Traditional dark web intel workflow:
  check breach exposure           ->  HIBP web interface (paid API)
  search leaked credentials       ->  IntelligenceX web interface
  track ransomware groups         ->  ransomware.live + ransomlook.io (2 separate UIs)
  access .onion hidden services   ->  Tor Browser manually
  analyze malware samples         ->  Hybrid Analysis + MalwareBazaar (2 more UIs)
  check IP abuse history          ->  AbuseIPDB + GreyNoise (2 more UIs)
  trace cryptocurrency            ->  blockchain.info + ChainAbuse
  search for exploits             ->  Vulners web interface
  check phishing URLs             ->  PhishTank web interface
  correlate everything            ->  copy-paste into a report
  ────────────────────────────────
  Total: 60+ minutes per investigation, most of it switching contexts

With darknet-mcp-server:
  You: "Investigate the breach exposure and threat landscape for target.com"

  Agent: -> HIBP: 3 known breaches (Adobe 2013, LinkedIn 2021, Collection #1)
         -> ThreatFox: 2 IOCs associated with domain (C2 callback, phishing)
         -> URLhaus: 1 malicious URL hosted on subdomain
         -> Ransomware: No victim listings found (good)
         -> Stealer logs: 47 compromised employee credentials found
         -> OTX: 5 threat pulses referencing the domain
         -> AbuseIPDB: Primary IP has 12 abuse reports (brute force)
         -> "target.com has been in 3 data breaches exposing 2.1M records.
            47 employee credentials found in stealer logs — immediate
            password reset recommended. 2 active ThreatFox IOCs suggest
            ongoing targeting. No ransomware listings, but the abuse
            reports on the primary IP warrant investigation."

You: "Check if example.com has been in any data breaches and look for stealer logs"

You: "Check if example.com has been in any data breaches"

Agent: -> breachList {domain: "example.com"}
       -> breachSearch {account: "admin@example.com"}
       -> stealer_domain {domain: "example.com"}
       -> intelx_search {term: "example.com"}
       -> "example.com appears in 5 known breaches:
          - ExampleDB 2023: 4.2M records (emails, passwords, IPs)
          - Collection #1: credential stuffing list
          - Combolist 2024: 890K email:password pairs
          Stealer logs: 23 compromised machines with saved credentials
          for example.com found in Hudson Rock database.
          IntelligenceX: 47 results across paste sites and dark web."

You: "What ransomware groups are targeting healthcare?"

Agent: -> ransomwareBySector {sector: "healthcare"}
       -> ransomwareRecent {}
       -> ransomlookRecent {}
       -> "Healthcare sector ransomware activity:
          142 victims across 12 groups in the last 12 months.
          Top groups: LockBit3 (38 victims), BlackCat/ALPHV (24),
          Cl0p (19), Royal (15).
          Most recent: MedCorp Inc. listed by LockBit3 (2 days ago).
          3 new healthcare victims in the last week across
          ransomware.live and RansomLook feeds."

You: "Search for mentions of our company on .onion sites"

Agent: -> tor_search_onion {query: "AcmeCorp"}
       -> intelx_search {term: "acmecorp.com"}
       -> onion_lookup {address: "relevant-onion-address.onion"}
       -> "Dark web search results for AcmeCorp:
          Ahmia.fi: 3 .onion pages mention AcmeCorp
          - Forum post discussing AcmeCorp employee list (leak forum)
          - Marketplace listing for AcmeCorp database (unverified)
          - Blog post referencing AcmeCorp breach
          IntelligenceX: 12 results on paste sites
          Recommendation: investigate the forum post and marketplace
          listing for potential active data sales."

You: "Analyze this file hash for malware indicators: abc123def456..."

Agent: -> malware_search {hash: "abc123def456..."}
       -> malware_overview {sha256: "abc123def456..."}
       -> bazaarHash {hash: "abc123def456..."}
       -> threatfoxSearch {searchTerm: "abc123def456..."}
       -> otx_hash {hash: "abc123def456..."}
       -> "Malware analysis for abc123def456:
          Hybrid Analysis: MALICIOUS (threat score 95/100)
          - Family: AgentTesla (info stealer)
          - MITRE ATT&CK: T1555 (Credential Access), T1071 (C2)
          - Network IOCs: 3 C2 domains, 2 IPs
          MalwareBazaar: First seen 2024-03-15, tagged 'AgentTesla'
          ThreatFox: 2 IOC entries linking to same campaign
          OTX: Referenced in 4 threat pulses"

src/
  index.ts                # CLI entrypoint (--help, --list, --check-tor, stdio server)
  protocol/
    mcp-server.ts         # MCP server setup (stdio transport)
    tools.ts              # Tool registry — all 66 tools assembled here
  types/
    index.ts              # Shared types (ToolDef, ToolContext, ToolResult)
  utils/
    rate-limiter.ts       # Per-provider rate limiter
    cache.ts              # TTL cache for API responses
    tor-fetch.ts          # Tor SOCKS5 proxy HTTP client
    require-key.ts        # API key validation helper
  tor/                    # Tor Network tools (7)
  ransomware/             # Ransomware Intelligence tools (9)
  breach/                 # HIBP Breach tools (7)
  abusech/                # ThreatFox + URLhaus + MalwareBazaar tools (9)
  otx/                    # AlienVault OTX tools (5)
  abuseipdb/              # AbuseIPDB tools (4)
  greynoise/              # GreyNoise Community tools (2)
  pulsedive/              # Pulsedive tools (3)
  hudsonrock/             # Hudson Rock stealer log tools (3)
  vulners/                # Vulners exploit tools (3)
  blockchain/             # Blockchain Intelligence tools (4)
  hybrid/                 # Hybrid Analysis malware tools (3)
  onionlookup/            # CIRCL Onion Lookup tool (1)
  intelx/                 # IntelligenceX tools (4)
  phishing/               # PhishTank tool (1)
  meta/                   # Meta tools (1)