darknet-mcp-server
A 66-tool MCP server that gives an AI agent unified access to dark-web and threat-intelligence sources: breach databases, ransomware-leak tracking, Tor .onion access, malware analysis, blockchain forensics and exploit search.
The server queries sixteen data sources in parallel and correlates results across the surface and dark web in a single conversation, instead of a person checking each source's own web UI, CLI or API separately and piecing results together by hand; example sources include HIBP for breach data and ThreatFox for malware indicators. It can cross-reference results, for instance linking a file hash seen in ThreatFox to the same hash detonated in a malware sandbox.
Its sixteen data sources cover breach and paste data, ransomware-leak-site tracking, Tor .onion access over a SOCKS5 proxy, malware sandboxes and hash lookups, blockchain transaction forensics, and exploit-database search, exposed to an MCP client as 66 distinct tools. It is written in TypeScript and documents its own architecture and data sources alongside a changelog.