Dark web data for your AI assistant

OwlyScan is a search over the documents ransomware groups publish on their sites and forums. Your AI gets two tools to use it.

• count_results gives the number of documents that match a query and how they split by channel.
• search_tor returns a page of results as excerpts, each with its channel and its date, and says how much of each you may read: yours, likely yours, names hidden or values hidden.

A record is yours when it concerns your company: your domain, an address on it or one of your company names. Your records are shown as they are, and the rest has its names hidden. In your records, passwords and hashes are masked: only their length and at most their first two characters show.

What it cannot read. There is no tool to open a full document: excerpts are all there is. Documents that are not yours show no web address and no file name. A query that looks like a person’s name, an email address, a phone number or a handle gets counts only.

OwlyScan supplies the records and does not interpret them. Your AI does the reading and the reasoning, so ask it to quote the excerpts and not to guess beyond them.

1. Create your Access.

   Sign up with your work email. Access opens the app, your AI and the API.

2. Add the server to your AI app.

   In Claude Desktop or claude.ai, open Settings, then Connectors, choose Add custom connector and paste this URL. Sign in with your work email when your browser asks: we email you a code.

   https://backend.owlyscan.com/mcp/v1

3. Or add it in Claude Code.

   Run this in your terminal, then open the /mcp command in Claude Code and choose OwlyScan to sign in with your work email.

   claude mcp add --transport http owlyscan https://backend.owlyscan.com/mcp/v1

For a script or a program, an owly_ key works on the same endpoint. In the .mcp.json file, the entry looks like this:

{
  "mcpServers": {
    "owlyscan": {
      "type": "http",
      "url": "https://backend.owlyscan.com/mcp/v1",
      "headers": {
        "Authorization": "Bearer owly_YOUR_KEY"
      }
    }
  }
}

Create the key in the app and treat it like a password. API keys.

Write to your AI as you would to a colleague. Give it your domain and your company names first. Four requests a security lead might type:

• Count the documents that mention our domain, split by channel. Only search if the count is reasonable.
• Search our company name and domain. List each excerpt with its channel and date, and say whether it is yours.
• Search our domain on the ransomware channel only, for this year, and sort the excerpts by date.
• Write a short note for our CISO from these excerpts. Quote them and do not guess beyond them.

• Access includes 100 searches a week per account. The app, the API and your AI share the one counter.
• count_results counts as one search. A search_tor of the same query soon after shares that search, and paging through its results in that time costs nothing.
• When the weekly limit is reached, the tool says so and gives the time it resets.
• Excerpts only: no tool opens a full document.

Every rule is in limits and quota.

Yes. An owly_ key lets a script or a program search OwlyScan the way your AI does, on the search route and on the same MCP endpoint, with the same excerpts and the same weekly counter. Read the API page.

One Access account opens the app, your AI and the API. Free for 7 days. Then €39 a month or €390 a year, excl. VAT.

You pay by card and can cancel any time. The prices and the trial are on the pricing page.