# DarkStrata

> DarkStrata is a stolen-credential monitoring and dark-web surveillance platform. It detects compromised credentials in infostealer logs, notifies affected employees privately, and helps organisations remediate. AI agents can drive the full platform over the Model Context Protocol (MCP) or the REST API.

## MCP Server

DarkStrata exposes its capabilities to AI agents through a hosted MCP server over Streamable HTTP. Connect any MCP-compatible client (Claude Desktop, Claude Code, Cursor) to it.

- Endpoint: `https://mcp.darkstrata.io/mcp` (Streamable HTTP transport)
- Auth: `x-api-key: <YOUR_API_KEY>`
- Capabilities: 40+ tools, live resources, and guided investigation prompts across alerts, assets, credential check, data intelligence, groups, incident response, Lens, organisations, STIX/TAXII, and usage.

Client config (Claude Code / Claude Desktop / Cursor):

```json
{
  "mcpServers": {
    "darkstrata": {
      "url": "https://mcp.darkstrata.io/mcp",
      "headers": {
        "x-api-key": "<YOUR_API_KEY>"
      }
    }
  }
}
```

## Endpoints

- REST API base: `https://api.darkstrata.io` - full OpenAPI-documented REST surface.
- MCP server: `https://mcp.darkstrata.io/mcp` - same capabilities for AI agents.
- `GET /v1/credential-check/query?prefix=<first 5-6 hex of SHA256(email:password)>` - check a credential against breach data using k-anonymity (no plaintext leaves the client).
- `GET /v1/alerts` - list security alerts with severity/status filtering.
- `GET /v1/data-intelligence/query` - query credential exposure data across monitored domains.

See the full, authoritative endpoint reference at https://docs.darkstrata.io.

## Authentication

All API and MCP requests authenticate with an API key sent in the `x-api-key` header. Generate one from your account at https://app.darkstrata.io/integrations/api-keys and send it as `x-api-key: <YOUR_API_KEY>`.

## Docs

- [API Reference](https://docs.darkstrata.io) - every REST endpoint with parameters and schemas.
- [SDKs](https://github.com/darkstrata/darkstrata-sdks) - official Credential Check client libraries for Node.js, Python, Rust, Go, C#, Java and PHP.
- [Umbraco Package](https://darkstrata.io/en/docs/umbraco/) - blocks compromised passwords and logins for Umbraco members and backoffice users; one NuGet install.
- [Laravel Integration](https://darkstrata.io/en/docs/laravel/) - blocks compromised logins and passwords in Laravel 11-13; bundled with the PHP SDK, auto-discovered.
- [Splunk Add-on](https://darkstrata.io/en/docs/splunk/) - Technology Add-on that ingests credential-exposure intelligence into Splunk and Enterprise Security.
- [Webhook Signatures](https://darkstrata.io/en/docs/webhooks/) - verify the HMAC-SHA256 X-DarkStrata-Signature on webhook deliveries and dedupe retries by X-DarkStrata-Event-Id.
- [Directory Sync](https://darkstrata.io/en/docs/directory-sync/) - sync monitored staff hourly from Google Workspace or Microsoft Entra ID, or manage group members by CSV and the Groups API.
- [MCP Server](https://darkstrata.io/en/mcp/) - connect AI agents to DarkStrata.
- [Credential Check APIs](https://darkstrata.io/en/credential-check-apis/) - k-anonymity breach lookups.
- [SIEM Integrations](https://darkstrata.io/en/siem-integrations/) - STIX/TAXII, CEF, and LEEF feeds.
- [MITRE ATT&CK Mapping](https://darkstrata.io/en/mitre-attack/) - the ATT&CK techniques (observed or inferred) tagged on every credential exposure finding, with a Navigator layer.
- [Stolen Data Monitoring](https://darkstrata.io/en/stolen-data-monitoring/) - what DarkStrata monitors and why.
- [Dark Web Monitoring](https://darkstrata.io/en/dark-web-monitoring/) - continuous monitoring of forums, marketplaces, and Telegram for exposed credentials.
- [DarkStrata In Your Stack](https://darkstrata.io/en/in-your-stack/) - complementary credential-intelligence feed for your SIEM, SOAR, MDR, or CTI platform; multi-tenant and white-label for MSSPs.
- [MSSP Partners](https://darkstrata.io/en/mssp/) - white-label dark web monitoring for MSSPs and MSPs: multi-tenant console, co-branded reporting, CNAME support.

## Guides

- [What Are Infostealers?](https://darkstrata.io/en/what-are-infostealers/) - how infostealer malware harvests credentials and how to defend against it.
- [Data Breach Response](https://darkstrata.io/en/guides/data-breach-response/) - UK incident-response guide, from first-hour actions to the ICO's 72-hour reporting rule.
- [Red Team Intelligence](https://darkstrata.io/en/red-team-intelligence/) - using exposed-credential data in offensive security engagements.
- [Blog](https://darkstrata.io/en/blog/) - threat intelligence and credential-security analysis.
- [Resource Hub](https://darkstrata.io/en/resources/) - all guides, research, and integration documentation in one place.
- [RSS feed](https://darkstrata.io/rss.xml) - subscribe to new posts.

## Examples

Query the MCP server for a security posture overview (any MCP client):

    > use the darkstrata security-posture-overview tool

Check a credential exposure over REST:

    curl https://api.darkstrata.io/v1/data-intelligence/query \
      -H "x-api-key: $DARKSTRATA_API_KEY" \
      -G --data-urlencode "keyword=acme-corp.io"

List active critical alerts:

    curl "https://api.darkstrata.io/v1/alerts?severity=CRITICAL&status=ACTIVE" \
      -H "x-api-key: $DARKSTRATA_API_KEY"