DarkFeed Ransomware MCP — Live Threat Intelligence for AI Agents
DarkFeed  ·  Model Context Protocol Server

Ransomware Intelligence, Native to Your AI

A live MCP server that streams DarkFeed's ransomware & darknet-forum intelligence directly into your AI agents, SOC copilots and security workflows — no scraping, no stale exports.

Already a customer? — Free Dashboard · Get Access
Live Victim Feed 24/7
MCP Tools 8
Tracked Groups 200+
New · MCP Server Online

Plug ransomware intel straight into any AI agent

DarkFeed's new Model Context Protocol server exposes our entire ransomware intelligence database — victims, threat groups, sectors and darknet forum chatter — as native tools your AI can call in real time. Ask a question in natural language; get authoritative, source-backed answers.

Request Access See How It Works
Source-verified data Updated continuously Works with Claude, GPT & more
darkfeed-mcp · session CONNECTED
What is it

One protocol between your AI and the darknet

The Model Context Protocol (MCP) is the emerging standard for connecting AI assistants to live data sources. Our server speaks it natively — so instead of copy-pasting threat reports or maintaining brittle scrapers, your AI queries DarkFeed directly and reasons over fresh ransomware intelligence.

Every answer is grounded in data collected from ransomware leak sites and underground forums, processed and risk-classified by our engine, and returned with full attribution.

No data engineering — connect once, query forever
Structured, machine-readable responses your agent can act on
The same intelligence that powers DarkFeed's platform
Your AI Agent
Claude · GPT · SOC copilot
asks
DarkFeed MCP Server
8 intelligence tools
routes
Intelligence Database
Ransomware · forums · darknet
answers
Watch the walkthrough

See the MCP server in action

A two-minute tour of connecting the server, asking your first question, and watching live ransomware intelligence flow straight into your AI assistant.

Explainer
Capabilities

Eight tools, one ransomware brain

Each tool maps to a focused query against our intelligence database — your AI picks the right one automatically based on what you ask.

get_latest_victims
Pull the newest ransomware victims posted across tracked leak sites, freshest first.
get_top_groups
Rank the most active ransomware groups by victim volume and recent activity.
search_by_group
Retrieve every known victim and operation attributed to a specific threat group.
search_by_country
Filter ransomware victims by country to map geographic exposure and targeting.
search_by_sector
Surface victims within an industry — healthcare, finance, manufacturing and more.
search_text
Free-text search across the dataset for a company name, domain or keyword.
get_victim_by_id
Fetch the full record for a single victim — sector, country, domain and details.
health
Check server status and data freshness to confirm the feed is live and current.
Who it's for

Built for the teams on the front line

Security Operations & SOC

Give analysts and AI copilots instant context during triage and threat hunting.

  • Enrich alerts with live ransomware attribution
  • Hunt for sector- and geo-specific threats on demand
  • Cut investigation time from hours to seconds

Large Enterprises

Monitor your organization, subsidiaries and supply chain across one programmatic interface.

  • Automated third-party & vendor exposure checks
  • Continuous monitoring of your brand and domains
  • Feed intel into GRC and risk-reporting pipelines

CTI Analysts & Researchers

Query the darknet at the speed of thought and build intelligence on top of structured data.

  • Track group activity and emerging campaigns
  • Power custom reports and dashboards via the API
  • Correlate forum chatter with confirmed attacks
How it works

Connected in three steps

Point your MCP-compatible client at our endpoint, authenticate, and your AI gains eight ransomware-intelligence tools instantly.

1
Get your access key
Activate the MCP server from your DarkFeed monitoring plan.
2
Add it to your AI client
Drop the server config into Claude, your IDE, or any MCP-aware agent.
3
Just ask
Query ransomware intelligence in plain language — the AI handles the rest.
mcp.config.json Copy 
// Add DarkFeed to your MCP client
{
  "mcpServers": {
    "darkfeed-ransomware": {
      "url": "https://mcp.darkfeed.io/sse",
      "transport": "sse",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

Bring the darknet into your AI stack

Join the security teams using DarkFeed's MCP server to keep their AI agents one step ahead of ransomware. Get access and connect in minutes.

View Monitoring Plans Talk to Our Team