data-breach-detector MCP

{
  "type": "object",
  "title": "breach_newsArguments",
  "properties": {
    "limit": {
      "type": "integer",
      "title": "Limit",
      "default": 10,
      "maximum": 100,
      "minimum": 1,
      "description": "maximum disclosures to return (default 10; raise it deliberately, large pages are heavy for an agent loop)"
    },
    "offset": {
      "type": "integer",
      "title": "Offset",
      "default": 0,
      "minimum": 0,
      "description": "how many matching disclosures to skip before the page starts; with limit this walks a result set larger than any single page (count reports the full total)"
    },
    "sector": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Sector",
      "default": null,
      "description": "optional keyword filter over entity, title, summary, categories and exposed data types, e.g. 'bank', 'health', 'crypto'"
    },
    "source": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Source",
      "default": null,
      "description": "optional source filter: 'HaveIBeenPwned', 'RansomLook', 'ransomwatch-archive' or 'SEC EDGAR 8-K 1.05'"
    },
    "since_days": {
      "type": "integer",
      "title": "Since Days",
      "default": 30,
      "minimum": 1,
      "description": "look-back window in days over disclosure dates (default 30)"
    }
  }
}

{
  "title": "Recent breach disclosures",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true
}

{
  "type": "object",
  "title": "check_exposureArguments",
  "required": [
    "query"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "title": "Limit",
      "default": 8,
      "maximum": 100,
      "minimum": 1,
      "description": "maximum matching disclosures to return (default 8; the mention count and the aggregates always cover every match)"
    },
    "query": {
      "type": "string",
      "title": "Query",
      "description": "domain, company or brand to look up, e.g. 'example.com' or 'Acme'"
    },
    "offset": {
      "type": "integer",
      "title": "Offset",
      "default": 0,
      "minimum": 0,
      "description": "how many matches to skip before the page starts; with limit this reaches matches beyond the first page"
    },
    "since_days": {
      "type": "integer",
      "title": "Since Days",
      "default": 100000,
      "minimum": 1,
      "description": "optional look-back window in days; the default covers all history"
    }
  }
}

{
  "title": "Entity exposure check",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true
}

{
  "type": "object",
  "title": "breach_historyArguments",
  "properties": {
    "limit": {
      "type": "integer",
      "title": "Limit",
      "default": 10,
      "maximum": 100,
      "minimum": 1,
      "description": "maximum incidents to return (default 10; raise it deliberately, large pages are heavy for an agent loop)"
    },
    "order": {
      "type": "string",
      "title": "Order",
      "default": "newest",
      "description": "'newest' (default), 'oldest' or 'largest' (by accounts exposed)"
    },
    "query": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Query",
      "default": null,
      "description": "optional keyword over entity, title, summary, actor and data types; omit to browse the whole archive"
    },
    "offset": {
      "type": "integer",
      "title": "Offset",
      "default": 0,
      "minimum": 0,
      "description": "how many matching incidents to skip before the page starts; count can run to five figures over the ~16k-post archive, so this is how the tail is reached"
    },
    "sector": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Sector",
      "default": null,
      "description": "industry keyword filter, e.g. 'bank', 'health', 'gaming'"
    },
    "year_to": {
      "anyOf": [
        {
          "type": "integer",
          "minimum": 2000
        },
        {
          "type": "null"
        }
      ],
      "title": "Year To",
      "default": null,
      "description": "latest incident year to include, e.g. 2020"
    },
    "data_type": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Data Type",
      "default": null,
      "description": "require an exposed data type, e.g. 'passwords', 'credit card', 'health'"
    },
    "year_from": {
      "anyOf": [
        {
          "type": "integer",
          "minimum": 2000
        },
        {
          "type": "null"
        }
      ],
      "title": "Year From",
      "default": null,
      "description": "earliest incident year to include, e.g. 2013"
    },
    "min_accounts": {
      "type": "integer",
      "title": "Min Accounts",
      "default": 0,
      "minimum": 0,
      "description": "only incidents exposing at least this many accounts"
    }
  }
}

{
  "title": "Historical breach search",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true
}

{
  "type": "object",
  "title": "breach_timelineArguments",
  "required": [
    "entity"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "title": "Limit",
      "default": 12,
      "maximum": 100,
      "minimum": 1,
      "description": "how many incidents the timeline list carries (default 12); the counts, span and judgment always cover every incident"
    },
    "entity": {
      "type": "string",
      "title": "Entity",
      "description": "domain, company or brand to build the chronology for, e.g. 'yahoo.com' or 'Adobe'"
    },
    "offset": {
      "type": "integer",
      "title": "Offset",
      "default": 0,
      "minimum": 0,
      "description": "pages backwards through the chronology from the recent end: 0 gives the newest window, 12 gives the window before that"
    }
  }
}

{
  "title": "Entity breach timeline",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true
}

{
  "type": "object",
  "title": "breach_statsArguments",
  "properties": {
    "limit": {
      "type": "integer",
      "title": "Limit",
      "default": 40,
      "maximum": 500,
      "minimum": 1,
      "description": "how many buckets to return, largest first (default 40); buckets_total reports how many exist, and grouping by actor over the ~16k-post archive produces far more"
    },
    "sector": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Sector",
      "default": null,
      "description": "optional industry keyword filter applied before aggregating"
    },
    "group_by": {
      "type": "string",
      "title": "Group By",
      "default": "year",
      "description": "aggregation axis: 'year' (default), 'source', 'data_type', 'threat_level' or 'actor' (ransomware group)"
    }
  }
}

{
  "title": "Breach archive statistics",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true
}

{
  "type": "object",
  "title": "assess_threatArguments",
  "required": [
    "text"
  ],
  "properties": {
    "text": {
      "type": "string",
      "title": "Text",
      "description": "the security text to classify — an advisory, alert or forum post"
    }
  }
}

{
  "title": "Threat-text triage",
  "readOnlyHint": true,
  "openWorldHint": false,
  "idempotentHint": true
}

{
  "type": "object",
  "title": "feed_sourcesArguments",
  "properties": {}
}

{
  "title": "Feed sources & health",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true
}