Skip to main content
Glama
MadaBurns

Blackveil DNS

by MadaBurns
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Hybrid

osint_investigate_email_start

Starts an asynchronous OSINT investigation for an email address to check breach exposure and account correlation. Returns an investigation ID for polling and report retrieval.

Instructions

Start an async OSINT investigation for an email address (breach exposure, account correlation). Owner/enterprise tier only — people-centric OSINT is restricted to prevent misuse. Returns an investigationId immediately — poll with osint_investigation_status and retrieve results with osint_investigation_report.

Input Schema

NameRequiredDescriptionDefault
queryYesInvestigation subject, per tool: a domain, public IP, organisation name, email address or username.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv3.103.1
    • addedInput schema / properties / query / description
      Added value: +"Investigation subject, per tool: a domain, public IP, organisation name, email address or username."
  2. Changed1 schema field changedv3.54.0
    • changedOutput schema / (root)
      Previous value: -{
-  "additionalProperties": {},
-  "properties": {
-    "category": {
-      "type": "string"
-    },
-    "findings": {
-      "items": {
-        "additionalProperties": {},
-        "properties": {},
-        "type": "object"
-      },
-      "type": "array"
-    },
-    "passed": {
-      "type": "boolean"
-    },
-    "score": {
-      "type": "number"
-    }
-  },
-  "required": [
-    "category",
-    "score",
-    "passed",
-    "findings"
-  ],
-  "type": "object"
-}New value: +null
  3. First observedv3.29.7

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnly=false, openWorld=true, idempotent=false, destructive=false. The description adds genuinely new behavioral facts: the call is asynchronous, it returns an investigationId immediately rather than results, and it requires an owner/enterprise tier. It does not mention cost, rate limits, or latency beyond 'async'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences, each earning its place: purpose, access constraint, and async workflow. The most important fact (async, returns an ID) is stated before the polling instructions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter async starter with no output schema, it covers what the tool does, who may call it, what it returns (an investigationId), and exactly which tools to call next. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single 'query' parameter has 100% schema coverage but a generic description ('a domain, public IP, organisation name, email address or username'). The tool description narrows that to an email address for this specific tool, which is real added meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Start an async OSINT investigation for an email address') and scopes the contents (breach exposure, account correlation). It is clearly distinguishable from the sibling osint_investigate_domain_start / _username_start / _infrastructure_start variants.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly gates usage ('Owner/enterprise tier only — people-centric OSINT is restricted to prevent misuse') and routes the agent through the correct follow-up sequence (osint_investigation_status, then osint_investigation_report). It does not explicitly compare against the other osint_investigate_*_start siblings, but the email scope makes the choice unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools