darknet-mcp-server-threat-intelligence

# darknet-mcp-server Threat Intelligence > Skill by [ara.so](https://ara.so) — MCP Skills collection. ## Overview darknet-mcp-server is a comprehensive MCP server providing 66 tools across 16 data sources for dark web and threat intelligence. It unifies breach databases (HIBP), ransomware tracking, Tor .onion access, malware analysis (Hybrid Analysis, MalwareBazaar), blockchain forensics, exploit databases (Vulners), stealer logs (Hudson Rock), and OSINT platforms into a single interface for AI agents. **Key capabilities:** - Breach intelligence: HIBP, IntelligenceX, paste searches - Ransomware tracking: ransomware.live, ransomlook.io (12 active groups, 1000+ victims) - Dark web access: 7 Tor tools for .onion fetching, scraping, searching - Malware analysis: ThreatFox, MalwareBazaar, Hybrid Analysis, URLhaus - Blockchain: Bitcoin transaction tracing, ChainAbuse reports - IP/domain intel: AbuseIPDB, GreyNoise, AlienVault OTX, Pulsedive - Exploit search: Vulners database - Phishing: PhishTank, OpenPhish ## Installation ### npx (Zero Install) ```bash # Run directly without installation npx darknet-mcp-server # Check Tor connectivity (for .onion tools) npx darknet-mcp-server --check-tor ``` ### Local Clone ```bash git clone https://github.com/badchars/darknet-mcp-server.git cd darknet-mcp-server bun install bun run src/index.ts ``` ### MCP Client Configuration **Claude Desktop** (`~/Library/Application Support/Claude/claude_desktop_config.json`): ```json { "mcpServers": { "darknet": { "command": "npx", "args": ["-y", "darknet-mcp-server"], "env": { "HIBP_API_KEY": "", "INTELX_API_KEY": "", "ABUSEIPDB_API_KEY": "", "HUDSONROCK_API_KEY": "", "HYBRID_API_KEY": "", "VULNERS_API_KEY": "", "OTX_API_KEY": "", "PULSEDIVE_API_KEY": "", "PHISHTANK_API_KEY": "", "ABUSECH_AUTH_KEY": "", "TOR_SOCKS_HOST": "127.0.0.1", "TOR_SOCKS_PORT": "9050" } } } } ``` **Claude Code**: ```bash claude mcp add darknet-mcp-server -- npx darknet-mcp-server ``` **Cursor/Windsurf** (`.cursor/mcp.json` or similar): ```json { "mcpServers": { "darknet": { "command": "npx", "args": ["-y", "darknet-mcp-server"] } } } ``` ## Environment Variables All API keys are **optional**. Many tools work without authentication: ```bash # Breach & credential intelligence export HIBP_API_KEY=your-key # Enables breachSearch, pasteSearch export INTELX_API_KEY=your-key # Enables intelx_search, intelx_phonebook, etc. # Threat intelligence export OTX_API_KEY=your-key # AlienVault OTX (higher rate limits) export ABUSEIPDB_API_KEY=your-key # Enables abuseipdb_check, abuseipdb_report export ABUSECH_AUTH_KEY=your-key # abuse.ch (ThreatFox, MalwareBazaar, URLhaus) export PULSEDIVE_API_KEY=your-key # Pulsedive threat intel # Stealer logs & credentials export HUDSONROCK_API_KEY=your-key # Enables stealer_domain, stealer_ip, stealer_cve # Exploit & malware analysis export VULNERS_API_KEY=your-key # Enables vulners_search, vulners_exploit export HYBRID_API_KEY=your-key # Enables hybrid_search, hybrid_report, hybrid_submit # Phishing export PHISHTANK_API_KEY=your-key # PhishTank (higher rate limits) # Tor SOCKS5 proxy (for .onion access) export TOR_SOCKS_HOST=127.0.0.1 # Default: 127.0.0.1 export TOR_SOCKS_PORT=9050 # Default: 9050 ``` ### Tor Setup (Required for .onion Tools) ```bash # macOS brew install tor brew services start tor # Linux (Debian/Ubuntu) sudo apt install tor sudo systemctl start tor sudo systemctl enable tor # Docker docker run -d -p 9050:9050 dperson/torproxy # Verify curl --socks5-hostname 127.0.0.1:9050 https://check.torproject.org ``` ## Tool Categories & Usage ### 1. Breach Intelligence (HIBP) **Tools:** `breachList`, `breachSearch`, `pasteSearch` ```typescript // List all breaches for a domain await use_mcp_tool("darknet", "breachList", { domain: "example.com" }); // Returns: Array of breach objects with Name, BreachDate, PwnCount, DataClasses // Search if specific account was breached (requires HIBP_API_KEY) await use_mcp_tool("darknet", "breachSearch", { account: "user@example.com" }); // Returns: Array of breaches affecting this account // Search pastes mentioning an email (requires HIBP_API_KEY) await use_mcp_tool("darknet", "pasteSearch", { account: "admin@example.com" }); // Returns: Array of paste sites with Source, Id, Date ``` **Example investigation:** ```typescript // Comprehensive breach check const domain = "target.com"; const breaches = await use_mcp_tool("darknet", "breachList", { domain }); const accountCheck = await use_mcp_tool("darknet", "breachSearch", { account: `admin@${domain}` }); const pastes = await use_mcp_tool("darknet", "pasteSearch", { account: `admin@${domain}` }); // Cross-reference with stealer logs const stealerLogs = await use_mcp_tool("darknet", "stealer_domain", { domain }); // Summary: breaches.length breaches, pastes.length pastes, stealerLogs compromised machines ``` ### 2. Ransomware Tracking **Tools:** `ransomwareGroups`, `ransomwareRecent`, `ransomwareByGroup`, `ransomwareBySector`, `ransomwareByCountry`, `ransomlookRecent`, `ransomlookGroup` ```typescript // List all active ransomware groups await use_mcp_tool("darknet", "ransomwareGroups", {}); // Returns: Array of {name, description, country, activity_since, onion_url} // Get recent victims (last 7 days by default) await use_mcp_tool("darknet", "ransomwareRecent", { days: 30 }); // Returns: Array of {victim_name, group_name, published_date, country, sector} // Track specific group await use_mcp_tool("darknet", "ransomwareByGroup", { group: "lockbit3" }); // Returns: Victims by this group // Sector-specific tracking await use_mcp_tool("darknet", "ransomwareBySector", { sector: "healthcare" }); // Returns: All healthcare sector victims // Cross-source validation (ransomlook.io) await use_mcp_tool("darknet", "ransomlookRecent", {}); await use_mcp_tool("darknet", "ransomlookGroup", { group: "lockbit3" }); ``` **Example: Healthcare sector threat landscape** ```typescript const healthcareVictims = await use_mcp_tool("darknet", "ransomwareBySector", { sector: "healthcare" }); const recentActivity = await use_mcp_tool("darknet", "ransomwareRecent", { days: 90 }); // Identify most active groups targeting healthcare const groups = new Set(healthcareVictims.map(v => v.group_name)); for (const group of groups) { const groupVictims = await use_mcp_tool("darknet", "ransomwareByGroup", { group }); // Analyze: groupVictims.length victims, average time between attacks } ``` ### 3. Tor & Dark Web Access **Tools:** `tor_fetch_onion`, `tor_scrape_onion`, `tor_search_onion`, `tor_check_availability`, `tor_exit_nodes`, `tor_check_exit`, `circl_onion_lookup` **Prerequisites:** Tor SOCKS5 proxy running on `127.0.0.1:9050` ```typescript // Fetch raw .onion content await use_mcp_tool("darknet", "tor_fetch_onion", { onion_url: "http://example.onion/page.html" }); // Returns: {content: "raw HTML", status: 200} // Extract structured data (links, text, metadata) await use_mcp_tool("darknet", "tor_scrape_onion", { onion_url: "http://forum.onion/", extract: ["links", "text"] }); // Returns: {links: [...], text: "...", title: "..."} // Search content across multiple .onion pages await use_mcp_tool("darknet", "tor_search_onion", { onion_urls: [ "http://forum1.onion/threads", "http://market2.onion/listings" ], search_term: "stolen credentials" }); // Returns: Array of {url, matches: [...], snippet} // Check if .onion is reachable await use_mcp_tool("darknet", "tor_check_availability", { onion_url: "http://example.onion" }); // Returns: {available: true, response_time_ms: 2341} // Get current Tor exit nodes await use_mcp_tool("darknet", "tor_exit_nodes", {}); // Returns: Array of {ip, name, country, exit_policy} // Check if IP is a Tor exit node await use_mcp_tool("darknet", "tor_check_exit", { ip: "185.220.101.1" }); // Returns: {is_exit: true, nickname: "...", country: "DE"} // CIRCL onion lookup (known malicious .onion sites) await use_mcp_tool("darknet", "circl_onion_lookup", { onion_address: "example.onion" }); // Returns: {known: true, tags: ["phishing", "scam"], first_seen: "2023-01-15"} ``` **Example: Dark web forum monitoring** ```typescript const forumUrls = [ "http://darkforum1.onion/breaches", "http://marketplace2.onion/credentials" ]; // Check availability first for (const url of forumUrls) { const status = await use_mcp_tool("darknet", "tor_check_availability", { onion_url: url }); if (!status.available) continue; // Search for company mentions const results = await use_mcp_tool("darknet", "tor_search_onion", { onion_urls: [url], search_term: "example.com database" }); if (results.length > 0) { // Fetch full pages for context for (const result of results) { const content = await use_mcp_tool("darknet", "tor_fetch_onion", { onion_url: result.url }); // Analyze content.content for breach details } } } ``` ### 4. Malware Analysis **Tools:** `threatfox_ioc`, `threatfox_malware`, `threatfox_tag`, `malwarebazaar_hash`, `malwarebazaar_recent`, `malwarebazaar_tag`, `urlhaus_url`, `urlhaus_host`, `urlhaus_recent`, `hybrid_search`, `hybrid_report`, `hybrid_submit` ```typescript // ThreatFox: Look up IOC (IP, domain, URL, hash) await use_mcp_tool("darknet", "threatfox_ioc", { ioc: "185.220.101.1" }); // Returns: {ioc_type: "ip", malware: "emotet", confidence: 90, tags: [...]} // Search by malware family await use_mcp_tool("darknet", "threatfox_malware", { malware: "emotet" }); // Returns: Array of IOCs associated with Emotet // Search by tag await use_mcp_tool("darknet", "threatfox_tag", { tag: "ransomware" }); // MalwareBazaar: Hash lookup await use_mcp_tool("darknet", "malwarebazaar_hash", { hash: "d41d8cd98f00b204e9800998ecf8427e" }); // Returns: {sha256, file_type, file_name, signature, tags, first_seen} // Recent malware samples