BlackDome Threat Intel

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/blackdome-ai-blackdome-mcp

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools

19 read · 0 write · 0 delete · 1 not yet classified

Secrets

1 (API keys, tokens or passwords)

Install scripts

Not scanned yet

Runs as

Python package

Tools (20)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• attack_heatmap

  Get a country-aggregated attack heatmap with lat/lon centroids (free). Returns per-country attack and unique-IP counts with centroid coordinates, plus a 7-day summary. NOTE: limit minimum is 5 (lower values return 422). Args: limit: Max countries to return (minimum 5, default 5)

• attack_map

  Get recent geolocated attack events for a live global attack map (free). Returns individual attack events with source IP, protocol, country/city and latitude/longitude, plus a 24h summary. Unlike the aggregate tools, this endpoint DOES populate geo. NOTE: limit minimum is 10 (lower values return 422), so the default is 10. Args: limit: Max events to return (minimum 10, default 10)

• credential_preview

  Preview recently captured credentials with aggregate teaser counts (free, masked server-side). Returns a small sample of recently captured credentials (passwords already masked to '****' server-side) plus aggregate totals (recent_total, total_captured, protocol_count). Use search_credentials (paid) for the full plaintext corpus. Args: limit: Max sample credentials to return (default 5) hours: Lookback window in hours (default 24)

• credential_stats

  Get aggregate credential statistics — top usernames/passwords, protocol breakdown (paid: credential_intel). Returns totals (unique credentials/ips/usernames), cross-protocol counts and top usernames/passwords from the shared global dataset. Requires the credential_intel feature (Enterprise/OEM or the Credential Intelligence plan). Args: since: ISO timestamp lower bound protocol: Scope stats to a single protocol (e.g. "ssh")

• export_iocs

  Export the IOC threat-intel feed as json, csv (free) or stix (Pro+). Branches on format: json returns a flat {feed, generated_at, count, iocs[]} object; csv returns the raw CSV text body; stix returns a STIX 2.1 bundle (requires the stix_export feature — Pro plan or higher). json and csv work on the free community tier. The feed is tenant-scoped when authenticated. Args: fmt: Output format — "json", "csv", or "stix" (default "json") ioc_type: Filter by IOC type (e.g. "sha256", "ipv4") min_confidence: Minimum confidence 0-100 (default 50; pass 0 for full set) min_severity: Min…

• get_actor

  List threat actors with risk/geo enrichment, or fetch one actor's sessions (paid: api_access). With no actor_id this lists clustered actors (risk level/score, geo, techniques, sophistication, event counts). With an actor_id it returns that actor's session list. Actor clustering is only surfaced on this keyed endpoint (the free lookup returns actor_id=null). Args: actor_id: Optional actor id — when given, returns that actor's sessions limit: Max actors/sessions to return (default 20) risk: Filter by risk level (e.g. "medium") sort: Sort field (e.g. "risk") descending: Sort…

• get_artifact

  Get an artifact dossier with linked detonation, IOCs and session reference (paid: Pro detonation_intel). Returns artifact classification fields, linked detonation summary, iocs[], and dropped_by_session identifiers/counts only. It does not request or return transcript command text or output_preview fields. Requires the detonation_intel feature (Pro/Enterprise/OEM). Args: sha256: Artifact sha256 to inspect

• get_detonation_report

  Get a full malware detonation report (paid: Pro detonation_intel). Returns detonation_id, sha256, verdict, started_at, finished_at, metadata, report_available, report_unavailable_reason, report_body, iocs[] and artifact classification fields. report_available=false is returned when a report file is missing, absent or too large. Requires the detonation_intel feature (Pro/Enterprise/OEM). Args: detonation_id: Detonation id returned by list_detonations

• get_session_transcript

  Get a structured attacker session transcript (paid: Enterprise session_intel). Returns {session, steps, total_steps, truncated}. The session object includes session_id, actor_id, ip, geo, edge_id, primary_tactic, start_ts, end_ts, persona_stage, persona_score and dropped_artifacts. Each step includes seq, ts, command, output_preview, exit_code, cwd, latency_ms, techniques and guard_triggered. Requires the session_intel feature (Enterprise/OEM). Args: session_id: Session id returned by list_notable_sessions limit: Max transcript steps to return (default 500, capped at 1000) offset…

• ioc_trends

  Get aggregated IOC trends — totals, by-type/severity, daily new, top MITRE (free). Returns trend aggregates over the window: total IOCs, high-severity and malicious counts, breakdowns by type and severity, daily new-IOC counts and the top MITRE techniques. Bounded by the same 72h community freshness delay as recent_iocs. Args: days: Lookback period in days (default 7, max 90 on this endpoint)

• list_detonations

  List malware detonation reports with IOC counts and file classification (paid: Pro detonation_intel). Returns a flat object with count and detonations[]. Each detonation includes detonation_id, sha256, verdict, finished_at, vm_type, magika_label and ioc_count. Requires the detonation_intel feature (Pro/Enterprise/OEM). Args: verdict: Filter by verdict (e.g. "malware", "benign", "suspicious") vm_type: Filter by sandbox VM type sha256: Filter by artifact sha256 since: ISO timestamp lower bound limit: Max detonations to return (default 100, capped at 100)

• list_notable_sessions

  List rare hand-keyed attacker sessions ranked by score (paid: Enterprise session_intel). Returns a flat object with count and sessions[]. Each session includes session_id, actor_id, ip, geo, command_count, distinct_techniques, primary_tactic, persona_stage, persona_score, score, first_ts, last_ts, novelty, dropped_artifact_count, edge_id and human_likely. Use this to surface the most interesting hands-on-keyboard intrusions out of botnet probe noise. Requires the session_intel feature (Enterprise/OEM). Args: min_commands: Minimum command count (default 3) since: ISO timestamp lower b…

• list_payloads

  List captured malware payloads, or fetch one payload's full record by sha256 (paid: api_access). With no sha256 this lists payload artifacts with summary stats. With a sha256 it returns that artifact's full envelope (artifact + detonation + VirusTotal/MalwareBazaar intel + actor); a live VT/MB lookup runs so an unknown hash still returns a structured record. Reference hashes are discoverable free via recent_iocs ioc_value. Args: sha256: Optional payload sha256 — when given, returns that payload's detail limit: Max payloads in list mode (default 20)

• lookup_attacker_ip

  Look up a single attacker IP — events, protocols, credentials, MITRE (free, passwords masked). Returns the full honeypot dossier for an IP present in the event store: session/event counts, first/last seen, protocols, a daily timeline, credentials attempted (passwords MASKED to '********'), MITRE ATT&CK techniques, the edge nodes that saw it, and recent events. A 404 means the IP has no recorded events. Args: ip: The attacker IP address to look up (e.g. "176.65.139.56")

• recent_iocs

  Browse recent indicators of compromise (IOCs) from the honeypot fleet (free). Returns redacted IOCs (sha256/ipv4/domain/url/...) with confidence, severity, verdict, MITRE tactics/techniques, tags, and sighting counts from the public community preview. Values are redacted and the feed carries a 72h freshness delay; up to 25 rows per request. Filters: ioc_type and severity only — value search, verdict/confidence/MITRE filtering, and pagination require a paid plan key (https://blackdome.ai/pricing). Args: ioc_type: Filter by IOC type (e.g. "sha256", "ipv4", "domain", "url") severity: Fi…

Signals

Stars

1

Forks

0

Open issues

0

Weekly downloads

45

Last commit

Aug 11, 2026 (2 months ago)

Last release

Aug 6, 2026 (2 months ago)

Last package publish

Aug 11, 2026 (2 months ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name

io.github.blackdome-ai/blackdome-mcp

Version

0.2.2

Auth

API key

Packages

pypi blackdome-mcp

License

MIT

Repository

github.com/blackdome-ai/blackdome-mcp

Website

blackdome.ai

First seen

Oct 24, 2026

Last checked

Nov 1, 2026

Source

Official MCP Registrygithub-graphql