Check the exposed surface of a site you own
exposure_checkChecks what a site or app the user owns leaks publicly. Use it when the user asks what an attacker could find on their own domain, host or app, for example "does my app leak a .env file?". Pass the domain, host or app page address, not a bare IP. The first call returns ownership_not_proven with a DNS TXT record or file: publish it, then call again with the same target. Then it gives exposed or clean, the top three risks with fixes, and evidence: dangling subdomains, leaked files (never their contents), masked API keys, source maps, admin paths, dev servers and default pages. It adds six legal signals with law and source (COPPA, Google Fonts, session replay, renewals, DMCA, CAN-SPAM) and shipNaked: 7 pre-launch pages (privacy, refund and more) with text to paste; not legal advice. GET only, at most 32 fixed paths; no crawl, sign-in or port scan. Do not use it on a target the user does not own, to look up a person, user name or email, or for private or local addresses.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"target": "<target>"
},
"name": "exposure_check"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| No | Optional: the text or HTML of one marketing email the app sends, checked for an unsubscribe link and a postal address (CAN-SPAM). It is read in memory and never returned; like every input it may sit in the 30-day input log, cleaned and cut to 2 KB. | ||
| target | Yes | A domain, host or page address you own, such as example.com or https://app.example.com/dashboard. Not a bare IP: pass a host name that points at the server. The host is checked; a page address also names the page whose scripts are read for keys (the home page otherwise). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| asOf | No | When the check ran, ISO 8601 UTC. | |
| legal | No | ||
| tried | No | ||
| answer | Yes | One-paragraph answer to lead with. | |
| phases | No | ||
| target | Yes | Host checked. | |
| publish | No | ||
| sources | No | ||
| surface | No | ||
| verdict | Yes | ownership_not_proven: publicFindings holds what any visitor can see; publish the record or file in publish, then call exposure_check again with the same target for the rest. | |
| evidence | No | ||
| rejected | No | ||
| topRisks | No | ||
| keysFound | No | ||
| ownership | No | ||
| shipNaked | No | The 7 pre-launch pages an app usually ships without, each pass, fail, warn or not_checked; a fail or warn carries snippet, the text to paste. | |
| adminPaths | No | ||
| notChecked | No | ||
| scriptsRead | No | ||
| requestsMade | No | ||
| ownershipNote | Yes | Reminder that the check is only for a target the caller owns. | |
| publicFindings | No | Before the proof: what any visitor can see. Headers, plain http, robots.txt paths and admin paths by status only. | |
| needsVerification | No |