StealthMole

This MCP server enables you to access StealthMole threat intelligence through a programmable interface. You can search and monitor threats across the Deep & Dark Web and related data sources, then connect with MCP clients to query indicators, monitor incidents, and manage usage all through a secure, token-based flow.

How to use

You run a local MCP server and connect to it with an MCP client to perform searches, monitor threats, and manage quotas. Start the server in development or production mode, then configure your client to point to the local MCP endpoint or to the remote MCP URL if provided. Use the client’s available actions to query indicators, retrieve node details, and monitor specific threat data sources like Darkweb Tracker, Telegram Tracker, Credential Lookout, and others.

How to install

Prerequisites: install Python 3.10 or higher and obtain StealthMole API credentials (access_key and secret_key). If you plan to deploy via Smithery, also obtain a Smithery API key.

# Development setup
uv sync

# Run the server in development mode
uv run dev

# Test interactively in playground
uv run playground

To run in production mode locally, use the production start command shown here.

# Production mode
uv run start

# Development mode with auto-reload
uv run dev

Using with Claude Desktop

Add a configuration entry to Claude Desktop to start your MCP server locally. The example below demonstrates how to point Claude to run the StealthMole MCP server using the uv runner and a local path.

{
  "mcpServers": {
    "stealthmole": {
      "command": "uv",
      "args": [
        "--directory",
        "/absolute/path/to/stealthmole-mcp",
        "run",
        "start"
      ],
      "env": {
        "STEALTHMOLE_ACCESS_KEY": "your_access_key",
        "STEALTHMOLE_SECRET_KEY": "your_secret_key"
      }
    }
  }
}

Configuration notes

Environment variables shown here are required for authentication with the StealthMole service. Keep credentials secure by loading them from your environment or a secure configuration store. Rotate keys periodically and monitor API usage for unusual activity.

Security

Keep your API credentials secure and do not commit them to version control. Use environment variables or a secure vault for sensitive values. Regularly review and rotate keys, and enable monitoring to detect anomalous usage patterns.

Support

If you need help, reach out to StealthMole API support and reference the MCP interface for programmatic queries, quota checks, and threat data access.

Available tools

dt_search_targets

Retrieve a list of searchable targets for a given Darkweb Tracker indicator such as keyword, email, domain, ip, or other indicators.

dt_search_target

Search for a specific indicator and target set with a text query and limit the number of results.

dt_search_all

Search across all targets for a given indicator to obtain a broad results set.

dt_get_node_details

Fetch detailed information for a specific node from a search result, including data sources and URLs.

tt_search_targets

Get searchable targets for Telegram indicators like keywords, channels, or users.

tt_search_target

Search Telegram for specified targets with a text query and limit.

tt_get_node_details

Obtain detailed information for a Telegram node from search results.

cl_search

Query leaked credentials with filters such as domain, email, id, password, and time range.

cds_search

Search infected device leaks with indicators like domain, url, email, id, password, and other fields.

cds_get_node_details

Retrieve detailed information for a CDS node, including device data.

cb_search

Search for ID/Password combo leaks with optional filters and limits.

ub_search

Search URL-Login-Password format leaks with optional filters and limits.

rm_search

Monitor ransomware group breach incidents with optional torurl or domain filters and ordering.

gm_search

Monitor threats against government sector with optional filters and ordering.

lm_search

Monitor threats against enterprise sector with optional filters.

get_user_quotas

Query current API usage quotas and limits for the authenticated user.