darknet-mcp-server is a non-official community project (MIT, Bun + TypeScript) that exposes 66 dark web and threat intelligence tools over MCP stdio, covering 16 data sources. Its main value is consolidating scattered breach lookups, ransomware tracking, Tor .onion access, malware analysis, blockchain tracing and exploit search into a single conversation, with per-provider rate limiters, TTL caching, DNS leak prevention and graceful degradation when API keys are missing. Most free tools work immediately, but HIBP account/paste search, IntelligenceX, AbuseIPDB, Hudson Rock and Hybrid Analysis require API keys, and the 7 Tor tools need a local Tor proxy. Intended for authorized security testing and assessment only.
Strongest · Documentation 14/20 Weakest · Security and permissions 5/20
Static review · not runListed 2026-09-18
Read the FMRS scoring method →Runtime：Node.js · Bun · Docker
HIBP_API_KEY
HaveIBeenPwned API key enabling breach account and paste search (paid, $3.50/month); get it at haveibeenpwned.com.
INTELX_API_KEY
IntelligenceX API key enabling 4 leak/dark-web search tools; get it at intelx.io.
ABUSEIPDB_API_KEY
AbuseIPDB API key enabling 4 IP abuse lookup tools; get it at abuseipdb.com.
HUDSONROCK_API_KEY
Hudson Rock Cavalier API key enabling 3 stealer log search tools; get it at cavalier.hudsonrock.com.
HYBRID_API_KEY
Hybrid Analysis API key enabling 3 malware sandbox tools; get it at hybrid-analysis.com.
VULNERS_API_KEY
Vulners API key enabling vulnerability/exploit search; get it at vulners.com.
OTX_API_KEY
AlienVault OTX API key for higher rate limits; get it at otx.alienvault.com.
ABUSECH_AUTH_KEY
abuse.ch auth key for higher rate limits on ThreatFox/URLhaus/MalwareBazaar; get it at abuse.ch.
PULSEDIVE_API_KEY
Pulsedive API key for higher rate limits on indicator lookups; get it at pulsedive.com.
PHISHTANK_API_KEY
PhishTank API key for higher rate limits on phishing URL checks; get it at phishtank.org.
TOR_SOCKS_HOST
Tor SOCKS5 proxy host, default 127.0.0.1, used for .onion access.
TOR_SOCKS_PORT
Tor SOCKS5 proxy port, default 9050, used for .onion access.
Option 1 (no install): run npx darknet-mcp-server. Free tools work immediately — ransomware tracking, breach listings, GreyNoise, blockchain, OTX and more need no API keys. Option 2 (clone): git clone https://github.com/badchars/darknet-mcp-server.git && cd darknet-mcp-server && bun install. Optional environment variables: HIBP_API_KEY, INTELX_API_KEY, OTX_API_KEY, ABUSEIPDB_API_KEY, ABUSECH_AUTH_KEY, PULSEDIVE_API_KEY, HUDSONROCK_API_KEY, VULNERS_API_KEY, HYBRID_API_KEY, PHISHTANK_API_KEY, plus Tor proxy settings TOR_SOCKS_HOST (default 127.0.0.1) and TOR_SOCKS_PORT (default 9050). Connect a client: for Claude Code run claude mcp add darknet-mcp-server -- npx darknet-mcp-server, or with a local clone claude mcp add darknet-mcp-server -- bun run /path/to/darknet-mcp-server/src/index.ts; for Claude Desktop add the npx launch config to mcpServers in claude_desktop_config.json; Cursor / Windsurf use the same JSON format. To use the 7 Tor tools, run a local Tor SOCKS5 proxy first (macOS brew install tor && brew services start tor; Linux sudo apt install tor && sudo systemctl start tor; Docker docker run -d -p 9050:9050 dperson/torproxy) and verify connectivity with npx darknet-mcp-server --check-tor.
{
"mcpServers": {
"darknet": {
"command": "npx",
"args": ["-y", "darknet-mcp-server"],
"env": {
"HIBP_API_KEY": "optional",
"INTELX_API_KEY": "optional",
"ABUSEIPDB_API_KEY": "optional",
"HUDSONROCK_API_KEY": "optional",
"HYBRID_API_KEY": "optional",
"VULNERS_API_KEY": "optional"
}
}
}
}
Shown for Claude Code. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.
{
"servers": {
"darknet": {
"command": "npx",
"args": [
"-y",
"darknet-mcp-server"
],
"env": {
"HIBP_API_KEY": "optional",
"INTELX_API_KEY": "optional",
"ABUSEIPDB_API_KEY": "optional",
"HUDSONROCK_API_KEY": "optional",
"HYBRID_API_KEY": "optional",
"VULNERS_API_KEY": "optional"
}
}
}
}
Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).
claude mcp add darknet -e HIBP_API_KEY=optional -e INTELX_API_KEY=optional -e ABUSEIPDB_API_KEY=optional -e HUDSONROCK_API_KEY=optional -e HYBRID_API_KEY=optional -e VULNERS_API_KEY=optional -- npx -y darknet-mcp-server
Run it in a terminal; replace any <…> placeholders with your own values first.
Run npx darknet-mcp-server --check-tor to verify the Tor proxy, or confirm tools like darknet_list_sources and breachList appear in your client's tool list; npx darknet-mcp-server --list shows all 66 tools.
Once connected, you can ask your AI assistant things like:
No matching tools
Listed from the project's documentation, not tested by this site.
darknet-mcp-server is a Model Context Protocol (MCP) server that gives AI agents dark web and threat intelligence capabilities through 66 tools across 16 data sources. It unifies Have I Been Pwned, IntelligenceX, AlienVault OTX, AbuseIPDB, the abuse.ch suite (ThreatFox, URLhaus, MalwareBazaar), GreyNoise, Pulsedive, Hudson Rock, Vulners, Blockchain.info, ChainAbuse, Hybrid Analysis, CIRCL AIL and the Tor network into a single MCP server, letting an agent query all sources in parallel and correlate data in one conversation for breach investigation, ransomware tracking, dark web reconnaissance, malware analysis and blockchain tracing. It is built with Bun + TypeScript and runs over stdio, starting with zero config via npx.
Manage your Hevy workout data from AI assistants via MCP.
Firecrawl's official MCP server for web search, scraping, and structured extraction for AI agents
One binary. One grammar. Evidence from the biomedical sources you already trust.
Encrypted, fully offline long-term memory for AI agents
Source revision 8a19a37a03b3 Data synced 2026-11-02 Read the FMRS scoring method