darknet-mcp-server
66-tool MCP server for dark web intelligence — breach data, ransomware tracking, Tor .onion access, malware analysis, blockchain intel, exploit search, stealer logs
Install / Use
claude mcp add badchars -- npx -y github:badchars/darknet-mcp-serverIf the server publishes to npm under a different name, use that package instead — check the repo README.
MCP Server
Model Context Protocol server
Quality Score
Category
SecuritySupported Platforms
Skill content
View source on GitHubThe Problem
Dark web intelligence is the missing layer in every security investigation. Breach databases, ransomware trackers, Tor hidden services, malware sandboxes, stealer logs, blockchain forensics, exploit databases — the data you need is scattered across dozens of platforms, each with its own API, its own auth, its own rate limits, its own output format. Today you check HIBP in one tab, ThreatFox in another, browse ransomware leak sites through Tor, pull up MalwareBazaar for a hash, check blockchain transactions on a block explorer, and then spend an hour manually piecing it all together.
Traditional dark web intel workflow:
check breach exposure -> HIBP web interface (paid API)
search leaked credentials -> IntelligenceX web interface
track ransomware groups -> ransomware.live + ransomlook.io (2 separate UIs)
access .onion hidden services -> Tor Browser manually
analyze malware samples -> Hybrid Analysis + MalwareBazaar (2 more UIs)
check IP abuse history -> AbuseIPDB + GreyNoise (2 more UIs)
trace cryptocurrency -> blockchain.info + ChainAbuse
search for exploits -> Vulners web interface
check phishing URLs -> PhishTank web interface
correlate everything -> copy-paste into a report
────────────────────────────────
Total: 60+ minutes per investigation, most of it switching contexts
darknet-mcp-server gives your AI agent 66 tools across 16 data sources via the Model Context Protocol. The agent queries all sources in parallel, correlates data across the surface and dark web, identifies threats, and presents a unified intelligence picture — in a single conversation.
With darknet-mcp-server:
You: "Investigate the breach exposure and threat landscape for target.com"
Agent: -> HIBP: 3 known breaches (Adobe 2013, LinkedIn 2021, Collection #1)
-> ThreatFox: 2 IOCs associated with domain (C2 callback, phishing)
-> URLhaus: 1 malicious URL hosted on subdomain
-> Ransomware: No victim listings found (good)
-> Stealer logs: 47 compromised employee credentials found
-> OTX: 5 threat pulses referencing the domain
-> AbuseIPDB: Primary IP has 12 abuse reports (brute force)
-> "target.com has been in 3 data breaches exposing 2.1M records.
47 employee credentials found in stealer logs — immediate
password reset recommended. 2 active ThreatFox IOCs suggest
ongoing targeting. No ransomware listings, but the abuse
reports on the primary IP warrant investigation."
How It's Different
Existing tools give you raw data one source at a time. darknet-mcp-server gives your AI agent the ability to reason across surface web and dark web intelligence simultaneously.
<table> <thead> <tr> <th></th> <th>Traditional Approach</th> <th>darknet-mcp-server</th> </tr> </thead> <tbody> <tr> <td><b>Interface</b></td> <td>16 different web UIs, CLIs, and APIs</td> <td>MCP — AI agent calls tools conversationally</td> </tr> <tr> <td><b>Data sources</b></td> <td>One platform at a time</td> <td>16 sources queried in parallel</td> </tr> <tr> <td><b>Breach intel</b></td> <td>HIBP web UI for breaches, IntelligenceX for leaks</td> <td>Agent combines HIBP breaches + pastes + IntelligenceX + stealer logs</td> </tr> <tr> <td><b>Dark web access</b></td> <td>Manual Tor Browser, copy-paste from .onion sites</td> <td>Agent fetches, scrapes, and searches .onion sites via SOCKS5 proxy</td> </tr> <tr> <td><b>Malware analysis</b></td> <td>Hybrid Analysis + MalwareBazaar + ThreatFox separately</td> <td>Agent cross-references: "This hash from ThreatFox was also detonated in Hybrid Analysis with network IOCs"</td> </tr> <tr> <td><b>Blockchain</b></td> <td>Block explorer + ChainAbuse separately</td> <td>Agent traces BTC transactions and checks abuse reports in one step</td> </tr> <tr> <td><b>API keys</b></td> <td>Required for almost everything</td> <td>Many tools work free; API keys unlock premium sources</td> </tr> <tr> <td><b>Setup</b></td> <td>Install each tool, manage each config, run Tor Browser</td> <td><code>npx darknet-mcp-server</code> — one command, zero config</td> </tr> </tbody> </table>Quick Start
Option 1: npx (no install)
npx darknet-mcp-server
Free tools work immediately. No API keys required for ransomware tracking, breach listings, GreyNoise, blockchain, OTX, and more.
Option 2: Clone
git clone https://github.com/badchars/darknet-mcp-server.git
cd darknet-mcp-server
bun install
Environment variables (optional)
# Breach & credential intelligence
export HIBP_API_KEY=your-key # Enables breach account search & paste search
export INTELX_API_KEY=your-key # Enables 4 IntelligenceX tools
# Threat intelligence
export OTX_API_KEY=your-key # Increases AlienVault OTX rate limits
export ABUSEIPDB_API_KEY=your-key # Enables 4 AbuseIPDB tools
export ABUSECH_AUTH_KEY=your-key # Higher rate limits for abuse.ch suite
export PULSEDIVE_API_KEY=your-key # Higher rate limits for Pulsedive
# Stealer logs & credentials
export HUDSONROCK_API_KEY=your-key # Enables 3 Hudson Rock stealer log tools
# Exploit & malware analysis
export VULNERS_API_KEY=your-key # Enables Vulners search & exploit tools
export HYBRID_API_KEY=your-key # Enables 3 Hybrid Analysis malware tools
# Phishing
export PHISHTANK_API_KEY=your-key # Higher rate limits for PhishTank
# Tor SOCKS5 proxy (for .onion access)
export TOR_SOCKS_HOST=127.0.0.1 # Default: 127.0.0.1
export TOR_SOCKS_PORT=9050 # Default: 9050
All API keys are optional. Without them, you still get ransomware tracking, breach listings, GreyNoise, blockchain intelligence, OTX, Tor exit node checks, onion search, CIRCL onion lookup, and more.
Connect to your AI agent
<details open> <summary><b>Claude Code</b></summary># With npx
claude mcp add darknet-mcp-server -- npx darknet-mcp-server
# With local clone
claude mcp add darknet-mcp-server -- bun run /path/to/darknet-mcp-server/src/index.ts
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"darknet": {
"command": "npx",
"args": ["-y", "darknet-mcp-server"],
"env": {
"HIBP_API_KEY": "optional",
"INTELX_API_KEY": "optional",
"ABUSEIPDB_API_KEY": "optional",
"HUDSONROCK_API_KEY": "optional",
"HYBRID_API_KEY": "optional",
"VULNERS_API_KEY": "optional"
}
}
}
}
Same JSON config format. Point the command to npx darknet-mcp-server or your local installation path.
Tor setup (optional, for .onion access)
The 7 Tor tools (tor_fetch_onion, tor_scrape_onion, etc.) require a running Tor SOCKS5 proxy.
# macOS
brew install tor && brew services start tor
# Linux
sudo apt install tor && sudo systemctl start tor
# Docker
docker run -d -p 9050:9050 dperson/torproxy
# Verify connectivity
npx darknet-mcp-server --check-tor
Start querying
You: "Check if example.com has been in any data breaches and look for stealer logs"
That's it. The agent handles breach lookups, credential searches, threat correlation, and more automatically.
What The AI Can Do
Breach Investigation
You: "Check if example.com has been in any data breaches"
Agent: -> breachList {domain: "example.com"}
-> breachSearch {account: "admin@example.com"}
-> stealer_domain {domain: "example.com"}
-> intelx_search {term: "example.com"}
-> "example.com appears in 5 known breaches:
- ExampleDB 2023: 4.2M records (emails, passwords, IPs)
- Collection #1: credential stuffing list
- Combolist 2024: 890K email:password pairs
Stealer logs: 23 compromised machines with saved credentials
for example.com found in Hudson Rock database.
IntelligenceX: 47 results across paste sites and dark web."
Ransomware Tracking
You: "What ransomware groups are targeting healthcare?"
Agent: -> ransomwareBySector {sector: "healthcare"}
-> ransomwareRecent {}
-> ransomlookRecent {}
-> "Healthcare sector ransomware activity:
142 victims across 12 groups in the last 12 months.
Top groups: LockBit3 (38 victims), BlackCat/ALPHV (24),
Cl0p (19), Royal (15).
Most recent: MedCorp Inc. listed by LockBit3 (2 days ago).
3 new healthcare victims in the last week across
ransomware.live and RansomLook feeds."
Dark Web Recon
``
Truncated for display — read the full file on GitHub.
Related Skills
Agent-Reach
84.2kGive your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees.
headroom
73.4kCompress tool outputs, logs, files, and RAG chunks before they reach the LLM. 20% fewer tokens for coding agents, 60-95% fewer tokens for JSON, same answers. Library, proxy, MCP server.
ruflo
73.0k🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory, self-learning intelligence, federation, vector RAG integration, and native Claude Code / Codex / Hermes and many more Integrated
CowAgent
47.1kOpen-source super AI assistant & Agent Harness. Plans tasks, runs tools and skills, self-evolves with memory and knowledge. Multi-agent, multi-model, multi-channel. Lightweight, extensible, one-line install.
