Skip to main content
Glama

Understand company monitoring

leakdata.company_monitoring
Read-onlyIdempotent

Use this when someone asks about their own company or employer: whether it had a data breach, whether its domain, staff email addresses or work accounts appear in data breaches, or how to monitor a business domain. Explains what LeakData checks for a domain the company verifies it owns and returns any public catalog breaches listed for exactly that domain with their details. Explain setup using the returned checks and requirements; do not offer plans, prices or sales links. No sign-in is needed. It does not enable monitoring, search employee addresses, or reveal any person's data; never claim it did. Not listed means not in LeakData's catalog, not that the company was never breached.

Input Schema

NameRequiredDescriptionDefault
domainNoThe company domain the user gave, for example "acme.com". Omit when the user gave no domain; never infer it from a company name.

Output Schema

NameRequiredDescriptionDefault
kindYes
checksYes
domainYes
requirementsYes
listedBreachesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • removedOutput schema / properties / infoUrl
      Removed value: -{
      -  "description": "LeakData's page showing which plans include domain monitoring. Share only when the user asks how to set it up.",
      -  "maxLength": 200,
      -  "type": "string"
      -}
    • changedOutput schema / required
      Previous value: -[
      -  "kind",
      -  "domain",
      -  "checks",
      -  "requirements",
      -  "infoUrl"
      -]New value: +[
      +  "kind",
      +  "domain",
      +  "checks",
      +  "requirements"
      +]
  2. Added

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the read-only/idempotent annotations: states no sign-in is needed, that it does not enable monitoring or expose personal data, and interprets negative results ('Not listed means not in LeakData's catalog, not that the company was never breached'). That interpretive caveat is exactly the kind of behavior an agent cannot get from structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the usage trigger and efficiently dense, but it runs five sentences and some guardrail content (pricing/sales links, repeated non-capability claims) is verbose rather than strictly necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be explained, and the description still covers the trigger, the exclusions, the auth posture, and the meaning of absent results. An agent has everything needed to select and call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description nonetheless adds meaning by framing the domain as one 'the company verifies it owns,' which clarifies the parameter's business semantics beyond the schema's 'domain the user gave.' It does not add format or syntax detail, so it stays below top marks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource: it 'explains what LeakData checks for a domain the company verifies it owns and returns any public catalog breaches listed for exactly that domain with their details.' It also carves boundaries against siblings by stating it does not enable monitoring, search employee addresses, or reveal personal data, so an agent can separate it from search/breach_lookup without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit trigger: 'Use this when someone asks about their own company or employer.' Explicit exclusions: not for enabling monitoring, not for searching employee addresses, not for revealing any person's data, and 'do not offer plans, prices or sales links.' Nothing about when to use versus alternatives is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources