darknet-mcp-server-threat-intelligence

Query the IP across multiple sources: abuseipdb_check for abuse confidence scores, greynoiseContext for classification, otx_ip for threat pulses, and pulsedive_indicator for risk ratings. Correlating results from several sources gives a more reliable verdict than any single feed.

Start a Tor SOCKS5 proxy on port 9050, then use tor_search_onion to search .onion forums for your domain, combined with breachList for known breaches and stealer_domain for compromised credentials in stealer logs.

No, all API keys are optional. Many tools work without authentication, including ransomware tracking, Tor access, MalwareBazaar, URLhaus, and basic OTX lookups. Keys for HIBP, AbuseIPDB, Hudson Rock, Hybrid Analysis, and Vulners unlock additional tools or higher rate limits.

Pass the hash to threatfox_ioc, malwarebazaar_hash, and hybrid_search in parallel to correlate malware family, signatures, and sandbox reports. If the sample is unknown to Hybrid Analysis, submit it with hybrid_submit for dynamic analysis.

The Tor tools require a running Tor SOCKS5 proxy, defaulting to 127.0.0.1:9050. Install and start Tor via your package manager or Docker, then verify connectivity with curl through the proxy before calling tor_fetch_onion or related tools.

Yes. Use btc_balance and btc_transactions to inspect incoming payments and total amounts received, then check chainabuse_report to see whether the address has been reported for ransomware or other abuse categories.