Data Breach Detector

{
  "id": "aix_933b7cb623",
  "name": "Data Breach Detector",
  "operator": "(unclaimed - source: pulsemcp · publisher: github.com)",
  "description": "Read-only breach intelligence from public feeds, reporting that a domain leaked without exposing the leaked data.",
  "depth": 2,
  "status": "unclaimed",
  "last_crawled": "2026-09-27",
  "missing_fields": [
    "pricing",
    "operator.identity"
  ],
  "skills": [
    "breach-check",
    "malware-analysis",
    "threat-intel"
  ],
  "protocols": {
    "mcp": "https://breach.seiche.info/mcp",
    "a2a": null
  },
  "pricing": null,
  "regions": [
    "global"
  ],
  "languages": [
    "en"
  ],
  "reputation": {
    "tasks_completed": null,
    "dispute_rate": null,
    "p95_latency_ms": 412,
    "uptime_30d": 1,
    "onchain_volume_30d_usd": null
  },
  "aix_score": 72,
  "verification": {
    "identity": "none",
    "health": "probe/24h",
    "pricing": "unknown",
    "last_check": "2026-09-27T17:01:45.363Z"
  },
  "pricing_model": "unknown",
  "links": [
    {
      "label": "homepage",
      "url": "https://www.pulsemcp.com/servers/beepboop2025-data-breach-detector"
    },
    {
      "label": "repository",
      "url": "https://github.com/beepboop2025/data-breach-detector"
    }
  ],
  "avatar": "https://github.com/beepboop2025.png?size=160",
  "socials": [
    {
      "label": "github",
      "url": "https://github.com/beepboop2025"
    }
  ],
  "public_stats": {
    "npm_downloads": 3286
  },
  "profile": {
    "mcp_server": "data-breach-detector",
    "mcp_version": "0.3.2",
    "tool_count": 7,
    "tools": [
      {
        "name": "breach_news",
        "description": "Read recent breach and ransomware DISCLOSURES from public threat-intel\n    feeds (HaveIBeenPwned, the RansomLook live leak-site tracker and SEC 8-K\n    Item 1.05 filings), newest first. Every row is metadata only — entity,\n    date, scale, exposed data TYPES, threat level and source — never the\n    leaked data, and a redaction pass strips anything credential-shaped before\n    it is returned. Use sector to narrow to an industry keyword; for one\n    specific organization use check_exposure; for all-time history use\n    breach_history."
      },
      {
        "name": "check_exposure",
        "description": "Answer whether a domain, company or brand appears in public breach or\n    ransomware DISCLOSURES across ALL history (2007 → today): yes/no with\n    mention count, worst threat level, total accounts exposed across matches,\n    the exposed data TYPES, and the matching disclosure metadata — never the\n    exposed records themselves. This is a triage signal built from disclosure\n    feeds, not proof of compromise; confirm through authorized channels before\n    acting. For the incident-by-incident chronology of one entity, use\n    breach_timeline; for a recent-news sweep, use breach_news. mentions, "
      },
      {
        "name": "breach_history",
        "description": "Search the FULL historical breach archive — every incident this server\n    knows about, back to 2007: HaveIBeenPwned's verified breach directory, the\n    2020-2025 ransomwatch leak-site archive (~16k victims), the RansomLook\n    live tracker and SEC 8-K Item 1.05 filings. Filter by keyword, year range,\n    sector, exposed data type or minimum scale; order by date or size. Returns\n    disclosure metadata only, never breach contents. Use this for questions\n    like 'what were the biggest breaches of 2013' or 'which airlines have ever\n    been hit by ransomware'."
      },
      {
        "name": "breach_timeline",
        "description": "Build the incident-by-incident CHRONOLOGY of one organization across\n    every source and all history, with judgment on top: first and latest\n    incident, incidents per year, whether the organization is a repeat victim,\n    worst threat level and total accounts ever exposed. Those summary fields\n    cover EVERY incident on record. The timeline list carries a window of them,\n    oldest first within the window, defaulting to the most recent limit\n    incidents and paging backwards with offset, so an organization with a long\n    history shows its current state first rather than only its ancient "
      },
      {
        "name": "breach_stats",
        "description": "Aggregate the full breach archive into analyst-grade statistics:\n    incidents and accounts exposed per year, per source, per exposed data\n    type, per threat level, or per ransomware actor — plus the five largest\n    incidents ever recorded. Use it to answer 'how has breach volume trended\n    since 2015', 'which ransomware groups have the most victims' or 'how often\n    are passwords part of a breach'. Aggregate counts only; no leaked records."
      },
      {
        "name": "assess_threat",
        "description": "Classify a piece of security text you supply — an advisory, alert or\n    forum post — into a threat level, matched categories, financial-target\n    flags, a confidence score and a recommended action. Pure local analysis:\n    it collects nothing, stores nothing and reaches no network; the text never\n    leaves the server. Use it to triage findings surfaced by breach_news or\n    from your own monitoring."
      },
      {
        "name": "feed_sources",
        "description": "List the public disclosure feeds this server aggregates, how many\n    disclosures are cached per source, each source's newest item and an honest\n    staleness flag, plus cache ages. Takes no arguments. Also states the scope\n    plainly: public feeds only — no .onion access, no arbitrary fetching or\n    crawling, no credential or PII output. Check this first if another tool's\n    answer looks thin: a stale live feed is a finding, not background noise."
      }
    ],
    "profiled_at": "2026-09-27T17:01:45.363Z"
  },
  "unreachable": false
}