check_exposure
Check whether a domain, company, or brand appears in public breach or ransomware disclosures, returning mention counts, threat level, exposed data types, and accounts affected.
Instructions
Answer whether a domain, company or brand appears in public breach or ransomware DISCLOSURES across ALL history (2007 → today): yes/no with mention count, worst threat level, total accounts exposed across matches, the exposed data TYPES, and the matching disclosure metadata — never the exposed records themselves. This is a triage signal built from disclosure feeds, not proof of compromise; confirm through authorized channels before acting. For the incident-by-incident chronology of one entity, use breach_timeline; for a recent-news sweep, use breach_news. mentions, the aggregates and the data types always cover every match; matches carries one page of them, sized by limit and walked with offset.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"query": "<query>"
},
"name": "check_exposure"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | maximum matching disclosures to return (default 8; the mention count and the aggregates always cover every match) | |
| query | Yes | domain, company or brand to look up, e.g. 'example.com' or 'Acme' | |
| offset | No | how many matches to skip before the page starts; with limit this reaches matches beyond the first page | |
| since_days | No | optional look-back window in days; the default covers all history |