mcp-livedatapro

checkCredentialBreach

Check if an email address, domain, or k-anonymity password hash prefix appears in known dark-web data breaches. Use when auditing whether an email address, corporate domain, or 5-character SHA-1 password hash prefix appears in verified dark-web data breaches or stealer logs. Do not use for IP threat scoring (use getIpIntelligence). Returns compromised status, incident dates, and leaked data categories without exposing plaintext passwords.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "target_query": "<target_query>"
    },
    "name": "checkCredentialBreach"
  }
}

Input Schema

Name	Required	Description	Default
`target_query`	Yes	Email address, corporate root domain, or 5-character uppercase SHA-1 password hash prefix.

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedOct 24, 2026
- addedInput schema / additionalProperties
```
Added value: +false
```
- addedInput schema / properties / target_query / examples
```
Added value: +[
+  "security@example.com"
+]
```
- addedInput schema / properties / target_query / minLength
```
Added value: +5
```

Changed1 schema field changedOct 24, 2026

changedInput schema / properties / target_query / description

Previous value: -"Email address, corporate domain, or 5-char SHA-1 password hash prefix"New value: +"Email address, corporate root domain, or 5-character uppercase SHA-1 password hash prefix."

First observedOct 21, 2026

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden and does well: it discloses the return contents (compromised status, incident dates, leaked data categories) and the privacy behavior (k-anonymity, no plaintext passwords). It does not mention authentication or rate limits, but for this lookup tool the behavioral profile is substantially covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded and reasonably tight, but it repeats the accepted input types across the first two sentences ('email address, domain, or k-anonymity password hash prefix' then 'email address, corporate domain, or 5-character SHA-1 password hash prefix'). That redundancy slightly weakens an otherwise efficient statement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and no annotations, so the description must explain behavior and returns; it does both by naming compromised status, incident dates, leaked categories, and privacy handling. The main omission is operational detail such as rate limits or authentication expectations, but for a one-parameter read lookup the definition is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the schema already defines the single parameter precisely, including the 5-character uppercase SHA-1 prefix format. The description reinforces the accepted input types and mentions k-anonymity, but it adds little syntax or format detail beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: checking whether an email, domain, or hash prefix appears in known dark-web breaches. It also explicitly distinguishes the tool from getIpIntelligence, so an agent can route correctly among siblings without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit use case ('Use when auditing whether...') and a clear exclusion with an alternative ('Do not use for IP threat scoring (use getIpIntelligence)'). This is exactly the when-to-use/when-not-to-use guidance that helps tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All mcp-livedatapro tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?