{
  "markdown": "<!-- mcp-name: io.github.beepboop2025/data-breach-detector -->\n\n# data-breach-detector\n\nA **read-only breach-intelligence MCP server**. It answers *\"has this\norganization ever been breached, what's the recent breach news, what does two\ndecades of breach history look like, how severe is this threat text\"* from\npublic disclosure feeds — and reports **intelligence, not contents**: the\nexistence, timing, scale, category and exposed data-*types* of a breach, never\nthe leaked records themselves.\n\nBuilt for defenders and for agents that work on their behalf.\n\n## Why this instead of the alternatives\n\nMost breach tooling sits in one of three camps, and each has a structural gap:\n\n- **Consumer checkers** (HaveIBeenPwned's site) answer one question — \"is my\n  email in a breach\" — one account at a time, one source at a time.\n- **Leak-data brokers** (DeHashed, IntelX, LeakCheck and the like) sell access\n  to the leaked records themselves. Wiring one into an AI agent hands the\n  agent stolen credentials.\n- **Enterprise intel platforms** (SpyCloud, Recorded Future, Flashpoint) do\n  the join properly — behind five-figure contracts and closed APIs.\n\nThis server takes a fourth position:\n\n1. **Four primary sources, one queryable surface.** The verified breach\n   directory (HIBP), a *live* ransomware leak-site tracker (RansomLook), a\n   ~16k-victim leak-site archive back to 2020 (ransomwatch), and SEC 8-K\n   Item 1.05 filings — companies' own legally mandated \"material cybersecurity\n   incident\" disclosures. Regulator-grade and criminal-infrastructure-grade\n   evidence in the same index. No key, no contract.\n2. **History is first-class.** `breach_history`, `breach_timeline` and\n   `breach_stats` treat 2007→today as the product, not a cache: every breach\n   of 2013, an organization's full incident chronology, repeat-victim\n   flagging, per-year and per-actor aggregates.\n3. **The ethical boundary is in the code, not the terms of service.** No\n   fetch/crawl/proxy primitives, no `.onion` access, and every feed-authored\n   string is sanitized *where the record is built*, before any field is\n   assembled from it: emails, hashes, IPs, crypto addresses and\n   credential-shaped tokens are redacted, and the invisible channels used to\n   hide instructions from a human reader (Unicode Tags, zero-widths, bidi\n   overrides, variation selectors, terminal control codes) are stripped. That\n   matters because leak-site titles are written by ransomware crews and read\n   by agents: the same field is both intelligence and an injection surface.\n   Redacting only the two fields a human looks at is not enough, because ids,\n   actor names and statistic bucket keys are built from the same strings.\n4. **Honesty is instrumented.** `feed_sources` reports each feed's newest\n   item, a staleness flag and the last fetch error — a dead upstream is a\n   served fact, not a silent hole. (The ransomwatch project itself froze in\n   June 2025; this server says so instead of pretending.)\n5. **MCP-native, free, MIT, self-hostable.** One `pip install`, stdio or\n   streamable-HTTP.\n\n## What it does not do\n\n- No arbitrary URL fetch, no crawl, no proxy — no general scraping primitives.\n- No `.onion` marketplace access, no transactions.\n- Never returns the raw text of a dump, paste or leak. Feed-authored strings are\n  redacted and stripped of hidden-instruction characters at the point each\n  record is constructed, so ids, actor names, entity names, dates, source URLs\n  and aggregation keys are built from sanitized values rather than raw ones.\n\n## Sources (public, no key)\n\n- **HaveIBeenPwned** `/api/v3/breaches` — the verified breach directory back\n  to 2007: domain, breach date, pwn count, exposed data *categories*.\n- **RansomLook** (`ransomlook.io`) — live ransomware leak-site tracker.\n- **ransomwatch** (`joshhighet/ransomwatch`) — frozen archive of ~16k\n  leak-site posts, Jan 2020 → Jun 2025, retained as history.\n- **SEC EDGAR** — 8-K filings carrying Item 1.05 *Material Cybersecurity\n  Incidents* (mandatory first-party disclosure since Dec 2023).\n\n## Tools\n\n| tool | what it returns |\n|------|-----------------|\n| `breach_news(since_days, sector, source, limit, offset)` | recent disclosures — entity, date, scale, exposed data types, severity |\n| `check_exposure(query, since_days, limit, offset)` | does a domain/company appear anywhere in breach data — yes/no + metadata |\n| `breach_history(query, year_from, year_to, sector, data_type, min_accounts, order, limit, offset)` | search the full archive back to 2007 |\n| `breach_timeline(entity, limit, offset)` | one organization's incident-by-incident chronology + repeat-victim assessment |\n| `breach_stats(group_by, sector, limit)` | aggregates per year / source / data type / threat level / ransomware actor |\n| `assess_threat(text)` | classify a piece of security text — level, categories, action (no network) |\n| `feed_sources()` | feeds, per-source freshness, staleness flags, last fetch errors |\n\nEvery list tool reports `count`, `limit`, `offset` and `returned`, and\n`breach_stats` reports `buckets_total`, so a truncated answer is visible as\ntruncated and the tail is reachable by paging rather than lost.\n\n## Run\n\n```bash\npip install data-breach-detector\n\ndata-breach-detector           # stdio (for MCP clients)\ndata-breach-detector --http    # streamable-HTTP on 127.0.0.1:8790/mcp\n```\n\nOr point an MCP client at the config:\n\n```json\n{ \"mcpServers\": { \"data_breach_detector\": {\n  \"command\": \"data-breach-detector\"\n} } }\n```\n\nHosted remote: `https://breach.seiche.info/mcp`\n\n## License\n\nMIT. The breach data belongs to its sources (HaveIBeenPwned, RansomLook,\nransomwatch, SEC EDGAR); this tool only aggregates their public disclosure\nmetadata, with attribution.\n",
  "bytes": 5739,
  "sha": "3e8fda1679fb582dd9ef7c6bd43f8557934b82dd280de24d5a6650787041d102",
  "repo_slug": "beepboop2025/data-breach-detector",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_beepboop2025_data_breach_detec_7ffe9d59/readme"
}