badchars/darknet-mcp-server

What is darknet‑mcp‑server?

A small, self‑hosted MCP (Model Context Protocol) server that bundles 66 security‑tool wrappers around 16 public dark‑web and threat‑intelligence data sources. It lets an AI‑powered assistant (Claude, Cursor, etc.) ask natural‑language questions like “Has example.com been breached?” and have the server query dozens of APIs (HIBP, ThreatFox, ransomware trackers, Tor‑onion search, blockchain explorers, etc.) in parallel, combine the results, and return a concise, structured answer.

---

Why it exists – the problem it solves

Security investigations normally require hopping between many web UIs, CLIs and APIs, each with its own authentication, rate limits and output format. A typical analyst spends tens of minutes just gathering data before any analysis can begin.

darknet‑mcp‑server removes that friction by:

• exposing every data source as a single MCP tool that an AI agent can call conversationally,
• running the calls in parallel and correlating the results automatically,
• handling optional API‑key configuration so the basic (free) tools work out‑of‑the‑box.

---

Core capabilities (the 66 tools)

Category	Example tools (free / paid)	What you can ask the AI to do
Tor / .onion	tor_fetch_onion, tor_search_onion	“Search the dark web for mentions of AcmeCorp.”
Ransomware intel	ransomwareRecent, ransomwareBySector	“Which ransomware groups target healthcare?”
Breach intel (HIBP)	breachList, breachSearch (needs key)	“List breaches affecting example.com.”
Abuse.ch / ThreatFox	threatfoxSearch, urlhausLookup	“Show IOCs for domain example.com.”
OTX, Pulsedive, AbuseIPDB	otx_ip, abuseipdb_check	“Is the IP 1.2.3.4 known malicious?”
Malware analysis	bazaarHash, malware_search	“Analyse hash abc123… for threats.”
Blockchain / crypto	otx_ip (covers crypto‑related IOCs)	“Trace BTC transactions linked to a domain.”
GreyNoise	greynoise_ip	“Is this IP just a scanner?”
Vulners exploits	vulners_search	“Find exploits for CVE‑2023‑1234.”

All tools are invoked through the MCP JSON schema, e.g. breachList {"domain":"example.com"}.

---

Quick‑start guide

1. Run without installing (requires Bun runtime):

   npx darknet-mcp-server
   

   The server starts and listens for MCP calls on the default port.

2. Or run from source:

   git clone https://github.com/badchars/darknet-mcp-server.git
   cd darknet-mcp-server
   bun install   # installs dependencies
   bun run src/index.ts   # start the server
   

3. Optional API keys – set any of the environment variables listed in the README (e.g. HIBP_API_KEY, ABUSEIPDB_API_KEY). The server works with the free subset even if none are provided.

4. Tor for .onion tools – install a local Tor SOCKS5 proxy (brew/apt/docker) and ensure TOR_SOCKS_HOST/TOR_SOCKS_PORT point to it.

5. Connect an AI client – add the server to Claude, Cursor, Windsurf, etc. via the provided JSON snippet or the claude mcp add command. Once registered, the AI can call any of the 66 tools as part of a conversation.

---

Typical AI‑agent workflows

• Breach investigation – the agent calls breachList, breachSearch, stealer_domain and intelx_search to produce a single paragraph summarising breach exposure, leaked credentials and any dark‑web mentions.
• Ransomware monitoring – ransomwareBySector + ransomlookRecent give a quick snapshot of active groups and recent victims for a chosen industry.
• Dark‑web reconnaissance – tor_search_onion + intelx_search let the agent surface .onion forum posts or marketplace listings that reference a target company.
• Malware triage – a hash is fed to malware_search, bazaarHash, otx_hash and threatfoxSearch; the agent returns a concise ATT&CK‑style summary.

---

Who might use it?

• Security analysts who want to automate data‑gathering and let a language model do the heavy lifting of correlation.
• Red‑team / threat‑intel developers building autonomous agents that need up‑to‑date dark‑web intel.
• DevSecOps pipelines that want a programmable source of breach and IOC data without wiring dozens of separate APIs.

---

License & ecosystem

• License: MIT – free for commercial and non‑commercial use.
• Package: Published on npm as darknet-mcp-server (runtime: Bun).
• Protocol: Implements the open Model Context Protocol (MCP), making it compatible with any MCP‑aware AI client.

---

Bottom line

darknet‑mcp‑server is a ready‑to‑run bridge that turns a sprawling set of dark‑web and threat‑intel feeds into a single, AI‑friendly endpoint. By handling authentication, parallel querying and result correlation, it lets language‑model agents deliver full‑spectrum security intelligence with a single natural‑language prompt.