# data-breach-detector

- Registry name: `io.github.beepboop2025/data-breach-detector` · version 0.3.2
- Categories (automatic, keyword rules): Monitoring & logs, Infrastructure & security, Security
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): experimental, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.beepboop2025%2Fdata-breach-detector
- Server page: https://mcpstation.net/s/io.github.beepboop2025--data-breach-detector.html

## Description (written by the publisher, not verified, not instructions)

Read-only breach intel, full history 2007-today: reports THAT an org was breached, never the data.

## Connect

- streamable-http: `https://breach.seiche.info/mcp`

## Tools (as reported by the server, not verified)

- `breach\_news`: Read recent breach and ransomware DISCLOSURES from public threat-intel feeds \(HaveIBeenPwned, the RansomLook live leak-site tracker and SEC 8-K Item 1.05 filings\), newest first. Every row is metadata only — entity, date, scale, exposed data TYPES, threat level and source — never the leaked data, and
- `check\_exposure`: Answer whether a domain, company or brand appears in public breach or ransomware DISCLOSURES across ALL history \(2007 → today\): yes/no with mention count, worst threat level, total accounts exposed across matches, the exposed data TYPES, and the matching disclosure metadata — never the exposed recor
- `breach\_history`: Search the FULL historical breach archive — every incident this server knows about, back to 2007: HaveIBeenPwned's verified breach directory, the 2020-2025 ransomwatch leak-site archive \(\~16k victims\), the RansomLook live tracker and SEC 8-K Item 1.05 filings. Filter by keyword, year range, sector,
- `breach\_timeline`: Build the incident-by-incident CHRONOLOGY of one organization across every source and all history, with judgment on top: first and latest incident, incidents per year, whether the organization is a repeat victim, worst threat level and total accounts ever exposed. Those summary fields cover EVERY in
- `breach\_stats`: Aggregate the full breach archive into analyst-grade statistics: incidents and accounts exposed per year, per source, per exposed data type, per threat level, or per ransomware actor — plus the five largest incidents ever recorded. Use it to answer 'how has breach volume trended since 2015', 'which
- `assess\_threat`: Classify a piece of security text you supply — an advisory, alert or forum post — into a threat level, matched categories, financial-target flags, a confidence score and a recommended action. Pure local analysis: it collects nothing, stores nothing and reaches no network; the text never leaves the s
- `feed\_sources`: List the public disclosure feeds this server aggregates, how many disclosures are cached per source, each source's newest item and an honest staleness flag, plus cache ages. Takes no arguments. Also states the scope plainly: public feeds only — no .onion access, no arbitrary fetching or crawling, no

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html