months ago (2026-06-10 18:22 UTC)
1
MIT
darknet-mcp-server
Security Blockchain
badchars
A
license
A
quality
C
maintenance
Dark web & threat intelligence for AI agents. HIBP, ThreatFox, ransomware tracking, Tor .onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.
Updated 2 months ago (2026-09-22 21:54 UTC)
66
419 npm
524
MIT
OSINT MCP Server
osintukraine
A
license
C
quality
D
maintenance
MCP server for the OSINT Intelligence Platform, enabling AI assistants to interact with Telegram intelligence archives via 65 tools for search, entity analysis, event tracking, social graph, and platform monitoring.
Updated a year ago (2025-12-25 20:08 UTC)
71
2
MIT

The Problem

How It's Different

Quick Start

Option 1: npx (no install)

Option 2: Clone

Environment variables (optional)

Connect to your AI agent

Tor setup (optional, for .onion access)

Start querying

What The AI Can Do

Breach Investigation

Ransomware Tracking

Dark Web Recon

Malware Analysis

Tools Reference (66 tools)

CLI Usage

Data Sources (16)

Architecture

Limitations

Part of the MCP Security Suite

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Oracle-42 DarkIntel MCP

wrg-mcp-server

darknet-mcp-server

OSINT MCP Server

Appeared in Searches