Official MCP RegistryListed
Dragons Eye Ransomware Claims
Ransomware leak-site claim lookups, group profiles and a $3 vendor risk report (x402 USDC).
First seen 10 Oct 2026. Evidence as of 14 Oct 2026.
7
Tools
From an anonymous probe
1
Source listings
Each with its own history
17
Recorded changes
Since first seen
Tools
| Tool | Description | Behaviour |
|---|---|---|
| batch_exposure_check | Check up to 25 vendor or supplier domains in one call for ransomware leak-site claims, for third-party-risk reviews. Returns one result per domain (found, claim count, claims with group, dates and sources). Domains only; use lookup_victim for company names. At most 15 claim records are read per batch, so a domain with many matches is marked partial. Every result is an unverified claim from a criminal leak site, not a confirmed breach; found=false is not proof of absence. Read-only; one flat price. Costs $0.05 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged. | Read-only |
| group_profile | Get a profile of one ransomware group: aliases, when RansomLook first observed it, and a sample of its newest claims. Use it to understand who a group is; use recent_claims for a longer list of its latest claims. Unknown groups return an error and are not charged. Every claim is an unverified claim from a criminal leak site, not a confirmed breach. Read-only. Costs $0.02 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged. | Read-only |
| lookup_victim | Search ransomware leak-site claims for one company name or domain: has a group claimed it? Returns matching claims with group, claimed date, first-observed date, country, sector and licensed sources. Use it for a single vendor or target; use batch_exposure_check for a list of up to 25 vendor domains, and recent_claims for the newest claims overall. Every result is an unverified claim from a criminal leak site, not a confirmed breach, and found=false is not proof of absence (only commercially reusable sources are covered). Read-only, live lookup. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged. | Read-only |
| pricing | Free. Return the price of every paid tool, the payment network (Base) and address, the licensed data sources, and the 'unverified claim' label every result carries. No input, no network request, no payment. | Read-only |
| recent_claims | List the newest ransomware leak-site claims (1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim to search for a specific company. Only commercially reusable sources are used, so country and sector are often null. Every result is an unverified claim from a criminal leak site, not a confirmed breach. Read-only. Costs $0.01 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged. | Read-only |
| validate_query | Free. Check and normalize a company name or domain before calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no network request, no payment. | Read-only |
| vendor_risk_report | Build a third-party ransomware risk report for up to 100 vendors (domains or company names). For each vendor: matching leak-site claims (group, claimed and first-observed dates, sources), a risk level (high = claim in the last 90 days, elevated = last 12 months, historical, none_found, unknown) and follow-up actions; plus a portfolio summary with priority vendors and the groups involved. Use it for vendor reviews and audits; use batch_exposure_check for a cheaper raw check of up to 25 domains. Every result is an unverified claim from a criminal leak site, not a confirmed breach; none_found is not proof of absence. Fails (not charged) if the source is down for more than 25% of vendors. Read-only; one flat price. Costs $3 USDC per call via x402 (payment goes in _meta["x402/payment"]); invalid input or an upstream failure returns an error and is not charged. | Read-only |
Change history
- vendor_risk_report: tool added
- server instructions changed (+"vendor_risk_report builds a full risk report for up to 100 vendor domains or names,")
- Description changed (registry)
- validate_query: input schema changed
- validate_query: description changed (+"Free." +"calling lookup_victim; tells you whether it will be searched as a domain or a name. Offline: no network request, no payment." -"FREE.")
- validate_query: annotations changed
- recent_claims: description changed (+"List the newest" +"(1-10), optionally filtered to one group such as akira or qilin. Use it to watch recent activity; use lookup_victim" +"search")
- recent_claims: annotations changed
- pricing: description changed (+"Free. Return the price of every paid tool, the" +"network (Base) and" +"the licensed")
- pricing: annotations changed
- lookup_victim: description changed (+"Search" +"leak-site claims for one" +"name")
- lookup_victim: annotations changed
- group_profile: description changed (+"Get a profile" +"one" +"when RansomLook")
- group_profile: annotations changed
- batch_exposure_check: tool added
- server instructions changed (+"Dragons Eye: pay-per-call ransomware leak-site claim data. Use validate_query and pricing (both free) first. lookup_victim searches one company or domain, batch_exposure_check checks up to 25 vendor domains at once, recent_claims lists the newest claims (optionally per group), group_profile describes one group. Every result is an unverified claim from a criminal leak site, not a confirmed breach; found=false is not proof of absence. Do not use results to contact, shame or harm alleged victims. Read-only; x402 USDC on Base in _meta['x402/payment']; failed or invalid calls are not charged.")
- Listed (registry)
| Source | Listing | First seen | Last seen | Versions |
|---|---|---|---|---|
| Official MCP Registry | com.ransomware-tracker.api/dragonseye | 10 Oct 2026 | 14 Oct 2026 | 2 |