This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
An official Model Context Protocol (MCP) server for the Covertlabs infostealer intelligence platform. Built with FastMCP.
Sherlock provides access to Covertlabs' comprehensive database of infostealer logs, enabling security researchers and threat intelligence teams to:
Search compromised credentials by email, domain, username, or password
Investigate victims by IP address, country, or stealer family
Retrieve detailed artifacts including credentials, cookies, and browser history
Related MCP server: Threat Intel MCP Server
🔍 12 Search Tools - Comprehensive search capabilities across the infostealer database
🔐 Token Authentication - Secure access via Personal Access Tokens
⚡ Stateless HTTP - Scalable, load-balancer friendly architecture
🐳 Docker Ready - Production-ready containerization
Python 3.11+
A Covertlabs account with API access
Your Personal Access Token from app.covertlabs.io/cli/token
# Clone the repository
git clone https://github.com/covertlabs/sherlock-mcp.git
cd sherlock-mcp
# Create virtual environment
python -m venv .venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate
# Install dependencies
pip install -r requirements.txt
# Run the server
python server.pydocker compose up --buildConfigure via environment variables:
Variable | Default | Description |
|
| Server port |
|
| Server host |
|
| API endpoint |
|
| Allowed CORS origins |
|
| Enable request logging |
Add to ~/.cursor/mcp.json:
{
"mcpServers": {
"sherlock": {
"url": "http://localhost:8080/mcp",
"headers": {
"Authorization": "Bearer YOUR_TOKEN_HERE"
}
}
}
}Add to your Claude Desktop MCP configuration:
{
"mcpServers": {
"sherlock": {
"url": "http://localhost:8080/mcp",
"headers": {
"Authorization": "Bearer YOUR_TOKEN_HERE"
}
}
}
}See the docs/ folder for detailed documentation on each tool and response formats.
Tool | Description |
| Search victims by email address |
| Search victims by domain |
| Search victims by IP address |
| Search victims by username |
| Search victims by password |
| Broad text search across all fields |
| Search by ISO country code |
| Search by stealer malware family |
Tool | Description |
| Get victim profile and metadata |
| Get stolen credentials |
| Get stolen browser cookies |
| Get browser history |
This server uses Personal Access Token (PAT) authentication. Tokens are passed through to the Covertlabs API.
Log in to app.covertlabs.io
Navigate to CLI Token
Copy your token (format: cl_pat_V1_...)
Add to your MCP client configuration
Endpoint | Method | Description |
| GET | Server information |
| GET | Health check |
| POST | MCP protocol endpoint |
Tools Reference - Detailed tool documentation
Response Formats - API response schemas
Examples - Usage examples
Documentation: docs.covertlabs.io
Issues: GitHub Issues
Email: support@covertlabs.io
MIT License - see LICENSE for details.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
This server cannot be deployed
Breach intelligence API: email search, domain monitoring, passwords and stealer logs.
Deltabridge brings an AI-native cyber threat intelligence platform into your AI agent. Search a knowledge graph of 200,000+ threat actors, malware families, vulnerabilities, indicators and campaigns, mapped to MITRE ATT&CK. Look up and enrich IOCs, trace links between entities and read living briefs built from 300+ open sources. Read-only, scoped to your organisation, with OAuth sign-in or an API key. Included on Researcher, Business and Enterprise plans.
OSINT lookups across breach, people, domain, crypto, and image sources, paid per lookup.
Look up IOCs and search threat-intel reports, YARA rules, MITRE ATT&CK ids and CVEs from rosti.dev
