badchars/darknet-mcp-server

npx darknet-mcp-server (no install, free tools work immediately)
git clone https://github.com/badchars/darknet-mcp-server.git && bun install (alternative)
Set optional API keys via env vars (HIBP_API_KEY, INTELX_API_KEY, ABUSEIPDB_API_KEY, HUDSONROCK_API_KEY, HYBRID_API_KEY, VULNERS_API_KEY, etc.)

Usage

• •claude mcp add darknet-mcp-server -- npx darknet-mcp-server (or the JSON config for Claude Desktop / Cursor / Windsurf)
• •Tor .onion tools require a running Tor SOCKS5 proxy: brew install tor && brew services start tor (macOS) or apt + systemctl (Linux); verify with npx darknet-mcp-server --check-tor
• •CLI: npx darknet-mcp-server --tool breachList '{"domain":"adobe.com"}' or --list to show all tools

Key features

• ✓66 tools across 16 providers: breach intel (HIBP), IntelligenceX, steer logs (Hudson Rock), ransomware tracking (ransomware.live + RansomLook), abuse.ch suite, AlienVault OTX, AbuseIPDB, GreyNoise, Pulsedive, Vulners, blockchain (Bitcoin + ChainAbuse), Hybrid Analysis, CIRCL onion lookup, PhishTank
• ✓7 Tor tools (fetch/scrape/search .onion, exit-node checks) with DNS-leak prevention via socks5h
• ✓Graceful degradation: missing API keys don't crash the server; many tools work free
• ✓Per-provider rate limiters, TTL caching, and parallel multi-source correlation
• ✓CLI flags: --list, --check-tor, --tool <name> '{...}'

Best for

Security investigations where an agent must cross-reference breach data, ransomware, stealer logs, malware hashes, and dark-web mentions in one query

Caveats

• ⚠HIBP account/paste search requires a paid API key ($3.50/month); IntelligenceX, AbuseIPDB, Hudson Rock, and Hybrid Analysis tools require their API keys
• ⚠Tor .onion tools require a running Tor SOCKS5 proxy (not bundled)
• ⚠Blockchain tools support Bitcoin only (no Ethereum/Monero)
• ⚠PhishTank database can lag behind real-time phishing campaigns
• ⚠macOS/Linux tested; Windows not tested
• ⚠For authorized security testing and assessment only