DarkRadar OSINT MCP Server

An MCP tool for data-breach / infostealer intelligence, for Claude and other MCP clients. Query a domain, email, username, IP or HWID against DarkRadar's infostealer dataset.

• Runs locally (stdio). Requests reach the DarkRadar API from your own IP, so the API's existing per-IP rate limiting, target blocking (including public institutions) and redaction apply as-is.
• Sensitive data is masked: passwords, full usernames, URL paths, IP octets and HWIDs are masked server-side; this client never receives raw credentials.

Tools

| Tool | What it does | |---|---| | search_domain | Domain: number of compromised employee/user credentials, stealer families, antivirus coverage, affected apps, third-party exposure | | search_email | Whether an email appears in infostealer data | | search_username | Username lookup | | search_ip | Events associated with an IP: OS, antivirus, stealer family, first-seen, service count | | search_hwid | Events associated with an infected machine's hardware ID (HWID) |

Installation

Requires Node.js 18+.

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "darkradar": {
      "command": "npx",
      "args": ["-y", "darkradar-mcp"]
    }
  }
}

Claude Code (CLI)

claude mcp add darkradar -- npx -y darkradar-mcp

Local (development)

git clone <repo> && cd darkradar-mcp
npm install
node src/index.mjs

Point Claude Desktop to the local path:

{
  "mcpServers": {
    "darkradar": { "command": "node", "args": ["/absolute/path/darkradar-mcp/src/index.mjs"] }
  }
}

Environment variables

| Variable | Default | Description | |---|---|---| | DARKRADAR_API_BASE | https://api.darkradar.com/api | API base URL | | DARKRADAR_API_KEY | — | Optional; sent as the x-api-key header for keyed/paid access |

Example prompts (ask Claude)

• "What do you know about example.com?"
• "Search the IP address 186.22.13.118."
• "Has [email protected] been compromised?"
• "Look up the username johndoe."

Responsibility & privacy

This tool is for defensive use: helping organizations and individuals see their own exposure. Sensitive fields are masked, blocked targets (e.g. public institutions) cannot be queried, and raw credentials are never shared. Query only assets you are authorized to check.

— DarkRadar · https://darkradar.com