data-breach-detector

Official4 tools

by beepboop2025 · Python

Read-only breach intelligence from public feeds: reports THAT a domain leaked, never the data.

Topics

mcpmcp-servermodel-context-protocolsecuritythreat-intelligence

Captured live from the server via tools/list.

breach_news

Recent breach and ransomware DISCLOSURES from public threat-intel feeds (HaveIBeenPwned, ransomwatch). Metadata only — entity, date, scale, exposed data TYPES, threat level — never the leaked data. Optional sector/keyword filter (e.g. "bank", "health", "crypto").

Parameters3

since_days	integer	optional
sector	any	optional
limit	integer	optional

Raw schema

{
  "type": "object",
  "properties": {
    "since_days": {
      "default": 30,
      "title": "Since Days",
      "type": "integer"
    },
    "sector": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "title": "Sector"
    },
    "limit": {
      "default": 25,
      "title": "Limit",
      "type": "integer"
    }
  },
  "title": "breach_newsArguments"
}

check_exposure

Does a domain, company or brand appear in public breach or ransomware DISCLOSURES? The HaveIBeenPwned model: yes/no plus metadata (when, scale, which data types were exposed, severity, source) — never the exposed records. Triage only; confirm through authorized channels.

Parameters2

query	string	required
since_days	integer	optional

Raw schema

{
  "type": "object",
  "properties": {
    "query": {
      "title": "Query",
      "type": "string"
    },
    "since_days": {
      "default": 100000,
      "title": "Since Days",
      "type": "integer"
    }
  },
  "required": [
    "query"
  ],
  "title": "check_exposureArguments"
}

assess_threat

Triage a piece of security text (advisory, forum post, alert): classify threat level, categories and recommended action. Pure analysis of text you supply — collects nothing, reaches no network.

Parameters1

text

string

required

Raw schema

{
  "type": "object",
  "properties": {
    "text": {
      "title": "Text",
      "type": "string"
    }
  },
  "required": [
    "text"
  ],
  "title": "assess_threatArguments"
}

feed_sources

List the public feeds this detector aggregates and how fresh the cache is.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "title": "feed_sourcesArguments"
}

README.md2 KBView on GitHub

data-breach-detector

A read-only breach-intelligence MCP server. It answers "has this domain been breached, what's the recent breach news, how severe is this threat text" from public threat-intelligence disclosure feeds — and reports intelligence, not contents: the existence, timing, scale, category and exposed data-types of a breach, never the leaked records themselves.

Built for defenders. Comparable in spirit to HaveIBeenPwned's own directory.

What it does not do

No arbitrary URL fetch, no crawl, no proxy — no general scraping primitives.
No .onion marketplace access, no transactions.
Never returns the raw text of a dump, paste or leak. A redaction layer strips emails, hashes, IPs, crypto addresses and credential-shaped tokens from every string returned.

Sources (public, no key)

HaveIBeenPwned /api/v3/breaches — the public breach directory: domain, breach date, pwn count, and the categories of data exposed.
ransomwatch (joshhighet/ransomwatch) — public ransomware leak-site tracker.

Tools

tool	what it returns
`breach_news(since_days, sector, limit)`	recent disclosures — entity, date, scale, exposed data types, severity
`check_exposure(query)`	does a domain/company appear in breach data — yes/no + metadata
`assess_threat(text)`	classify a piece of security text — level, categories, action (no network)
`feed_sources()`	which feeds are aggregated + cache freshness

Run

bash

pip install data-breach-detector

data-breach-detector           # stdio (for MCP clients)
data-breach-detector --http    # streamable-HTTP on 127.0.0.1:8790/mcp

Or point an MCP client at the config:

json

{ "mcpServers": { "data_breach_detector": {
  "command": "data-breach-detector"
} } }

License

MIT. The breach data belongs to its sources (HaveIBeenPwned, ransomwatch); this tool only aggregates their public disclosure metadata, with attribution.

Install

Tools (4)

breach_newscheck_exposureassess_threatfeed_sources

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "data-breach-detector": {
      "command": "uvx",
      "args": [
        "data-breach-detector"
      ]
    }
  }
}