AI-ready threat intelligence

Query live attacker intelligence from your own AI tools.

BlackDome captures real attacker behaviour across global honeypots, previews the evidence safely, and exposes it through a free MCP server so Claude, Cursor, ChatGPT, and your own agents can ask questions grounded in live threat evidence.

Connect MCP Free View Sample Evidence ThreatDrop Live

Free MCP connectorRedacted evidence previewsubmit@blackdome.ai → detonation + reportsLive Red Team data packagesReal-time API + TAXII paths

Enterprise contactsales@blackdome.ai

Most threat feeds sell conclusions without the session evidence.

BlackDome owns the contact layer. We see the scans, logins, commands, credentials, payloads, and infrastructure as they happen, then make that evidence queryable for humans, APIs, and AI agents.

Closed Loop

One attacker session becomes intelligence your AI can use.

Start with the free MCP connector and redacted public preview. Upgrade when you need real-time access, bulk exports, TAXII delivery, or managed deception.

1Capture

Global honeypots collect commands, credentials, payloads, and attacker sessions

2Query

Claude, Cursor, ChatGPT, and your own LLM can query BlackDome through MCP

3Buy

Teams unlock real-time API access, STIX exports, reports, and packaged data

4Deploy

Selected clients can add guided Sentinel and honeypot deployments as the defence layer matures

Sentinel Dev Preview

Sentinel is the defence layer we are still hardening.

The public self-serve product is intelligence, MCP, API, and packages. Sentinel and managed honeypots stay visible as a guided deployment path for selected clients who want BlackDome collecting and responding inside their environment.

DEV

Private preview, not open self-serve

Sentinel is being hardened through guided client deployments before broad release.

POT

Managed honeypots and tripwires

Deploy customer-specific deception surfaces when a team needs direct collection.

PROOF

Proof packs and bounded response

The roadmap keeps actions explainable, signed, and constrained by policy.

Discuss Preview Access

Platform Pillars

Ways to use BlackDome.

Use the public explorer, connect MCP, submit threats via ThreatDrop for detonation + abuse reports, buy curated Red Team data, or talk to us about Sentinel and managed honeypots when you need a guided defence deployment.

INTEL