Using MCP

The Dark Radar MCP server lets Claude and other MCP clients use Dark Radar data as tools. It runs on your machine; your key stays with the client.

Installation

Add it to Claude Code with a single command, or to Claude Desktop through the configuration file. For product tools, provide the API key in the DARKRADAR_API_KEY environment variable.

Claude Code

claude mcp add darkradar -e DARKRADAR_API_KEY=<DARKRADAR_API_KEY> -- npx -y darkradar-mcp@latest

Claude Desktop

{
  "mcpServers": {
    "darkradar": {
      "command": "npx",
      "args": ["-y", "darkradar-mcp@latest"],
      "env": { "DARKRADAR_API_KEY": "<DARKRADAR_API_KEY>" }
    }
  }
}

Product tools require darkradar-mcp 0.5.0 or later.

Tools

Without a key, only the free search tools are available. With a key, the tools for products enabled for your firm appear; scopes are also enforced on the server.

Free search (no key)

search_domainLeak summary for a domain (masked)

search_emailWhether an email appears in leaks

search_usernameUsername lookup

search_ipInfections related to an IP

search_hwidInfections related to a HWID

glossary_searchSearches the glossary (0.6.0+)

glossary_get_termGets a term with how it works, detection, defense and sources (0.6.0+)

malware_list_familiesLists malware families (0.6.0+)

malware_get_familyGets a family profile with capabilities, MITRE techniques and defense (0.6.0+)

academy_list_casesLists Academy case studies (0.6.0+)

academy_get_caseGets a case with its spread, attack chain and lessons (0.6.0+)

threat_actor_searchSearches threat actors (0.6.0+)

threat_actor_getGets an actor profile with origin, targeted sectors and related families (0.6.0+)

vulnerability_listLists latest, exploited or critical vulnerabilities (0.6.0+)

vulnerability_getGets a CVE; checks whether a version is affected (0.6.0+)

integrations_listLists integrations and what they do (0.6.0+)

reports_listLists global or country monthly reports (0.6.0+)

report_getGets a report’s key figures (0.6.0+)

products_listLists Dark Radar products with a short summary (0.6.0+)

product_getGets a product’s scope, key capabilities and FAQ (0.6.0+)

Infostealer Detection

corporate_list_reportsLists leak reports

corporate_get_reportGets one report

corporate_list_leak_eventsLists leak events with filters

corporate_get_leak_eventGets one leak event

corporate_list_inventoryLists inventory files

corporate_list_analysesLists CTI case analyses

corporate_get_analysisGets one case analysis with its context, evidence and report

corporate_list_protection_resourcesLists protection resources

corporate_list_protection_resource_groupsLists protection resource groups

corporate_create_protection_resource_groupCreates a protection resource group (changes data)

corporate_update_protection_resource_groupUpdates a protection resource group (changes data)

corporate_delete_protection_resource_groupDeletes an empty protection resource group (changes data)

corporate_bulk_create_protection_resourcesBulk creates protection resources (changes data)

corporate_bulk_delete_protection_resourcesBulk deletes protection resources (changes data)

corporate_list_webhook_deliveriesLists a webhook’s recent deliveries (read-only; 0.3.0+)

corporate_list_supply_chain_inboundLists inbound supplier risks (0.5.0+)

corporate_assess_suppliersGrades up to 50 suppliers from A to F (0.5.0+)

Intelligence 360

x360_list_customer_leaksLists customer (end-user) leaks

Portfolio Monitoring

watch_list_assetsLists watched assets

watch_add_assetAdds an asset (changes data)

watch_remove_assetRemoves an asset (changes data)

watch_list_findingsLists findings

Threat Investigation

hunter_searchFree-target search — free, results masked

hunter_domainDomain discovery — free

hunter_productProduct leak search — free, results masked

hunter_usageShows credit balance, analysis allowance and target usage

hunter_targets_listLists watched targets

hunter_findings_listLists watch findings; secrets masked

search_iocLooks up an indicator in threat records; "no record" does not mean safe

Security

Secrets are masked server-side; tools never return raw passwords. The key is never written to any output. Tools that change data say so.

DARKRADAR_API_KEY