AlertsBar

exposure_counts_for_domain

Read-only

Credential-exposure counters for a domain. Counts only - no credential values or per-account detail. Sources: known breaches, infostealer infections, unattributed heap of ULP (Url,Login,Password) bundles, stolen cookies. All figures are INDEXATION dates, not incident dates: _month/_week mean 'newly indexed', never 'newly leaked' - the underlying leak may be years old. Windows nest (_total includes _month includes _week) - never sum them. Counters are rebuilt once daily, so figures are up to 24h old and never real-time. Repeated calls for the same input within a day return identical values - do not re-query to check for changes. Accepts a bare domain or a full URL; scheme, path, port, case and a leading www. are stripped and subdomains collapse to the registrable domain (multi-tenant hosting suffixes such as github.io are not collapsed). An IDN must already be in punycode (xn--) form. Invalid input (not a domain, an IP address) returns an error. If the domain is not in the index at all, every counter and both dates are null: that means NO DATA, not that the domain is clean - never report it as 'no exposure'. first_indexed_at and last_indexed_at give the date range of the domain's records; use last_indexed_at as the 'last updated' date for the domain. Free, no auth.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`domain`	Yes	Domain to check, e.g. example.com. A full URL is accepted and normalized.

Output Schema

TableJSON Schema

Name	Required	Description
`domain`	Yes	Normalized domain actually queried. May differ from the input - report this one to the user.
`cookies_week`	Yes	Indexed in last 7d. Subset of cookies_month.
`breaches_week`	Yes	Indexed in last 7d. Subset of breaches_month.
`cookies_month`	Yes	Indexed in last 30d. Subset of cookies_total.
`cookies_total`	Yes	Stolen browser session cookies, indexed all time. Non-zero means session-hijacking risk that a password reset alone does not fix. Cookies are counted here only; they are not included in exposure_samples_for_domain.
`breaches_month`	Yes	Indexed in last 30d. Subset of breaches_total.
`breaches_total`	Yes	Records from known breach incidents, indexed all time.
`heap_staff_week`	Yes	Indexed in last 7d. Subset of heap_staff_month.
`heap_users_week`	Yes	Indexed in last 7d. Subset of heap_users_month.
`last_indexed_at`	Yes	Date-time (format YYYY-MM-DD HH:MM:SS, UTC) when AlertsBar last indexed a record for this domain. This is the domain's 'last updated' date and the only reliable freshness signal - samples are random and say nothing about recency. Say 'newly indexed', never 'newly leaked'. Null if the domain is not in the index.
`first_indexed_at`	Yes	Date-time (format YYYY-MM-DD HH:MM:SS, UTC) when AlertsBar first indexed a record for this domain. Indexation date, not incident date - never say the domain was first leaked then. Null if the domain is not in the index.
`heap_staff_month`	Yes	Indexed in last 30d. Subset of heap_staff_total.
`heap_staff_total`	Yes	Staff logins in unattributed heap of ULP (Url,Login,Password) bundles - no linkable breach, device or leak date. Credentials circulating in the wild.
`heap_users_month`	Yes	Indexed in last 30d. Subset of heap_users_total.
`heap_users_total`	Yes	Customer logins in unattributed heap of ULP (Url,Login,Password) bundles - no linkable breach, device or leak date.
`stealers_staff_week`	Yes	Indexed in last 7d. Subset of stealers_staff_month.
`stealers_users_week`	Yes	Indexed in last 7d. Subset of stealers_users_month.
`stealers_staff_month`	Yes	Indexed in last 30d. Subset of stealers_staff_total.
`stealers_staff_total`	Yes	Staff logins from infostealer-infected devices, indexed all time. Implies a compromised machine, not just a leaked password. The credentials may be for any site, not only this domain's own systems.
`stealers_users_month`	Yes	Indexed in last 30d. Subset of stealers_users_total.
`stealers_users_total`	Yes	Customer logins for this domain's site from infostealer-infected devices, indexed all time.

Schema Changelog

Changes observed during successful MCP inspections.

Changed26 schema fields changedSep 29, 2026

changedOutput schema / description

Previous value: -"Counters as of the last daily rebuild. Windows count back from that rebuild, not from request time. Every _total/_month/_week is counted by INDEXATION date, not by when the leak or infection happened. staff = login is an address at this domain (employees); users = login belongs elsewhere but the record is for this domain's site (customers)."New value: +"Counters as of the last daily rebuild. Windows count back from that rebuild, not from request time. Every _total/_month/_week and both dates are by INDEXATION date, not by when the leak or infection happened. All counters and both dates are null when the domain is not in the index (no data - not the same as clean). staff = login is an address at this domain; users = login belongs elsewhere but the record is for this domain's site (customers). For public mailbox providers (e.g. gmail.com, ukr.net) staff means holders of mailboxes at that domain, NOT employees, and the numbers can be huge - do not present them as an employee compromise. Placeholder or test domains (e.g. example.com) also produce staff records that belong to nobody in particular."

changedOutput schema / properties / breaches_month / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / breaches_total / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / breaches_week / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / cookies_month / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / cookies_total / description

Previous value: -"Stolen browser session cookies, indexed all time. Non-zero means session-hijacking risk that a password reset alone does not fix."New value: +"Stolen browser session cookies, indexed all time. Non-zero means session-hijacking risk that a password reset alone does not fix. Cookies are counted here only; they are not included in exposure_samples_for_domain."

changedOutput schema / properties / cookies_total / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / cookies_week / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

addedOutput schema / properties / first_indexed_at

Added value: +{
+  "description": "Date-time (format YYYY-MM-DD HH:MM:SS, UTC) when AlertsBar first indexed a record for this domain. Indexation date, not incident date - never say the domain was first leaked then. Null if the domain is not in the index.",
+  "type": [
+    "string",
+    "null"
+  ]
+}

changedOutput schema / properties / heap_staff_month / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / heap_staff_total / description

Previous value: -"Staff logins in unattributed heap of ULP bundles - no linkable breach, device or leak date. Credentials circulating in the wild."New value: +"Staff logins in unattributed heap of ULP (Url,Login,Password) bundles - no linkable breach, device or leak date. Credentials circulating in the wild."

changedOutput schema / properties / heap_staff_total / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / heap_staff_week / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / heap_users_month / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / heap_users_total / description

Previous value: -"Customer logins in unattributed heap of ULP bundles - no linkable breach, device or leak date."New value: +"Customer logins in unattributed heap of ULP (Url,Login,Password) bundles - no linkable breach, device or leak date."

changedOutput schema / properties / heap_users_total / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / heap_users_week / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

addedOutput schema / properties / last_indexed_at

Added value: +{
+  "description": "Date-time (format YYYY-MM-DD HH:MM:SS, UTC) when AlertsBar last indexed a record for this domain. This is the domain's 'last updated' date and the only reliable freshness signal - samples are random and say nothing about recency. Say 'newly indexed', never 'newly leaked'. Null if the domain is not in the index.",
+  "type": [
+    "string",
+    "null"
+  ]
+}

changedOutput schema / properties / stealers_staff_month / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / stealers_staff_total / description

Previous value: -"Staff logins from infostealer-infected devices, indexed all time. Implies a compromised machine, not just a leaked password."New value: +"Staff logins from infostealer-infected devices, indexed all time. Implies a compromised machine, not just a leaked password. The credentials may be for any site, not only this domain's own systems."

changedOutput schema / properties / stealers_staff_total / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / stealers_staff_week / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / stealers_users_month / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / stealers_users_total / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / properties / stealers_users_week / type

Previous value: -"integer"New value: +[
+  "integer",
+  "null"
+]

changedOutput schema / required

Previous value: -[
-  "domain",
-  "breaches_total",
-  "breaches_month",
-  "breaches_week",
-  "cookies_total",
-  "cookies_month",
-  "cookies_week",
-  "stealers_staff_total",
-  "stealers_staff_month",
-  "stealers_staff_week",
-  "stealers_users_total",
-  "stealers_users_month",
-  "stealers_users_week",
-  "heap_staff_total",
-  "heap_staff_month",
-  "heap_staff_week",
-  "heap_users_total",
-  "heap_users_month",
-  "heap_users_week"
-]New value: +[
+  "domain",
+  "first_indexed_at",
+  "last_indexed_at",
+  "breaches_total",
+  "breaches_month",
+  "breaches_week",
+  "cookies_total",
+  "cookies_month",
+  "cookies_week",
+  "stealers_staff_total",
+  "stealers_staff_month",
+  "stealers_staff_week",
+  "stealers_users_total",
+  "stealers_users_month",
+  "stealers_users_week",
+  "heap_staff_total",
+  "heap_staff_month",
+  "heap_staff_week",
+  "heap_users_total",
+  "heap_users_month",
+  "heap_users_week"
+]

Changed2 schema fields changedSep 29, 2026

changedOutput schema / properties / heap_staff_total / description

Previous value: -"Staff logins in unattributed ULP bundles - no linkable breach, device or leak date. Credentials circulating in the wild."New value: +"Staff logins in unattributed heap of ULP bundles - no linkable breach, device or leak date. Credentials circulating in the wild."

changedOutput schema / properties / heap_users_total / description

Previous value: -"Customer logins in unattributed ULP bundles - no linkable breach, device or leak date."New value: +"Customer logins in unattributed heap of ULP bundles - no linkable breach, device or leak date."

Changed1 schema field changedSep 28, 2026

changedInput schema / properties / domain / description

Previous value: -"Domain to check, e.g. example.com."New value: +"Domain to check, e.g. example.com. A full URL is accepted and normalized."

First observedSep 23, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With only readOnlyHint available in annotations, the description carries the rest: daily rebuild with up to 24h staleness, idempotent same-day results, indexation-vs-incident date semantics, nested-window warning never to sum counters, free/no-auth. It also discloses the critical null-vs-clean trap that an agent would otherwise misreport.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first sentence and every subsequent sentence carries distinct operational information, so nothing is filler. It is still a dense block, and the normalization rules could be tightened, but the length is justified by the number of traps being flagged.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value documentation is not required, yet the description still explains what the returned counters mean, the window nesting, and the all-null case. Together with annotations and schema, an agent has everything needed to call and interpret it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already says a URL is accepted and normalized, yet the description adds real semantics beyond it: scheme/path/port/case/www stripping, subdomain collapse to registrable domain, the multi-tenant suffix exception, required punycode for IDNs, and error behavior for IPs/invalid input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource (credential-exposure counters) and explicitly scopes out the detail available elsewhere ('Counts only - no credential values or per-account detail'), which cleanly separates it from the sibling exposure_samples_for_domain. An agent can pick between the two without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear runtime guidance: do not re-query within a day, treat nulls as NO DATA rather than clean, and use last_indexed_at as the domain's 'last updated'. It routes detail-seekers away implicitly ('no credential values or per-account detail') but never names the sibling tool outright, so the alternative is inferred rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All AlertsBar tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?