MCP100 Assessment

Editorial verdict

Experimental research tooling only; it remains on the Shortlist because legality, content safety, provenance, operational security, and investigation authorization cannot be assumed from source availability.

Reviewed August 11, 2026

Task Fit

Mapped

Specialized workflows

Trust

Status warning

mcp_relevance; documentation; client_coverage; tool_contract; install_supply_chain; advisory_freshness; resource_type_requirements

Maintenance

Activity observed

A dated repository or package update is available; editorial maintenance review is still pending.

Popularity

Signals available

Visible usage signals are shown for discovery only, not as proof of safety.

Best for

Supervised research that uses the publisher-documented dark-web search and retrieval tools in an isolated environment

Not ideal for

General web search, unattended collection, or investigations that require guaranteed provenance and comprehensive coverage

Avoid if

The work lacks explicit authorization, a legal and safety review, an isolated environment, or a plan for handling harmful and sensitive material

Trade-offs

A single MCP interface may speed specialized research, while upstream content can be unsafe, misleading, illegal to access, or operationally sensitive.

Evidence scope

Evidence

Current source snapshot

Popularity

307 MCP repository stars

611 package downloads / 30 days

Repository identity: badchars/darknet-mcp-server

Package identity: darknet-mcp-server

Official npm package darknet-mcp-server: 611 downloads / 30 days.

Stars observed August 14, 2026 · Downloads observed September 8, 2026

Exact implementation repository metric.

Exact package is documented; download evidence is unavailable.

Maintenance

Publisher activity observed August 11, 2026

Current source snapshot

Trust review

Source relationship: Community implementation

Reviewed August 11, 2026

Sources

GitHub repository ↗

Evidence-backed setup

Install & Agents

Choose your MCP client. A client connects to the MCP server; the language model is selected inside that client. Only stored, source-backed configurations are shown.

Claude Code

Local stdio

MCP100 logic checked

claude mcp add darknet-mcp-server -- npx "darknet-mcp-server"

The publisher connection details were combined with this client's official MCP transport configuration; installation was not executed by MCP100.

Verify safely: Restart Claude Code, confirm darknet-mcp-server tools are listed, and perform one read-only test with non-sensitive data.

Uninstall and revoke

Remove darknet-mcp-server from Claude Code, restart the client, remove any separately installed package, and revoke dedicated credentials if used.

Evidence & methodology

Publisher-documented setup is not the same as MCP100 execution testing. “MCP100 logic checked” means the stored configuration shape was reviewed, not that third-party MCP software was run.

Evidence checked 2026-08-12

Evidence 1 ↗Evidence 2 ↗

Capability

What it does

onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.

Security & TestingCybersecurity

Representative uses

Supervised research that uses the publisher-documented dark-web search and retrieval tools in an isolated environment

Important limits

General web search, unattended collection, or investigations that require guaranteed provenance and comprehensive coverage

Tools66 documented capabilitiesView tools

Breach & leaked-data intelligence
Search breach and leaked-data sources for exposed accounts, credentials, or other compromised information.
Threat/IOC intelligence
Look up indicators of compromise and related threat-intelligence context across supported providers.
Malware & URL analysis
Analyze suspicious files, hashes, domains, or URLs using the server's malware and reputation sources.
Ransomware intelligence
Search ransomware-focused intelligence for groups, victims, campaigns, and related activity.
Tor/.onion discovery & retrieval
Discover Tor or .onion resources and retrieve content from supported dark-web sources.
Phishing & abuse intelligence
Investigate phishing, abuse, and malicious-infrastructure reports across supported providers.

View 3 more capabilities

Exploit/vulnerability search
Search exploit and vulnerability sources for known weaknesses, proof-of-concept references, or related intelligence.
Blockchain intelligence
Inspect supported blockchain or cryptocurrency intelligence relevant to threat investigations.
Provider/meta utilities
Inspect provider availability and use supporting utilities that coordinate or describe the server's intelligence sources.

Official catalog is 66 registered tools across 16 provider modules.

Source: Official source

Context Footprint

~13.2K estimated schema tokens

Context impact: High

Estimated token footprint of the MCP tool schemas exposed to the agent.

Approx. estimate

Approximate schema-token reference, not runtime measurement.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Provider API keys are optional environment variables for selected tools. MCP client authentication is not documented.
Permissions: Performs OSINT and threat-intelligence lookups, clearnet and onion fetch, scrape, and search, breach and stealer-log queries, malware intelligence, and blockchain, domain, and IP checks.
Data handling: Queries and indicators can be sent to external providers; outputs can include breach, stealer-log, and dark-web data. The README documents Tor SOCKS5H routing, local TTL caching, and HIBP password k-anonymity with only a five-character SHA-1 prefix sent.
Cost: The server has no documented project price. The README lists HIBP account and paste search as requiring a paid API key at $3.50 per month; other provider costs and limits vary.
Risk and cautions: Sensitive breach, credential, malware, and dark-web intelligence crosses external providers and Tor infrastructure. Minimize submitted identifiers, protect provider keys, and handle retrieved sensitive data under an explicit retention policy.

Related reviewed MCPs

Other options

sonarqube

MCP100 Recommended

Inspect SonarQube and SonarCloud projects, issues, quality gates, and security findings.

Choose this instead if

Choose sonarqube instead if code-quality and application-security investigation with optional controlled project operations.

Inspect SonarQube and SonarCloud projects, issues, quality gates, and security findings.

Compare with badchars-darknet-mcp-server View sonarqube details

semgrep

MCP100 Recommended

Run Semgrep security scans and inspect local or authorized Semgrep AppSec findings.

Choose this instead if

Choose semgrep instead if static-analysis and secure-coding investigation within the maintained Semgrep CLI.

Run Semgrep security scans and inspect local or authorized Semgrep AppSec findings.

Compare with badchars-darknet-mcp-server View semgrep details

Sentry MCP

MCP100 Recommended

Investigate Sentry errors, issues, projects, and telemetry.

Choose this instead if

Choose Sentry MCP instead if human-in-the-loop issue, event, trace, and performance investigation.

Investigate Sentry errors, issues, projects, and telemetry.

Compare with badchars-darknet-mcp-server View Sentry MCP details

Read publisher documentation

Publisher documentation

MCP100 source-backed summary

A concise MCP100 summary built from the reviewed publisher sources. It is not a publisher README; use the original link for the latest full documentation.

View original README ↗

badchars-darknet-mcp-server

onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.

What it can help with

Supervised research that uses the publisher-documented dark-web search and retrieval tools in an isolated environment

Important limits

General web search, unattended collection, or investigations that require guaranteed provenance and comprehensive coverage

Loading optional publisher documentation…

FAQ

What can badchars-darknet-mcp-server do?

onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.

Can Darknet MCP perform dark-web, breach, malware, and blockchain intelligence lookups?

Yes. The reviewed catalog spans breach and leaked-data intelligence, threat and IOC data, malware and URL analysis, ransomware, Tor/.onion discovery, phishing and abuse intelligence, exploit and vulnerability search, and blockchain intelligence. Provider coverage depends on configured API keys and should be used only for authorized research.

Does badchars-darknet-mcp-server work with Claude Code?

Yes. MCP100 reviewed an evidence-backed setup for Claude Code, but has not independently verified it with a live runtime test.

Which credentials or provider keys does it require?

Provider API keys are optional environment variables for selected tools. MCP client authentication is not documented.

What are the main security risks of badchars-darknet-mcp-server?

Sensitive breach, credential, malware, and dark-web intelligence crosses external providers and Tor infrastructure. Minimize submitted identifiers, protect provider keys, and handle retrieved sensitive data under an explicit retention policy.

Is this an official MCP?

github:badchars is listed as Community implementation in MCP100’s current evidence.

Current implementation resources:

Community implementation source ↗