Check whether a password appears in known data breaches via the HaveIBeenPwned k-anonymity API. Only a 5-character SHA-1 prefix is sent, never the full password.
Check if a password has appeared in known data breaches using HaveIBeenPwned k-anonymity API. The full password is never transmitted — only a 5-char SHA-1 prefix.
| Name | Required | Description | Default |
|---|---|---|---|
| password | Yes |
Changes observed during successful MCP inspections.
v1.1.61Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and delivers genuinely useful behavioral context: it discloses the external dependency (HaveIBeenPwned k-anonymity API) and the privacy property that only a 5-char SHA-1 prefix leaves the caller. It omits rate limits, auth requirements, and result semantics, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste. The purpose is front-loaded and the privacy mechanism follows as immediate reassurance about how the input is handled.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no annotations and no output schema, the description covers what the tool does and how input is protected, but says nothing about what the result contains (breach boolean vs. occurrence count) or call limits. Adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% for the single parameter, so the description must compensate. It implies the caller passes a plaintext password (not a pre-computed hash) and clarifies how it is processed, but adds no format, length, or encoding constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: checking whether a password appears in known breach data, plus the backing API. The resource ('password') inherently separates it from the sibling netintel_username_check, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the mechanism but gives no when-to-use guidance, no prerequisites (e.g., API key), and no exclusions or alternatives. An agent must infer the usage context entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.