{"name":"DarkStrata","description":"Stolen-credential monitoring and dark-web surveillance. Query alerts, monitored assets, compromised credentials, incident response, STIX/SIEM exports and usage for your organisation. Each skill is one DarkStrata MCP tool; send {\"tool\": \"<skill id>\", \"arguments\": {...}} as a data part.","supportedInterfaces":[{"url":"https://mcp.darkstrata.io/a2a","protocolBinding":"JSONRPC","protocolVersion":"1.0"}],"provider":{"url":"https://darkstrata.io","organization":"DarkStrata"},"version":"1.0.0","documentationUrl":"https://darkstrata.io/auth.md","capabilities":{"streaming":false,"pushNotifications":false},"securitySchemes":{"apiKey":{"apiKeySecurityScheme":{"description":"DarkStrata API key. Create one at https://app.darkstrata.io/integrations/api-keys","location":"header","name":"x-api-key"}}},"securityRequirements":[{"schemes":{"apiKey":{}}}],"defaultInputModes":["application/json","text/plain"],"defaultOutputModes":["text/plain","application/json"],"skills":[{"id":"alerts-list","name":"alerts-list","description":"List alerts with filtering and pagination. Returns security alerts for monitored domains. Each alert carries `mitre`: the MITRE ATT&CK techniques and malware (software) its evidence supports, each marked observed or inferred, stamped when the alert was raised (null for older alerts).","tags":["alerts"],"inputModes":["application/json"]},{"id":"alerts-get","name":"alerts-get","description":"Get detailed information about a specific alert by its ID. Each alert carries `mitre`: the MITRE ATT&CK techniques and malware (software) its evidence supports, each marked observed or inferred, stamped when the alert was raised (null for older alerts).","tags":["alerts"],"inputModes":["application/json"]},{"id":"alerts-get-stats","name":"alerts-get-stats","description":"Get aggregate alert statistics: counts by status, severity breakdown, and recent trends.","tags":["alerts"],"inputModes":["application/json"]},{"id":"alerts-attack-summary","name":"alerts-attack-summary","description":"Get MITRE ATT&CK coverage of the organisation's alerts over the last 90 days: distinct alert counts per tactic (matrix order) and per technique (most alerts first). Use it to answer which tactics and techniques recent alerts evidence; pass a tactic or technique id to alerts-list to drill in.","tags":["alerts"],"inputModes":["application/json"]},{"id":"alerts-update-status","name":"alerts-update-status","description":"Update the status of an alert (e.g. acknowledge or close it).","tags":["alerts"],"inputModes":["application/json"]},{"id":"alerts-delete","name":"alerts-delete","description":"Permanently delete an alert. This action cannot be undone.","tags":["alerts"],"inputModes":["application/json"]},{"id":"assets-list","name":"assets-list","description":"List monitored domain assets with filtering and pagination.","tags":["assets"],"inputModes":["application/json"]},{"id":"assets-get","name":"assets-get","description":"Get detailed information about a specific domain asset.","tags":["assets"],"inputModes":["application/json"]},{"id":"assets-get-stats","name":"assets-get-stats","description":"Get aggregate asset statistics: total, verified, unverified counts.","tags":["assets"],"inputModes":["application/json"]},{"id":"assets-register","name":"assets-register","description":"Register a new domain asset for monitoring. Provide the hostname (apex domain or subdomain). A domain past the plan allowance is chargeable: the call is refused with HTTP 402 and the price until accept_extra_charge is true. Ask the user before confirming.","tags":["assets"],"inputModes":["application/json"]},{"id":"assets-register-bulk","name":"assets-register-bulk","description":"Register multiple domain assets in a single operation. Domains past the plan allowance are chargeable: the call is refused with HTTP 402 and the price until accept_extra_charge is true. Ask the user before confirming.","tags":["assets"],"inputModes":["application/json"]},{"id":"assets-delete","name":"assets-delete","description":"Remove a domain asset from monitoring. This action cannot be undone.","tags":["assets"],"inputModes":["application/json"]},{"id":"assets-delete-bulk","name":"assets-delete-bulk","description":"Remove multiple domain assets from monitoring. This action cannot be undone.","tags":["assets"],"inputModes":["application/json"]},{"id":"assets-resubmit-dns","name":"assets-resubmit-dns","description":"Re-trigger DNS verification for an asset. Useful after updating DNS records.","tags":["assets"],"inputModes":["application/json"]},{"id":"data-intelligence-query","name":"data-intelligence-query","description":"Query credential exposure data with comprehensive filtering. Returns paginated records including stealer_intel (stealer_family, has_critical_files) when stealer malware metadata is present, plus a provenance block per row (label, matched_corpora_count, earliest_match_year, combolist_confidence), a base_level on threat_score so the read-time provenance modifier is transparent, and a mitre block per row (MITRE ATT&CK techniques and software the record evidences).","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-get","name":"data-intelligence-get","description":"Get detailed information about a specific credential exposure identifier. Response includes threat_intelligence with is_stealer_infected, stealer_risk_level, base_threat_score (raw score from scoring worker) and current_threat_score (provenance-adjusted: combolist findings downweight, confirmed-reuse upweight) fields, plus full stealer_intel metadata and a top-level provenance block (label, matched_corpora_count, earliest_match_year, combolist_confidence) summarising whether the stealer record looks like fresh infection or possible combolist replay.","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-get-stats","name":"data-intelligence-get-stats","description":"Get data intelligence statistics: total exposures, threat score distribution, monthly trends, enrichment metrics, and (OUTBOUND) provenance counts (verified_fresh, matched_to_breach_data, full label breakdown).","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-hostnames","name":"data-intelligence-hostnames","description":"List the hostnames on your monitored domains where customer accounts were captured, with match counts. Needs the Customer Protection add-on (403 without it).","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-get-actions","name":"data-intelligence-get-actions","description":"Get recommended actions for a credential exposure identifier. Returns standard actions plus dynamic stealer response actions (e.g. rotate_ssh_keys, revoke_sessions) based on exfiltrated data capabilities. Actions differ by flow: OUTBOUND (staff) vs INBOUND (customer).","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-update-actions","name":"data-intelligence-update-actions","description":"Update the configured actions for a specific credential exposure identifier.","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-generate-summary","name":"data-intelligence-generate-summary","description":"Generate an AI executive summary of a credential exposure identifier's risk profile. Returns a 3-5 sentence risk overview with caching.","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-breaches-query","name":"data-intelligence-breaches-query","description":"List third-party-breach OUTBOUND exposures (BreachExposure rows) with filtering and pagination. Includes corpus_is_combolist, PII presence flags, password_strength_score, and breach_threat_score_level_id. Response is a discriminated union on `mode`: by default `mode=rows` (one row per exposure); when `group_by=identifier` is set, `mode=identifiers` (one row per identifier with aggregated counts; filters apply pre-group, e.g. threat_scores=5 returns identifiers whose at-least-one child exposure is level 5).","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-breaches-stats","name":"data-intelligence-breaches-stats","description":"Aggregate stats over third-party-breach OUTBOUND exposures: counts by status / threat score / combolist-vs-genuine, distinct identifiers, distinct corpora, and rows with recovered plaintext passwords.","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-events-query","name":"data-intelligence-events-query","description":"List OUTBOUND credential-exposure events — one row per domain_data_matches (identifier ⇄ service accessed), ordered by per-event criticality (threat_score_level_id 1-5). The \"by exposure event\" counterpart to the identifier-grouped explorer list. Each event carries the service accessed, source / stealer family, identifier status, last_seen, service classification (supply-chain category / asset group / monitored asset), and password metadata (count, has_plaintext flag, strength band 0-4) — never the plaintext password.","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-events-stats","name":"data-intelligence-events-stats","description":"Distribution stats for the OUTBOUND credential-events view: total, critical vs not-critical (score 5 vs <5), counts by state (identifier status), service classification, and stealer family.","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-naming-rules","name":"data-intelligence-naming-rules","description":"List the organisation's active naming rules (asset hostname, direction, rule_type, pattern, optional custom_regex). Used by the explorer's Unmatched-tab breakdown to explain which rules are filtering the view. Optionally scope by flow direction and a single asset public_id.","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-breaches-update-status","name":"data-intelligence-breaches-update-status","description":"Update the status on a single third-party-breach exposure. Mirrors stealer-side status semantics (NEW/RESOLVED/IGNORED/FALSE_POSITIVE/RE_EMERGED).","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-breaches-bulk-status","name":"data-intelligence-breaches-bulk-status","description":"Bulk-update status across breach exposures. Provide exactly one of public_ids (direct list) OR identifier_groups (each entry fans out to every child exposure matching identifier+asset within the org — the entry-point used by the grouped/identifiers view). Returns affected row count.","tags":["data"],"inputModes":["application/json"]},{"id":"data-intelligence-malware-family-profile","name":"data-intelligence-malware-family-profile","description":"Get an AI-generated threat intelligence profile for a stealer malware family. Includes overview, distribution methods, capabilities, and indicators. Results are cached for 30 days.","tags":["data"],"inputModes":["application/json"]},{"id":"incident-response-request","name":"incident-response-request","description":"Request a new credential data export for incident response. Requires domain ownership verification and attestation details. This is a partner-verified feature: it is not available on standard plans and must be enabled by DarkStrata for the organisation — a 403 means the organisation is not an approved partner (contact hello@darkstrata.io).","tags":["incident"],"inputModes":["application/json"]},{"id":"incident-response-list","name":"incident-response-list","description":"List credential data export requests with filtering and pagination.","tags":["incident"],"inputModes":["application/json"]},{"id":"incident-response-get","name":"incident-response-get","description":"Get detailed information about a specific credential data export request.","tags":["incident"],"inputModes":["application/json"]},{"id":"incident-response-get-stats","name":"incident-response-get-stats","description":"Get incident response export statistics: counts by status, recent activity.","tags":["incident"],"inputModes":["application/json"]},{"id":"incident-response-list-pgp-keys","name":"incident-response-list-pgp-keys","description":"List the organisation's PGP public keys. Use a key's id as pgp_key_id when requesting a PGP-encrypted export.","tags":["incident"],"inputModes":["application/json"]},{"id":"incident-response-add-pgp-key","name":"incident-response-add-pgp-key","description":"Add a PGP public key to the organisation for encrypting PGP-method exports. An organisation may hold several keys. Provide an ASCII-armoured public key.","tags":["incident"],"inputModes":["application/json"]},{"id":"incident-response-remove-pgp-key","name":"incident-response-remove-pgp-key","description":"Remove one of the organisation's PGP public keys. Past exports remain encrypted with the key they were created with.","tags":["incident"],"inputModes":["application/json"]},{"id":"groups-list","name":"groups-list","description":"List identity groups with filtering and pagination.","tags":["groups"],"inputModes":["application/json"]},{"id":"groups-get","name":"groups-get","description":"Get detailed information about a specific group including member count.","tags":["groups"],"inputModes":["application/json"]},{"id":"groups-create","name":"groups-create","description":"Create a new identity group for organising monitored identities.","tags":["groups"],"inputModes":["application/json"]},{"id":"groups-update","name":"groups-update","description":"Update an existing group's name, description, or configuration.","tags":["groups"],"inputModes":["application/json"]},{"id":"groups-delete","name":"groups-delete","description":"Delete a group. This action cannot be undone.","tags":["groups"],"inputModes":["application/json"]},{"id":"groups-list-members","name":"groups-list-members","description":"List the members of a group with filtering and pagination.","tags":["groups"],"inputModes":["application/json"]},{"id":"groups-add-members","name":"groups-add-members","description":"Add members to a group (or replace the full membership with mode=replace). Members are identifiers such as email addresses, usernames, or hostnames.","tags":["groups"],"inputModes":["application/json"]},{"id":"groups-update-member","name":"groups-update-member","description":"Update a group member's display name, status, or external reference.","tags":["groups"],"inputModes":["application/json"]},{"id":"groups-remove-member","name":"groups-remove-member","description":"Remove a member from a group.","tags":["groups"],"inputModes":["application/json"]},{"id":"groups-move-members","name":"groups-move-members","description":"Move members from one group to another.","tags":["groups"],"inputModes":["application/json"]},{"id":"credential-check-stats","name":"credential-check-stats","description":"Get credential check database statistics: total unique records, total records, and last update timestamp.","tags":["credential"],"inputModes":["application/json"]},{"id":"stix-export-alerts","name":"stix-export-alerts","description":"Export alerts as STIX 2.1 bundles for Splunk ES and threat intelligence platforms. Use format=\"splunk\" for Splunk ES observed-data format. Infostealer and breach findings both export, tagged with MITRE ATT&CK techniques. Supports incremental fetching via the \"since\" parameter.","tags":["stix"],"inputModes":["application/json"]},{"id":"stix-export-alert","name":"stix-export-alert","description":"Export a specific alert as a STIX 2.1 bundle (report first, then the extension definition and indicators). Indicators carry MITRE ATT&CK kill_chain_phases, technique external_references and x_darkstrata_credential.mitre; Splunk-format observed-data carries mitre:<technique id> labels.","tags":["stix"],"inputModes":["application/json"]},{"id":"stix-export-indicators","name":"stix-export-indicators","description":"Export STIX 2.1 indicators for Splunk ES and threat intelligence platforms (MISP, OpenCTI, ThreatConnect). Each indicator carries MITRE ATT&CK kill_chain_phases and technique references. For incremental sync pass cursor (empty on the first call): indicators then come back oldest first, each exactly once; pass the returned next cursor each time.","tags":["stix"],"inputModes":["application/json"]},{"id":"siem-export-events","name":"siem-export-events","description":"Export credential exposure events in CEF or LEEF format for SIEM ingestion. CEF is supported by ArcSight, Microsoft Sentinel, and most SIEMs. LEEF is the native format for IBM QRadar. Covers infostealer findings. Each event carries its MITRE ATT&CK technique and tactic IDs and the infostealer family ATT&CK Software ID (CEF cs6/flexString1/flexString2, LEEF mitreTechniques/mitreTactics/malwareFamily), and the CEF Device Event Class ID names the finding class (credential-exposure:stealer-fresh, stealer-reuse, combolist, breach or stealer). Events come back oldest first, each exactly once: omit cursor to start, then pass the returned next cursor each time.","tags":["siem"],"inputModes":["application/json"]},{"id":"siem-export-alert-events","name":"siem-export-alert-events","description":"Export credential exposure events for a specific alert in CEF or LEEF format. Infostealer and breach findings both export (cat=BREACH / sourceType=BREACH for breach), each with the same MITRE ATT&CK fields as siem-export-events.","tags":["siem"],"inputModes":["application/json"]},{"id":"organisations-list","name":"organisations-list","description":"List organisations accessible to the current API key.","tags":["organisations"],"inputModes":["application/json"]},{"id":"organisations-get","name":"organisations-get","description":"Get detailed information about a specific organisation.","tags":["organisations"],"inputModes":["application/json"]},{"id":"organisations-get-stats","name":"organisations-get-stats","description":"Get organisation-level statistics: asset counts, identifier totals, critical threats.","tags":["organisations"],"inputModes":["application/json"]},{"id":"organisations-update","name":"organisations-update","description":"Update organisation details (name, contact info, address).","tags":["organisations"],"inputModes":["application/json"]},{"id":"organisations-list-tenant-plans","name":"organisations-list-tenant-plans","description":"List the plans an MSP partner can put its customer organisations (tenants) on, with the partner price for each. Use a plan slug with organisations-create or organisations-set-plan. Customer Protection bands (customer-account monitoring, on top of a plan) follow the plans with add_on \"customer_protection\" and their customer_accounts allowance; pass one's slug as customer_protection_slug.","tags":["organisations"],"inputModes":["application/json"]},{"id":"organisations-create","name":"organisations-create","description":"Create a customer organisation (tenant) under an MSP partner and put it on a tenant plan billed to the partner.","tags":["organisations"],"inputModes":["application/json"]},{"id":"organisations-set-plan","name":"organisations-set-plan","description":"Change a tenant organisation's plan, extra domains or Customer Protection band. Billed to its MSP partner, prorated by day.","tags":["organisations"],"inputModes":["application/json"]},{"id":"organisations-generate-api-key","name":"organisations-generate-api-key","description":"Generate an API key for a tenant organisation of an MSP partner. The secret is returned once. Permissions are capped at the calling key's; empty grants everything allowed.","tags":["organisations"],"inputModes":["application/json"]},{"id":"usage-get","name":"usage-get","description":"Get API usage data with optional filtering by key and date range.","tags":["usage"],"inputModes":["application/json"]},{"id":"usage-get-summary","name":"usage-get-summary","description":"Get API usage summary for the current billing period: total calls, active keys, first/last call timestamps.","tags":["usage"],"inputModes":["application/json"]},{"id":"usage-get-by-key","name":"usage-get-by-key","description":"Get API usage breakdown by individual API key.","tags":["usage"],"inputModes":["application/json"]},{"id":"lens-invite-send","name":"lens-invite-send","description":"Send Lens credential review invitations to one or more identifiers. Lens allows end-users to securely review and act on their exposed credentials.","tags":["lens"],"inputModes":["application/json"]},{"id":"webhooks-list","name":"webhooks-list","description":"List the organisation's configured webhooks with their status and last delivery result.","tags":["webhooks"],"inputModes":["application/json"]},{"id":"webhooks-get","name":"webhooks-get","description":"Get full configuration of a webhook: URL, headers, subscribed events, and delivery settings.","tags":["webhooks"],"inputModes":["application/json"]},{"id":"webhooks-list-deliveries","name":"webhooks-list-deliveries","description":"List a webhook's delivery history, newest first: event, status (SUCCESS, FAILED, RETRYING), HTTP status, error, attempts and the endpoint's response. Use it to find out why an endpoint is not receiving events.","tags":["webhooks"],"inputModes":["application/json"]},{"id":"webhooks-list-events","name":"webhooks-list-events","description":"List the catalogue of webhook events that can be subscribed to (e.g. alert.stealer_log.created, alert.breach_exposure.created). Use these event_key values when creating or updating a webhook.","tags":["webhooks"],"inputModes":["application/json"]},{"id":"webhooks-create","name":"webhooks-create","description":"Create a webhook so DarkStrata pushes events (new alerts, exposures, asset changes) to your endpoint. Subscribe to event keys from webhooks-list-events. Alert events carry MITRE ATT&CK tags in data.alert.mitre. Needs an API key granted the opt-in webhooks:write scope (not included by default); otherwise returns 403.","tags":["webhooks"],"inputModes":["application/json"]},{"id":"webhooks-update","name":"webhooks-update","description":"Update a webhook's configuration: URL, subscribed events, enable/disable, headers, or delivery settings. This is a full replace — omitted optional fields reset to defaults (e.g. omitting authentication clears it), so fetch the current config with webhooks-get and send the complete desired state. Needs an API key granted the opt-in webhooks:write scope (not included by default); otherwise returns 403.","tags":["webhooks"],"inputModes":["application/json"]},{"id":"webhooks-delete","name":"webhooks-delete","description":"Permanently delete a webhook and its event subscriptions. This action cannot be undone. Needs an API key granted the opt-in webhooks:delete scope (not included by default); otherwise returns 403.","tags":["webhooks"],"inputModes":["application/json"]},{"id":"webhooks-test","name":"webhooks-test","description":"Send a test event to a webhook to verify the endpoint receives deliveries.","tags":["webhooks"],"inputModes":["application/json"]},{"id":"users-list","name":"users-list","description":"List the organisation's team members with their role, status, and last activity.","tags":["users"],"inputModes":["application/json"]},{"id":"users-list-roles","name":"users-list-roles","description":"List the assignable user roles and their IDs. Use a role ID when inviting a user.","tags":["users"],"inputModes":["application/json"]},{"id":"users-invite","name":"users-invite","description":"Invite a new team member by email. API-key invites can only assign non-administrative roles.","tags":["users"],"inputModes":["application/json"]},{"id":"users-list-invitations","name":"users-list-invitations","description":"List pending, accepted, expired, and revoked team invitations.","tags":["users"],"inputModes":["application/json"]},{"id":"users-resend-invitation","name":"users-resend-invitation","description":"Resend a pending invitation email with a fresh token and a new 7-day expiry.","tags":["users"],"inputModes":["application/json"]},{"id":"users-revoke-invitation","name":"users-revoke-invitation","description":"Revoke a pending invitation so its link can no longer be used.","tags":["users"],"inputModes":["application/json"]},{"id":"users-suspend","name":"users-suspend","description":"Suspend a team member's account, immediately disabling their access. Use for automated response to a compromised account.","tags":["users"],"inputModes":["application/json"]},{"id":"users-unsuspend","name":"users-unsuspend","description":"Restore a suspended team member's account so they can log in again.","tags":["users"],"inputModes":["application/json"]},{"id":"security-posture-overview","name":"security-posture-overview","description":"Comprehensive security posture overview combining alert stats, asset stats, data intelligence stats, and recent critical alerts into a single summary.","tags":["security"],"inputModes":["application/json"]},{"id":"investigate-domain","name":"investigate-domain","description":"Full investigation context for a domain: assets, alerts, and credential exposure data.","tags":["investigate"],"inputModes":["application/json"]},{"id":"triage-alert","name":"triage-alert","description":"Gather all context needed to triage a specific alert: full alert details (including its MITRE ATT&CK `mitre` tags) plus credential exposure data for affected domains.","tags":["triage"],"inputModes":["application/json"]},{"id":"exposure-summary","name":"exposure-summary","description":"Credential exposure summary across all monitored domains: stats, top customer-account hostnames (Customer Protection add-on only), and threat score distribution.","tags":["exposure"],"inputModes":["application/json"]},{"id":"dashboard-exposure-summary","name":"dashboard-exposure-summary","description":"Get headline credential-exposure metrics for the organisation across its verified monitored assets. events (total vs critical), distribution (customers = inbound vs employees = outbound; customers stay 0 without the Customer Protection add-on, because customer accounts are not collected then, so 0 there does not mean none are exposed) and top_services are all derived from infostealer matches. top_services ranks services by exposure volume (distinct identifiers); priority_services ranks them by criticality instead — each entry carries score (the worst per-event threat level 1-5 seen for that service), count (affected distinct identifiers), employees (distinct OUTBOUND identifiers) and customers (distinct INBOUND identifiers), and last_seen (ISO date of the most recent exposure for that service) — surfacing the highest-risk services (monitored assets, critical supply-chain SaaS) to act on first. Under sources, infostealer is the malware-match count while breach counts third-party breach-corpus exposures (breach_exposures) — surfaced for comparison but NOT part of the infostealer event total (breaches carry no employee/customer attribution). Only actionable records (status NEW or RE_EMERGED) are counted; triaged-away records (RESOLVED/IGNORED/FALSE_POSITIVE) are excluded, mirroring the explorer default. Optionally filter by date range, specific assets, and source type.","tags":["dashboard"],"inputModes":["application/json"]}]}