DarkWebSonar

DarkWebSonar brings live dark-web threat intelligence into Claude. Ask in plain language who a ransomware group is targeting, how many leak-site posts hit an industry or country over a rolling window, or whether a client organisation has appeared on a leak site recently. It's built for MSPs and security teams who brief clients on threats.

The connector has 10 read-only tools. They search and profile threat actors, recommend the actors most relevant to an industry and country, count and list leak-site and intelligence entries with filters for victim organisation, site, industry, and country, and map MITRE ATT&CK technique IDs to their names and tactics. Nothing is written back to your account.

You sign in with OAuth and paste your DarkWebSonar API key on our authorization screen, so the key never sits in a config file. The connector is included with the Pro and Enterprise plans, and each tool call uses one request from your monthly API credits. It doesn't look up leaked credentials or monitored-account data. Continuous domain monitoring and alerts stay in the DarkWebSonar platform.