Skip to main content
Glama

Have I Been Pwned

Have I Been Pwned - Send Domain Verification Email

hibp_send_domain_verification_email

Send a domain verification email to an approved alias such as admin or security. Requires an authenticated subscription with domain-verification access.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
domainYesThe domain to verify by email.
emailAliasYesThe approval alias to send the verification email to, for example admin.
response_formatNoFormat only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.markdown

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
domainNo
messageNoPresent when the tool returns an error.
guidanceNoAdditional guidance for resolving the tool error.
emailSentNo
emailAliasNo
statusCodeNoPresent when the tool returns an error.
rateLimitResetAtNoUTC timestamp indicating when the current rate limit window should have reset.
retryAfterHeadersNoRetry headers that mirror the standard HTTP rate-limit response when applicable.
retryAfterSecondsNoHow long to wait before retrying, when the tool is rate limited.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changed
    • changedInput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
    • changedInput schema / properties / response_format / description
      Previous value: -"Format the text response as markdown (default) or JSON. structuredContent is always returned."New value: +"Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent."
    • changedOutput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
  2. First observed

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds an authentication/authorization requirement beyond the annotations, and it makes the side-effecting nature explicit by saying 'Send'. It does not contradict the annotations, and while it omits details like email delivery delays or retry behavior, the idempotentHint=false annotation partially covers that.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences convey the action, the target, and the key prerequisite with no filler. The main action is front-loaded, and the examples are compact and useful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a small three-parameter tool with full schema coverage and an output schema, the description is largely sufficient: it identifies the action, the required alias semantics, and the auth prerequisite. It could mention the DNS-token alternative or failure modes, but those are not essential to invoking this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaningful context by explaining that emailAlias must be an 'approved alias' and gives concrete examples ('admin or security'), which helps an agent pick valid values beyond the bare schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Send'), names the resource ('domain verification email'), and clarifies the target ('to an approved alias such as admin or security'). This clearly distinguishes it from the sibling token-generation and token-verification tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states a necessary prerequisite: 'Requires an authenticated subscription with domain-verification access.' However, it does not explicitly contrast this email-based verification path with the sibling DNS-token tools, so an agent must infer when this tool is preferred over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources