Security & Testing

blackdome.ai

An MCP server for security threat intelligence that exposes tools to look up attacker IPs, list top attackers, retrieve geolocated attack maps and heatmaps, and preview recently captured credentials.

1 endpoint26 known toolsFirst detected July 25, 2026Last detected October 10, 2026

ENDPOINT 1

https://api.blackdome.ai/mcp

No auth detected

MCP server metadata

Name: BlackDome
Version: 0.4.0

Capabilities

experimentalpromptsresourcestools

Server instructions

BlackDome provides live threat intelligence harvested from a global fleet of honeypots and edge sensors. Use these tools to look up attacker IPs, browse indicators of compromise (IOCs), inspect captured credentials and malware payloads, profile threat actors, and render a real-time global attack map. Free public tools require no API key; credential, payload, actor, warboard and STIX-export tools require a paid plan key. Captured passwords from the free attacker lookup are masked; the paid credential tools return the full intelligence.

Known tools 26

lookup_attacker_ip

Look up a single attacker IP — events, protocols, credentials, MITRE (free, passwords masked).

Inferred read-only

top_attackers

List the most active attacker IPs over a window — pick a busy IP to drill into (free).

Inferred read-only

attack_map

Get recent geolocated attack events for a live global attack map (free).

Inferred read-only

attack_heatmap

Get a country-aggregated attack heatmap with lat/lon centroids (free).

Inferred read-only

credential_preview

Preview recently captured credentials with aggregate teaser counts (free, masked server-side).

Inferred read-only

verify_sigil

Verify a BlackDome Sigil / audit record by its id (free).

Inferred read-only

recent_iocs

Browse recent indicators of compromise (IOCs) from the honeypot fleet (free).

Inferred read-only

ioc_trends

Get aggregated IOC trends — totals, by-type/severity, daily new, top MITRE (free).

Inferred read-only

export_iocs

Export the IOC threat-intel feed as json, csv (free) or stix (Pro+).

Inferred read-only

search_credentials

Search the global captured-credential corpus with PLAINTEXT passwords (paid: credential_intel).

Inferred read-only

credential_stats

Get aggregate credential statistics — top usernames/passwords, protocol breakdown (paid: credential_intel).

Inferred read-only

list_payloads

List captured malware payloads, or fetch one payload's full record by sha256 (paid: api_access).

Inferred read-only

get_actor

List threat actors with risk/geo enrichment, or fetch one actor's sessions (paid: api_access).

Inferred read-only

warboard

Get the warboard leaderboard of earned Sigils with intrusion narratives (paid: api_access).

Inferred read-only

list_notable_sessions

List rare hand-keyed attacker sessions ranked by score (candidate Enterprise/OEM pilot session_intel).

Inferred read-only

get_session_transcript

Get a structured attacker session transcript (candidate Enterprise/OEM pilot session_intel).

Inferred read-only

list_detonations

List malware detonation reports with IOC counts and file classification (paid: Pro detonation_intel).

Inferred read-only

get_detonation_report

Get a full malware detonation report (paid: Pro detonation_intel).

Inferred read-only

get_artifact

Get an artifact dossier with linked detonation, IOCs and session reference (paid: Pro detonation_intel).

Inferred read-only

whoami

Check your BlackDome tenant identity, plan, features and live quota (any valid key).

Inferred read-only

explain_ioc

Explain observed evidence for an IP, domain, or URL (Analyst: ioc_explanation).

Inferred read-only

compare_samples

Compare two samples deterministically (Pro: sample_compare).

Inferred read-only

get_evidence_cluster

Get a bounded evidence cluster (Pro: genome_clusters).

Inferred read-only

get_reproducible_novelty

Get a reproducible novelty assessment (Pro: reproducible_novelty).

Inferred read-only

get_threatdrop_case

Get an account-bound sanitized ThreatDrop case (ThreatDrop API access).

Inferred read-only

get_takedown_status

Get account-bound ThreatDrop case state and takedown-workflow status.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.blackdome]
url = "https://api.blackdome.ai/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "blackdome": {
      "type": "http",
      "url": "https://api.blackdome.ai/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: blackdome
Remote MCP URL: https://api.blackdome.ai/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "blackdome": {
      "url": "https://api.blackdome.ai/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "blackdome": {
      "type": "http",
      "url": "https://api.blackdome.ai/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "blackdome",
  "transport": "streamable-http",
  "url": "https://api.blackdome.ai/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Trust Data Available

BuiltWith Trust API v2 evidence for blackdome.ai was fetched 2026-10-15T02:56:33.822Z.

Trust status Trusted

blackdome.ai is assessed as Trusted: Domain runs a meaningful technology spend, consistent with a real business.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.