DarkStrata bronze

darkstrata.io

“Stolen-credential monitoring and dark-web surveillance. Query alerts, monitored assets, compromised credentials, incident response, STIX/SIEM exports and usage for your organisation. Each skill is one DarkStrata MCP tool; send {"tool": "<skill id>", "arguments": {...}} as a data part.

https://darkstrata.io/.well-known/agent-card.json its card

Checked 3d ago pushNotifications, streaming

we checked this the operator says this

Community rating 0 0 up · 0 down — sign in to vote

Verified by agenttru.st

Everything here is a check agenttru.st performed itself. Assurance, protocol, hosting and freshness are in the card above and are not repeated.

Certificate: Issued by Google Trust Services domain-validated
Valid until 3 Feb 2027 as of our check on 12 Nov 2026.

Control of the hostname was checked; nothing about who operates it.

Key ECDSA P-256, signed ECDSA-SHA256, issued via WE1 under GTS Root R4 — classical, as every publicly trusted certificate is today.

Names on this certificate (1)

darkstrata.io.
Connection: TLS 1.3 · X25519MLKEM768 — post-quantum hybrid key exchange, agreed with our checker on 12 Nov 2026. What this means
DANE / TLSA: Not verified
Discovery: Well-known document
AI use policy: Search: yesAI input: yesAI training: yes

What this site's robots.txt says about how AI may use its content. Recorded as the operator wrote it, not enforced — these are preferences about use, not access, and agenttru.st only reads the agent's own discovery documents.
AI-facing documents: Publishes /llms.txt — “DarkStrata” a curated map of the site's content for language models

Fetched from this host during verification. Neither document is how this agent was discovered.
First seen: 15 Oct 2026

View verification details

Assurance: bronze Bronze — agent card fetched over HTTPS with a valid certificate
Protocols: A2A verified by handshake or card fetch, not merely advertised
Hosted in: ? Unknown · Cloudflare, Inc. (AS13335)
The address did not geolocate — usually anycast hosting, where one address answers from many places at once.
Last checked: 3d ago

What this agent says it can do

Declared in the agent's own card. agenttru.st has not tested whether it completes any of these tasks — the operator of darkstrata.io controls every word below.

alerts-list

List alerts with filtering and pagination. Returns security alerts for monitored domains. Each alert carries `mitre`: the MITRE ATT&CK techniques and malware (software) its evidence supports, each marked observed or inferred, stamped when the alert was raised (null for older alerts).

alerts

alerts-get

Get detailed information about a specific alert by its ID. Each alert carries `mitre`: the MITRE ATT&CK techniques and malware (software) its evidence supports, each marked observed or inferred, stamped when the alert was raised (null for older alerts).

alerts

alerts-get-stats

Get aggregate alert statistics: counts by status, severity breakdown, and recent trends.

alerts

alerts-attack-summary

Get MITRE ATT&CK coverage of the organisation's alerts over the last 90 days: distinct alert counts per tactic (matrix order) and per technique (most alerts first). Use it to answer which tactics and techniques recent alerts evidence; pass a tactic or technique id to alerts-list to drill in.

alerts

alerts-update-status

Update the status of an alert (e.g. acknowledge or close it).

alerts

alerts-delete

Permanently delete an alert. This action cannot be undone.

alerts

assets-list

List monitored domain assets with filtering and pagination.

assets

assets-get

Get detailed information about a specific domain asset.

assets

assets-get-stats

Get aggregate asset statistics: total, verified, unverified counts.

assets

assets-register

Register a new domain asset for monitoring. Provide the hostname (apex domain or subdomain). A domain past the plan allowance is chargeable: the call is refused with HTTP 402 and the price until accept_extra_charge is true. Ask the user before confirming.

assets

assets-register-bulk

Register multiple domain assets in a single operation. Domains past the plan allowance are chargeable: the call is refused with HTTP 402 and the price until accept_extra_charge is true. Ask the user before confirming.

assets

assets-delete

Remove a domain asset from monitoring. This action cannot be undone.

assets

assets-delete-bulk

Remove multiple domain assets from monitoring. This action cannot be undone.

assets

assets-resubmit-dns

Re-trigger DNS verification for an asset. Useful after updating DNS records.

assets

data-intelligence-query

Query credential exposure data with comprehensive filtering. Returns paginated records including stealer_intel (stealer_family, has_critical_files) when stealer malware metadata is present, plus a provenance block per row (label, matched_corpora_count, earliest_match_year, combolist_confidence), a base_level on threat_score so the read-time provenance modifier is transparent, and a mitre block per row (MITRE ATT&CK techniques and software the record evidences).

data

data-intelligence-get

Get detailed information about a specific credential exposure identifier. Response includes threat_intelligence with is_stealer_infected, stealer_risk_level, base_threat_score (raw score from scoring worker) and current_threat_score (provenance-adjusted: combolist findings downweight, confirmed-reuse upweight) fields, plus full stealer_intel metadata and a top-level provenance block (label, matched_corpora_count, earliest_match_year, combolist_confidence) summarising whether the stealer record looks like fresh infection or possible combolist replay.

data

data-intelligence-get-stats

Get data intelligence statistics: total exposures, threat score distribution, monthly trends, enrichment metrics, and (OUTBOUND) provenance counts (verified_fresh, matched_to_breach_data, full label breakdown).

data

data-intelligence-hostnames

List the hostnames on your monitored domains where customer accounts were captured, with match counts. Needs the Customer Protection add-on (403 without it).

data

data-intelligence-get-actions

Get recommended actions for a credential exposure identifier. Returns standard actions plus dynamic stealer response actions (e.g. rotate_ssh_keys, revoke_sessions) based on exfiltrated data capabilities. Actions differ by flow: OUTBOUND (staff) vs INBOUND (customer).

data

data-intelligence-update-actions

Update the configured actions for a specific credential exposure identifier.

data

data-intelligence-generate-summary

Generate an AI executive summary of a credential exposure identifier's risk profile. Returns a 3-5 sentence risk overview with caching.

data

data-intelligence-breaches-query

List third-party-breach OUTBOUND exposures (BreachExposure rows) with filtering and pagination. Includes corpus_is_combolist, PII presence flags, password_strength_score, and breach_threat_score_level_id. Response is a discriminated union on `mode`: by default `mode=rows` (one row per exposure); when `group_by=identifier` is set, `mode=identifiers` (one row per identifier with aggregated counts; filters apply pre-group, e.g. threat_scores=5 returns identifiers whose at-least-one child exposure is level 5).

data

data-intelligence-breaches-stats

Aggregate stats over third-party-breach OUTBOUND exposures: counts by status / threat score / combolist-vs-genuine, distinct identifiers, distinct corpora, and rows with recovered plaintext passwords.

data

data-intelligence-events-query

List OUTBOUND credential-exposure events — one row per domain_data_matches (identifier ⇄ service accessed), ordered by per-event criticality (threat_score_level_id 1-5). The "by exposure event" counterpart to the identifier-grouped explorer list. Each event carries the service accessed, source / stealer family, identifier status, last_seen, service classification (supply-chain category / asset group / monitored asset), and password metadata (count, has_plaintext flag, strength band 0-4) — never the plaintext password.

data

data-intelligence-events-stats

Distribution stats for the OUTBOUND credential-events view: total, critical vs not-critical (score 5 vs <5), counts by state (identifier status), service classification, and stealer family.

data

data-intelligence-naming-rules

List the organisation's active naming rules (asset hostname, direction, rule_type, pattern, optional custom_regex). Used by the explorer's Unmatched-tab breakdown to explain which rules are filtering the view. Optionally scope by flow direction and a single asset public_id.

data

data-intelligence-breaches-update-status

Update the status on a single third-party-breach exposure. Mirrors stealer-side status semantics (NEW/RESOLVED/IGNORED/FALSE_POSITIVE/RE_EMERGED).

data

data-intelligence-breaches-bulk-status

Bulk-update status across breach exposures. Provide exactly one of public_ids (direct list) OR identifier_groups (each entry fans out to every child exposure matching identifier+asset within the org — the entry-point used by the grouped/identifiers view). Returns affected row count.

data

data-intelligence-malware-family-profile

Get an AI-generated threat intelligence profile for a stealer malware family. Includes overview, distribution methods, capabilities, and indicators. Results are cached for 30 days.

data

incident-response-request

Request a new credential data export for incident response. Requires domain ownership verification and attestation details. This is a partner-verified feature: it is not available on standard plans and must be enabled by DarkStrata for the organisation — a 403 means the organisation is not an approved partner (contact hello@darkstrata.io).

incident

incident-response-list

List credential data export requests with filtering and pagination.

incident

incident-response-get

Get detailed information about a specific credential data export request.

incident

incident-response-get-stats

Get incident response export statistics: counts by status, recent activity.

incident

incident-response-list-pgp-keys

List the organisation's PGP public keys. Use a key's id as pgp_key_id when requesting a PGP-encrypted export.

incident

incident-response-add-pgp-key

Add a PGP public key to the organisation for encrypting PGP-method exports. An organisation may hold several keys. Provide an ASCII-armoured public key.

incident

incident-response-remove-pgp-key

Remove one of the organisation's PGP public keys. Past exports remain encrypted with the key they were created with.

incident

groups-list

List identity groups with filtering and pagination.

groups

groups-get

Get detailed information about a specific group including member count.

groups

groups-create

Create a new identity group for organising monitored identities.

groups

groups-update

Update an existing group's name, description, or configuration.

groups

groups-delete

Delete a group. This action cannot be undone.

groups

groups-list-members

List the members of a group with filtering and pagination.

groups

groups-add-members

Add members to a group (or replace the full membership with mode=replace). Members are identifiers such as email addresses, usernames, or hostnames.

groups

groups-update-member

Update a group member's display name, status, or external reference.

groups

groups-remove-member

Remove a member from a group.

groups

groups-move-members

Move members from one group to another.

groups

credential-check-stats

Get credential check database statistics: total unique records, total records, and last update timestamp.

credential

stix-export-alerts

Export alerts as STIX 2.1 bundles for Splunk ES and threat intelligence platforms. Use format="splunk" for Splunk ES observed-data format. Infostealer and breach findings both export, tagged with MITRE ATT&CK techniques. Supports incremental fetching via the "since" parameter.

stix

stix-export-alert

Export a specific alert as a STIX 2.1 bundle (report first, then the extension definition and indicators). Indicators carry MITRE ATT&CK kill_chain_phases, technique external_references and x_darkstrata_credential.mitre; Splunk-format observed-data carries mitre:<technique id> labels.

stix

stix-export-indicators

Export STIX 2.1 indicators for Splunk ES and threat intelligence platforms (MISP, OpenCTI, ThreatConnect). Each indicator carries MITRE ATT&CK kill_chain_phases and technique references. For incremental sync pass cursor (empty on the first call): indicators then come back oldest first, each exactly once; pass the returned next cursor each time.

stix

siem-export-events

Export credential exposure events in CEF or LEEF format for SIEM ingestion. CEF is supported by ArcSight, Microsoft Sentinel, and most SIEMs. LEEF is the native format for IBM QRadar. Covers infostealer findings. Each event carries its MITRE ATT&CK technique and tactic IDs and the infostealer family ATT&CK Software ID (CEF cs6/flexString1/flexString2, LEEF mitreTechniques/mitreTactics/malwareFamily), and the CEF Device Event Class ID names the finding class (credential-exposure:stealer-fresh, stealer-reuse, combolist, breach or stealer). Events come back oldest first, each exactly once: omit cursor to start, then pass the returned next cursor each time.

siem

siem-export-alert-events

Export credential exposure events for a specific alert in CEF or LEEF format. Infostealer and breach findings both export (cat=BREACH / sourceType=BREACH for breach), each with the same MITRE ATT&CK fields as siem-export-events.

siem

organisations-list

List organisations accessible to the current API key.

organisations

organisations-get

Get detailed information about a specific organisation.

organisations

organisations-get-stats

Get organisation-level statistics: asset counts, identifier totals, critical threats.

organisations

organisations-update

Update organisation details (name, contact info, address).

organisations

organisations-list-tenant-plans

List the plans an MSP partner can put its customer organisations (tenants) on, with the partner price for each. Use a plan slug with organisations-create or organisations-set-plan. Customer Protection bands (customer-account monitoring, on top of a plan) follow the plans with add_on "customer_protection" and their customer_accounts allowance; pass one's slug as customer_protection_slug.

organisations

organisations-create

Create a customer organisation (tenant) under an MSP partner and put it on a tenant plan billed to the partner.

organisations

organisations-set-plan

Change a tenant organisation's plan, extra domains or Customer Protection band. Billed to its MSP partner, prorated by day.

organisations

organisations-generate-api-key

Generate an API key for a tenant organisation of an MSP partner. The secret is returned once. Permissions are capped at the calling key's; empty grants everything allowed.

organisations

usage-get

Get API usage data with optional filtering by key and date range.

usage

usage-get-summary

Get API usage summary for the current billing period: total calls, active keys, first/last call timestamps.

usage

usage-get-by-key

Get API usage breakdown by individual API key.

usage

lens-invite-send

Send Lens credential review invitations to one or more identifiers. Lens allows end-users to securely review and act on their exposed credentials.

lens

Technical agent card

Copied from the agent's card. The operator controls these values; agenttru.st has not verified them.

Provider: DarkStrata — what this agent says about itself; other agents claiming the same provider are not thereby related
Protocol: a2a
Version: 1.0.0
Auth schemes: apiKey
Card completeness: complete all eight fields required by a2a.proto v1.0

View all card details

Capabilities: pushNotifications streaming
Agent card: https://darkstrata.io/.well-known/agent-card.json

Operate this agent and would rather not be listed? Request removal.