BlackDome Threat Intel
Connects Claude to BlackDome's live honeypot threat intelligence API. You get 14 tools spanning IP lookups, IOC browsing, attack heatmaps, credential searches, malware payload inspection, and threat actor profiling. Most tools run free without an API key, pulling from the community tier with a 72-hour data delay and basic rate limits. Paid plans unlock plaintext credential searches, STIX export, detonation reports, and hand-keyed attacker session transcripts. Useful when you're triaging an IP, enriching indicators for a SIEM, or analyzing attack patterns without switching to a web console. Everything is read-only and the free tier masks passwords by default.
- GitHub stars
- 1
- tools
- 20
- auth
- Secret needed
- transport
- STDIO
- env vars
- 3
- last updated
- Jun 11, 2026
Tools
20 toolsPublic tool metadata for what this MCP can expose to an agent.
lookup_attacker_ipFull dossier for one attacker IP — events, protocols, credentials (passwords masked), MITRE, edge nodes
Full dossier for one attacker IP — events, protocols, credentials (passwords masked), MITRE, edge nodes
No parameter schema in public metadata yet.
top_attackersMost active attacker IPs over a window — pick one to drill into
Most active attacker IPs over a window — pick one to drill into
No parameter schema in public metadata yet.
attack_mapRecent geolocated attack events for a live map (limit ≥ 10)
Recent geolocated attack events for a live map (limit ≥ 10)
No parameter schema in public metadata yet.
attack_heatmapCountry-aggregated attack heatmap with centroids (limit ≥ 5)
Country-aggregated attack heatmap with centroids (limit ≥ 5)
No parameter schema in public metadata yet.
credential_previewSample of recent credentials (masked server-side) + teaser totals
Sample of recent credentials (masked server-side) + teaser totals
No parameter schema in public metadata yet.
verify_sigilVerify a BlackDome Sigil / audit record by id
Verify a BlackDome Sigil / audit record by id
No parameter schema in public metadata yet.
recent_iocsBrowse recent redacted IOCs — type/severity filters (72h community delay, 25-row cap)
Browse recent redacted IOCs — type/severity filters (72h community delay, 25-row cap)
No parameter schema in public metadata yet.
ioc_trendsAggregated IOC trends — totals, breakdowns, daily new, top MITRE
Aggregated IOC trends — totals, breakdowns, daily new, top MITRE
No parameter schema in public metadata yet.
export_iocsExport the IOC feed; STIX bundle needs the stix_export feature
Export the IOC feed; STIX bundle needs the stix_export feature
No parameter schema in public metadata yet.
search_credentialsSearch the global credential corpus with PLAINTEXT passwords
Search the global credential corpus with PLAINTEXT passwords
No parameter schema in public metadata yet.
credential_statsAggregate credential stats — top usernames/passwords, breakdowns
Aggregate credential stats — top usernames/passwords, breakdowns
No parameter schema in public metadata yet.
list_payloadsList captured malware payloads, or fetch one by sha256 (VT/MB intel)
List captured malware payloads, or fetch one by sha256 (VT/MB intel)
No parameter schema in public metadata yet.
get_actorList clustered threat actors, or fetch one actor's sessions
List clustered threat actors, or fetch one actor's sessions
No parameter schema in public metadata yet.
warboardSigil leaderboard with intrusion narratives + attacker command tails
Sigil leaderboard with intrusion narratives + attacker command tails
No parameter schema in public metadata yet.
list_notable_sessionsRanked hand-keyed attacker sessions surfaced out of botnet noise
Ranked hand-keyed attacker sessions surfaced out of botnet noise
No parameter schema in public metadata yet.
get_session_transcriptStructured command/output transcript for one attacker session
Structured command/output transcript for one attacker session
No parameter schema in public metadata yet.
list_detonationsMalware detonation list with verdicts, Magika labels and IOC counts
Malware detonation list with verdicts, Magika labels and IOC counts
No parameter schema in public metadata yet.
get_detonation_reportFull detonation report with behavior, IOCs, artifact classification and report availability
Full detonation report with behavior, IOCs, artifact classification and report availability
No parameter schema in public metadata yet.
get_artifactArtifact dossier with linked detonation, IOCs and session identifiers only
Artifact dossier with linked detonation, IOCs and session identifiers only
No parameter schema in public metadata yet.
whoamiCheck your tenant, plan, features and live quota
Check your tenant, plan, features and live quota
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
BLACKDOME_API_KEYsecretOptional Bearer API key. Free public tools work without it; paid tiers (credential intel, payloads, actors, warboard, STIX export) require a key. Get one at https://blackdome.ai/pricing
BLACKDOME_BASE_URLdefault: https://api.blackdome.aiAPI base URL (default https://api.blackdome.ai).
BLACKDOME_TIMEOUTdefault: 15HTTP request timeout in seconds (default 15). Increase for large STIX/CSV exports.
Readme
BlackDome MCP Server
Canonical MCP server name: io.github.blackdome-ai/blackdome-mcp
Package version: 0.4.0
Give your AI agents direct access to read-only observed threat intelligence. Look up attacker IPs, browse indicators of compromise (IOCs), inspect captured credentials and malware payloads, compare samples deterministically, inspect bounded evidence clusters, and retrieve authenticated ThreatDrop case and workflow status — all from Claude, Cursor, or any MCP-compatible client.
Community tools are free and need no API key. The tool table identifies the product features required for paid intelligence.
Quick Start
Option 1 — Separately hosted streamable-HTTP MCP (recommended, no install)
One hosted streamable-HTTP endpoint for compatible remote MCP clients (Claude Desktop, the claude.ai web app, mobile, Cursor):
https://api.blackdome.ai/mcp
Free tools work with no key. To unlock the paid tiers (credential intelligence, payloads, actors, warboard, STIX export), get an API key at https://blackdome.ai/pricing and add it as an Authorization header:
Details
- Repository
- github.com/blackdome-ai/blackdome-mcp
- Website
- blackdome.ai
- Package
blackdome-mcp- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active