Skip to main content
Glama

data-breach-detector

by io.github.beepboop2025

check_exposure

Read-onlyIdempotent

Answer whether a domain, company or brand appears in public breach or ransomware DISCLOSURES across ALL history (2007 → today): yes/no with mention count, worst threat level, total accounts exposed across matches, the exposed data TYPES, and the matching disclosure metadata — never the exposed records themselves. This is a triage signal built from disclosure feeds, not proof of compromise; confirm through authorized channels before acting. For the incident-by-incident chronology of one entity, use breach_timeline; for a recent-news sweep, use breach_news. mentions, the aggregates and the data types always cover every match; matches carries one page of them, sized by limit and walked with offset.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNomaximum matching disclosures to return (default 8; the mention count and the aggregates always cover every match)
queryYesdomain, company or brand to look up, e.g. 'example.com' or 'Acme'
offsetNohow many matches to skip before the page starts; with limit this reaches matches beyond the first page
since_daysNooptional look-back window in days; the default covers all history

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnly, openWorld, idempotent), the description adds critical behavioral details: it never returns exposed records, it is built from disclosure feeds rather than proof of compromise, and it explains that aggregates cover all matches while the matches list is paged via limit/offset. These go well beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured, front-loading the core purpose before expanding into caveats, alternatives, and pagination. Each sentence adds necessary information, and there is no fluff. It is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite lacking an output schema, the description enumerates the return fields (yes/no, mention count, worst threat level, total accounts exposed, data types, metadata) and clarifies API behavior. It fully covers the necessary context for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While schema description coverage is 100%, the description adds meaning beyond the schema by explaining how limit/offset affect only the matches page, not the aggregates or mention count, and that since_days default covers all history. This clarifies interaction between parameters and return values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to answer whether a domain, company, or brand appears in breach/ransomware disclosures across all history, returning a yes/no with aggregates and metadata. It also explicitly distinguishes from siblings by naming breach_timeline and breach_news for other use cases.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: it labels the tool as a triage signal, warns against treating it as proof of compromise, and directs users to breach_timeline for chronological details or breach_news for recent news. It also clarifies that the tool never returns exposed records, setting expectations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All data-breach-detector toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: assess_threat classifies text, breach_history searches the archive, breach_news reads recent disclosures, breach_stats aggregates statistics, breach_timeline builds per-entity chronologies, check_exposure provides a yes/no triage, and feed_sources lists metadata. Cross-references in descriptions explicitly direct users to the appropriate tool, eliminating ambiguity.

Naming Consistency4/5

Tool names are consistently lowercase snake_case and most follow a logical pattern, but not all are verb_noun (e.g., breach_history, breach_stats are nouns while assess_threat, check_exposure are verbs). The 'breach_' prefix creates a strong family, so deviations are minor and do not impair readability.

Tool Count5/5

Seven tools is ideal for this domain, covering search, news, statistics, timeline, exposure check, text classification, and source metadata without over-fragmentation or bloat. Each tool contributes a distinct capability and the set is well-scoped.

Completeness5/5

The tool surface provides comprehensive coverage of breach detection and analysis: historical search, recent disclosures, per-entity exposure checks and timelines, aggregate statistics, threat classification, and feed health checks. No obvious operational gap exists for the stated purpose.

Resources