StealthMole MCP

Connect Claude Desktop, Claude Code, Cursor, Windsurf, and other MCP clients to the StealthMole Threat Intelligence API.

Quick Start

Claude Desktop

Simply run the following command — it will automatically register the MCP server in your Claude Desktop configuration:

npx -y stealthmole.mcp

Or manually add to your config file:

{
  "mcpServers": {
    "stealthmole": {
      "command": "npx",
      "args": ["-y", "stealthmole.mcp"],
      "env": {
        "STEALTHMOLE_CLIENT_SECRET": "<your-client-secret>"
      }
    }
  }
}

Claude Code

Add to your project's .mcp.json:

{
  "mcpServers": {
    "stealthmole": {
      "command": "npx",
      "args": ["-y", "stealthmole.mcp"],
      "env": {
        "STEALTHMOLE_CLIENT_SECRET": "<your-client-secret>"
      }
    }
  }
}

Other MCP Clients

Add the configuration above to your MCP client's config file:

| Client | Config File | |--------|-------------| | Claude Desktop (macOS) | ~/Library/Application Support/Claude/claude_desktop_config.json | | Claude Desktop (Windows) | %APPDATA%\Claude\claude_desktop_config.json | | Claude Desktop (Linux) | ~/.config/Claude/claude_desktop_config.json | | Cursor | .cursor/mcp.json in your project root | | Windsurf | ~/.codeium/windsurf/mcp_config.json |

How It Works

1. Run npx stealthmole.mcp (or your MCP client starts it automatically)
2. On first run, it auto-registers itself in Claude Desktop's config (if not already registered)
3. A browser window opens for StealthMole authentication via OAuth 2.1
4. After login, the OAuth token is cached in ~/.mcp-auth/
5. The stdio-to-HTTP bridge connects your MCP client to the remote server

Requirements

• Node.js 18+
• A StealthMole account with API access
• STEALTHMOLE_CLIENT_SECRET environment variable (optional, for confidential client flow)

Available Tools

Once connected, your MCP client will have access to the following tools:

Dark Web Tracker

| Tool | Description | |------|-------------| | dark_web_search | Search dark web content by indicator (domain, email, keyword, etc.) | | dark_web_targets | Get available search targets for a given indicator | | download_dark_web_file | Download a file by SHA256 hash |

Telegram Tracker

| Tool | Description | |------|-------------| | telegram_search | Search Telegram content by indicator | | telegram_targets | Get available search targets for a given indicator | | download_telegram_file | Download a file by SHA256 hash |

Credential Lookout

| Tool | Description | |------|-------------| | credential_search | Search for leaked credentials | | credential_export | Export leaked credentials to CSV/JSON |

Compromised Dataset

| Tool | Description | |------|-------------| | compromised_dataset_search | Search compromised data with host/URL info | | compromised_dataset_node | Get detailed node information | | compromised_dataset_export | Export compromised data to CSV/JSON |

Combo Binder

| Tool | Description | |------|-------------| | combo_binder_search | Search leaked ID/Password combinations | | combo_binder_export | Export combo data to CSV/JSON |

ULP Binder

| Tool | Description | |------|-------------| | ulp_binder_search | Search URL-Login-Password combinations | | ulp_binder_export | Export ULP data to CSV/JSON |

Monitoring

| Tool | Description | |------|-------------| | ransomware_monitoring_search | Track ransomware activities and attack groups | | government_monitoring_search | Monitor government sector threats | | leaked_monitoring_search | Monitor enterprise data leaks |

Utilities

| Tool | Description | |------|-------------| | node_details | Get detailed information about a specific node from any service | | search_pagination | Paginate through large result sets (DT/TT) | | search_targets | Get available targets for any service and indicator | | api_usage | Check API usage quotas by service |

CLI Options

npx stealthmole.mcp --debug                  # Enable debug logging
npx stealthmole.mcp --port 3335              # Use custom callback port
npx stealthmole.mcp --callback-port 3335     # Alias for --port
npx stealthmole.mcp --help                   # Show help message
npx stealthmole.mcp --version                # Show version number

A free callback port is automatically selected if --port is not specified. Only the flags listed above are supported; other flags are silently ignored.

Troubleshooting

Reset authentication

rm -rf ~/.mcp-auth/

Then restart your MCP client to re-authenticate.

Connection issues

1. Ensure Node.js 18+ is installed: node --version
2. Try with debug logging: npx stealthmole.mcp --debug
3. Check that your StealthMole account has API access

Port conflicts

If you see "Port is already in use" errors, the client will automatically retry with a different port. You can also specify a port manually:

npx stealthmole.mcp --port 3335

License

MIT