darknet-mcp-server is a non-official community project (MIT, Bun + TypeScript) that exposes 66 dark web and threat intelligence tools over MCP stdio, covering 16 data sources. Its main value is consolidating scattered breach lookups, ransomware tracking, Tor .onion access, malware analysis, blockchain tracing and exploit search into a single conversation, with per-provider rate limiters, TTL caching, DNS leak prevention and graceful degradation when API keys are missing. Most free tools work immediately, but HIBP account/paste search, IntelligenceX, AbuseIPDB, Hudson Rock and Hybrid Analysis require API keys, and the 7 Tor tools need a local Tor proxy. Intended for authorized security testing and assessment only.
darknet-mcp-server is a Model Context Protocol (MCP) server that gives AI agents dark web and threat intelligence capabilities through 66 tools across 16 data sources. It unifies Have I Been Pwned, IntelligenceX, AlienVault OTX, AbuseIPDB, the abuse.ch suite (ThreatFox, URLhaus, MalwareBazaar), GreyNoise, Pulsedive, Hudson Rock, Vulners, Blockchain.info, ChainAbuse, Hybrid Analysis, CIRCL AIL and the Tor network into a single MCP server, letting an agent query all sources in parallel and correlate data in one conversation for breach investigation, ransomware tracking, dark web reconnaissance, malware analysis and blockchain tracing. It is built with Bun + TypeScript and runs over stdio, starting with zero config via npx.
Option 1 (no install): run npx darknet-mcp-server. Free tools work immediately — ransomware tracking, breach listings, GreyNoise, blockchain, OTX and more need no API keys. Option 2 (clone): git clone https://github.com/badchars/darknet-mcp-server.git && cd darknet-mcp-server && bun install. Optional environment variables: HIBP_API_KEY, INTELX_API_KEY, OTX_API_KEY, ABUSEIPDB_API_KEY, ABUSECH_AUTH_KEY, PULSEDIVE_API_KEY, HUDSONROCK_API_KEY, VULNERS_API_KEY, HYBRID_API_KEY, PHISHTANK_API_KEY, plus Tor proxy settings TOR_SOCKS_HOST (default 127.0.0.1) and TOR_SOCKS_PORT (default 9050). Connect a client: for Claude Code run claude mcp add darknet-mcp-server -- npx darknet-mcp-server, or with a local clone claude mcp add darknet-mcp-server -- bun run /path/to/darknet-mcp-server/src/index.ts; for Claude Desktop add the npx launch config to mcpServers in claude_desktop_config.json; Cursor / Windsurf use the same JSON format. To use the 7 Tor tools, run a local Tor SOCKS5 proxy first (macOS brew install tor && brew services start tor; Linux sudo apt install tor && sudo systemctl start tor; Docker docker run -d -p 9050:9050 dperson/torproxy) and verify connectivity with npx darknet-mcp-server --check-tor.
{
"mcpServers": {
"darknet": {
"command": "npx",
"args": ["-y", "darknet-mcp-server"],
"env": {
"HIBP_API_KEY": "optional",
"INTELX_API_KEY": "optional",
"ABUSEIPDB_API_KEY": "optional",
"HUDSONROCK_API_KEY": "optional",
"HYBRID_API_KEY": "optional",
"VULNERS_API_KEY": "optional"
}
}
}
}