BlackDome Threat Intel

io.github.blackdome-aiPublished by GitHub account blackdome-aiv0.2.0Updated Oct 24, 2026

Live honeypot threat intel: attacker IPs, IOCs, credentials, payloads, actors.

VerifiedSTDIODesktop onlySecurity & MonitoringData & Analytics

Overview

AI-generated overview

BlackDome Threat Intel gives an AI assistant read-only access to live honeypot threat intelligence: attacker IPs, IOCs, credentials, payloads and threat actors.

What you can do
Look up attacker IPs, top attackers, and verify Sigils or audit records by id, with masked credentials in the free dossier view and a masked credential preview sample with teaser totals. Browse and export indicators of compromise, including recent redacted IOCs with type and severity filters, aggregated IOC trends, and JSON, CSV or STIX exports. View geolocated attack events and country-aggregated heatmaps for a live attack map. Inspect captured malware payloads, clustered threat actors, Sigil leaderboards with intrusion narratives, and detonation reports with verdicts and IOCs. Search the credential corpus and read attacker session transcripts on higher paid tiers. Check the tenant, plan, g
When to use it
Use it when an assistant needs current, real-world attack data for security triage, incident investigation, IOC enrichment, SIEM feeds or threat reporting, and when a read-only source is preferred over one that changes data.
Requirements
Runs locally over stdio from the PyPI package blackdome-mcp, typically launched with uvx or pip. No API key is needed for the free community tools; paid tiers need BLACKDOME_API_KEY. Optional BLACKDOME_BASE_URL and BLACKDOME_TIMEOUT. Network access to the BlackDome API is required.
Before you install
Paid tiers require a paid plan, with listed prices from 49 to 5000 dollars, and the key is stored in the client's MCP config. The paid search_credentials tool returns plaintext captured passwords, which are sensitive third-party data. Free tier is limited to about 30 requests per minute and 100 per day, and community IOC data lags 72 hours. All tools are read-only GET requests and the server stores no data.

Installation

In SourceWeft

  1. Open BlackDome Threat Intel in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

BlackDome MCP Server

Give your AI agents direct access to live honeypot threat intelligence. Look up attacker IPs, browse indicators of compromise (IOCs), inspect captured credentials and malware payloads, profile threat actors, and render a real-time global attack map — all from Claude, Cursor, or any MCP-compatible client.

Most tools are free and need no API key (the public community tier). A subset of high-value intelligence requires a paid plan.

Quick Start

Option 1 — Cloud MCP (recommended, no install)

One URL, works in every client that supports remote MCP (Claude Desktop, the claude.ai web app, mobile, Cursor):

https://api.blackdome.ai/mcp

Free tools work with no key. To unlock the paid tiers (credential intelligence, payloads, actors, warboard, STIX export), get an API key at https://blackdome.ai/pricing and add it as an Authorization header:

json
{  "mcpServers": {    "blackdome-cloud": {      "url": "https://api.blackdome.ai/mcp",      "headers": {        "Authorization": "Bearer bd_your_key_here"      }    }  }}

Option 2 — Run it locally

Use uvx (part of uv) — it fetches and runs the server on demand, with no separate install step and no PATH issues:

bash
uvx blackdome-mcp

Prefer a fixed install? pip install blackdome-mcp works too — but note the troubleshooting item at the bottom if your client says "command not found".

The free public tools work with no API key. To unlock the paid tiers, get a key at https://blackdome.ai/pricing.

Claude Desktop

Merge this into claude_desktop_config.json — ~/Library/Application Support/Claude/ on macOS, %APPDATA%\Claude\ on Windows — then restart Claude:

json
{  "mcpServers": {    "blackdome": {      "command": "uvx",      "args": ["blackdome-mcp"],      "env": {        "BLACKDOME_API_KEY": "bd_your_key_here"      }    }  }}

The env block is optional — omit BLACKDOME_API_KEY to run free public tools only.

Claude Code

One command — the key is stored in the MCP config, so there are no shell exports to maintain (a plain export BLACKDOME_API_KEY=... only lasts for that terminal session, and your paid tools would stop working in the next one):

bash
claude mcp add blackdome -e BLACKDOME_API_KEY=bd_your_key_here -- uvx blackdome-mcp

For free tools only:

bash
claude mcp add blackdome -- uvx blackdome-mcp
Cursor

Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project):

json
{  "blackdome": {    "command": "uvx",    "args": ["blackdome-mcp"],    "env": {      "BLACKDOME_API_KEY": "bd_your_key_here"    }  }}

API Key Behavior

  • No key: free community tools work; paid tools return an explicit 401.
  • Invalid key: paid tools (and whoami) fail loudly with 401 Invalid API key — there is no silent fallback to free-tier results. Free tools keep working regardless of key validity.
  • Expired key / cancelled plan: 403 API key has expired / 403 Tenant account is inactive — again explicit errors, not degraded data.
  • Valid key, wrong plan: a tool whose feature your plan does not include returns an explicit 403; check your granted features any time with whoami.

If a paid tool returns less than expected, run whoami first — it reports your plan, features, and live quota.

Available Tools

Free tools work with no key. Paid tools require an API key whose plan includes the listed feature.

ToolTierDescription
lookup_attacker_ipFreeFull dossier for one attacker IP — events, protocols, credentials (passwords masked), MITRE, edge nodes
top_attackersFreeMost active attacker IPs over a window — pick one to drill into
attack_mapFreeRecent geolocated attack events for a live map (limit ≥ 10)
attack_heatmapFreeCountry-aggregated attack heatmap with centroids (limit ≥ 5)
credential_previewFreeSample of recent credentials (masked server-side) + teaser totals
verify_sigilFreeVerify a BlackDome Sigil / audit record by id
recent_iocsFreeBrowse recent redacted IOCs — type/severity filters (72h community delay, 25-row cap)
ioc_trendsFreeAggregated IOC trends — totals, breakdowns, daily new, top MITRE
export_iocsFree (json/csv) · Pro (stix)Export the IOC feed; STIX bundle needs the stix_export feature
search_credentialsEnterprise (credential_intel)Search the global credential corpus with PLAINTEXT passwords
credential_statsEnterprise (credential_intel)Aggregate credential stats — top usernames/passwords, breakdowns
list_payloadsPro (api_access)List captured malware payloads, or fetch one by sha256 (VT/MB intel)
get_actorPro (api_access)List clustered threat actors, or fetch one actor's sessions
warboardPro (api_access)Sigil leaderboard with intrusion narratives + attacker command tails
list_notable_sessionsEnterprise (session_intel)Ranked hand-keyed attacker sessions surfaced out of botnet noise
get_session_transcriptEnterprise (session_intel)Structured command/output transcript for one attacker session
list_detonationsPro (detonation_intel)Malware detonation list with verdicts, Magika labels and IOC counts
get_detonation_reportPro (detonation_intel)Full detonation report with behavior, IOCs, artifact classification and report availability
get_artifactPro (detonation_intel)Artifact dossier with linked detonation, IOCs and session identifiers only
whoamiAny keyCheck your tenant, plan, features and live quota

Plans: Community (free) → Analyst ($49, real-time intel) → Pro ($299, adds stix_export, api_access, detonation_intel) → Enterprise ($2000, adds credential_intel, bulk_api, session_intel) → OEM ($5000). See pricing.

Example Prompts

Once connected, try asking your AI assistant:

  • "Who are the top attackers hitting the honeypots this month?"
  • "Look up attacker IP 176.65.139.56 and summarize what they tried."
  • "Show me the latest malicious sha256 IOCs from the last week."
  • "What are the IOC trends — which MITRE techniques are spiking?"
  • "Render a heatmap of where attacks are coming from."
  • "Export the IOC feed as CSV so I can load it into my SIEM."
  • "What plan am I on and which features do I have?" (runs whoami)
  • "Search captured SSH credentials for the username root." (paid)
  • "Show me the most active hand-keyed attacker sessions this week." (Enterprise)
  • "Pull the detonation report for sha256 a6713518f2e26745683d33ded61b465d0645d7af850464c559fba8bb84e68398." (Pro)

Environment Variables

Local (stdio) server only — the cloud endpoint takes the key as an Authorization: Bearer header instead.

VariableRequiredDefaultDescription
BLACKDOME_API_KEYNo—Bearer API key. Free tools work without it; paid tools require it
BLACKDOME_BASE_URLNohttps://api.blackdome.aiAPI base URL
BLACKDOME_TIMEOUTNo15Request timeout in seconds

Rate Limits

The free community tier is capped at roughly 30 requests/minute and 100 requests/day, and community IOC data carries a 72-hour freshness delay. Paid plans raise these limits substantially (Enterprise: 1000 req/min, 50,000 req/day). When you hit a limit the server returns a clear 429 error with retry timing. Use whoami to see your live quota.

Troubleshooting

  • "command not found" in a GUI client: GUI apps don't load your shell PATH. Easiest fix: use "command": "uvx", "args": ["blackdome-mcp"] as shown above. If you pip-installed instead, run which blackdome-mcp (macOS/Linux) or where blackdome-mcp (Windows) and paste the full path into the command field.
  • Paid tools return 401/403: see API Key Behavior — errors are explicit, and whoami tells you exactly what your key grants.

Security

  • Read-only. Every tool is a GET request — the server never mutates BlackDome data.
  • Keyless free tier. Public tools require no API key and expose only community-tier data.
  • Masked credentials. The free lookup_attacker_ip tool masks captured passwords to ******** before returning them; credential_preview is masked server-side. Plaintext passwords are returned only by the paid search_credentials tool, which requires the credential_intel feature.
  • Secrets stay local. Your API key is read from the environment and sent only to the BlackDome API over HTTPS. No data is stored by the MCP server — it proxies directly to BlackDome.

License

MIT

Source: README.md at commit cc635e3

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts