Breach Radar
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NVD_API_KEY | No | Raises NVD's keyless limit (about 5 requests per 30 seconds) to 50 requests per 30 seconds. | |
| HIBP_API_KEY | No | Enables the email_breaches tool. HIBP keys are paid. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| breach_catalogB | Search the Have I Been Pwned breach catalogue (no key needed): most recent, largest, or by keyword/data type (e.g. 'passwords', 'crypto', 'health'). |
| breach_detailsA | Full details of one HIBP breach by name (e.g. 'Adobe', 'LinkedIn'). |
| domain_breachesA | Breaches in HIBP where the breached service is this domain (no key needed). Does not list individual addresses. |
| email_breachesA | Breaches containing an email address. Requires the server operator to set HIBP_API_KEY; otherwise explains alternatives. Only check addresses the user owns or is authorised to check. |
| password_pwnedA | Check if a password appears in known breaches using HIBP Pwned Passwords k-anonymity: the password is SHA-1 hashed locally and only the first 5 hex characters are sent. Accepts the password or its SHA-1. The password is never stored, logged or echoed. |
| cve_searchA | Search the NIST National Vulnerability Database: by CVE id, keyword (product/vendor), severity, recency, or KEV-listed only. Returns CVSS, CWE and KEV status. Keyless (rate-limited); optional NVD_API_KEY raises limits. |
| kev_lookupB | Search the CISA KEV catalogue (vulnerabilities exploited in the wild): by CVE, vendor, keyword, recency, or ransomware use. Includes CISA's required action and due date. |
| security_headersA | Grade a site's HTTP security headers from a single GET of its homepage (HSTS, CSP, X-Content-Type-Options, frame protection, Referrer-Policy, Permissions-Policy, COOP) and flag version-leaking headers. Passive. |
| attack_surface_reportA | One passive report for a domain the user owns or is authorised to assess: security headers (1 GET), TLS certificate/protocol, SPF/DMARC/CAA/DNSSEC, Certificate Transparency subdomains, and HIBP breaches of the domain. No scanning or probing. |
| ct_subdomainsA | Hostnames for a domain seen in public Certificate Transparency logs (crt.sh, Cert Spotter fallback). Passive: no DNS brute force. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 10 tools
Most tools have clearly distinct targets: breach_catalog (search HIBP by keyword), breach_details (one breach by name), domain_breaches, email_breaches, and password_pwned each address a different query type. Mild overlap exists between the aggregate attack_surface_report and its component tools (security_headers, ct_subdomains, domain_breaches), and cve_search's KEV filter partially overlaps kev_lookup, but descriptions clarify the boundaries.
All names use lowercase snake_case with a consistent noun-centric pattern (breach_catalog, domain_breaches, cve_search), so the set reads predictably. Minor deviations like the abbreviated ct_subdomains and adjective form password_pwned slightly break the otherwise uniform convention, but nothing is confusing.
Ten tools is well-scoped for a passive security/breach reconnaissance server, with each tool covering a meaningful slice (breach lookup, vulnerability lookup, surface exposure). No redundant or trivial tools inflate the count.
The surface covers the core domain well: breach lookup across catalogue/domain/email/password, vulnerability search via NVD and KEV, and surface exposure via headers, TLS/CT, and DNS records in the aggregate report. Minor gaps remain, such as no standalone DNS/email-auth tool (only bundled in attack_surface_report) and no IP-reputation or non-CT subdomain enumeration, but these are workable for a passive-only design.