I wrote torreable, a tool that lets AI agents publish websites to the dark web. The first reaction is usually that this sounds like the start of a dystopian short story: robots quietly spinning up onion sites by the thousand, the worst of both worlds in one Python package. It's a reasonable concern. But Tor's reputation has very little to do with what Tor was actually built for.
The protocol is mostly famous for drug markets and ransomware, because that's the part that makes the news. What Tor was actually built for is anonymous browsing for people who live somewhere that the wrong URL gets you a visit: journalists working around state media, dissidents on the wrong side of the censor, citizens who'd rather not have their reading history end up in a file somewhere.
Hidden services are the other half. The same protocol pointed at the publisher instead of the reader, so a site whose author can't be traced and whose host can't be pressured gets the same protections that anonymous browsing gives a reader. The infrastructure has always supported this, and almost nobody uses it that way.
The reason is that running a hidden service is five layers of expertise stacked on top of each other: install Tor, edit torrc, generate keys, run a web server, and write HTML. Each step is a wall, and the Venn diagram of people with something dangerous to publish and people who can clear all five walls is small. Approximately none of them are the people the original mission was for.
This is the kind of problem MCP is genuinely good for: a thin server in front of a stack of fiddly tooling. Most MCP servers do mundane things like searching docs or editing files. The interesting ones hand an agent a capability the user couldn't be bothered to set up themselves, and hidden services fit that shape exactly.
Torreable exposes six tools to the agent: create_site
, preview
, publish
, unpublish
, destroy
, and list_sites
. The agent handles the key management, the Tor control port dance, the local preview, and the publish. You say "put up a hidden service that says X" and twenty seconds later there's a .onion
URL. Each site keeps its own private key on disk, so the address survives republish cycles. The page is only reachable while torreable is running, which sounds like a limitation but in the dissident framing is exactly the tradeoff you want: a stable URL with content you can yank the moment things heat up. It feels closer to a personal printing press than a hosted blog.
The agent can also write the site. The user under a repressive regime doesn't have to know HTML, doesn't have to know hosting, doesn't have to know Tor. They describe what they want to say, and the agent produces the page and publishes it. The whole stack collapses into one sentence.
The original mission was never going to reach anyone while running a hidden service meant five layers of plumbing. Hand those layers to an agent, and the other half finally becomes a tool the people it was built for can actually use.