Breach Exposure Check

Example

{
  "domain": "adobe.com"
}

{
  "domain": "adobe.com",
  "breached": true,
  "breaches": [
    {
      "name": "Adobe",
      "title": "Adobe",
      "domain": "adobe.com",
      "added_date": "2013-12-04T00:00:00Z",
      "is_malware": false,
      "breach_date": "2013-10-04",
      "is_verified": true,
      "data_classes": [
        "Email addresses",
        "Password hints",
        "Passwords",
        "Usernames"
      ],
      "is_sensitive": false,
      "is_spam_list": false,
      "is_fabricated": false,
      "is_stealer_log": false,
      "accounts_exposed": 152445165,
      "exposed_credentials": true
    }
  ],
  "breach_count": 1,
  "total_accounts_exposed": 152445165,
  "credential_breach_count": 1,
  "most_recent_breach_date": "2013-10-04"
}

Inputs

Output fields

How reliably each field appears in a successful answer.

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "breach-exposure-check",
    "inputs": {
      "domain": "adobe.com"
    },
    "max_price_cents": 5
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "breach-exposure-check",
    "inputs": {
      "domain": "adobe.com"
    },
    "max_price_cents": 5
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "breach-exposure-check",
  inputs: {
    "domain": "adobe.com"
  },
  max_price_cents: 5,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="breach-exposure-check",
    inputs={
        "domain": "adobe.com",
    },
    max_price_cents=5,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/breach-exposure-check \
  -H 'Content-Type: application/json' \
  -d '{
    "domain": "adobe.com"
  }'

Limitations

• Breaches OF the domain, not breaches affecting its people

  This reports incidents where the service running on that domain was itself breached. It does not tell you whether staff at that company had accounts exposed in someone else's breach — that is a per-account question this capability deliberately does not answer.

• No per-email or per-password checking, by design

  Have I Been Pwned's account endpoint and the Pwned Passwords range API are both excluded. Strale records capability inputs on the transaction for 90 days with no write-time redaction, so an email address or password hash passed here would be retained. Those inputs are rejected with an explanatory error rather than accepted.

  What to do instead: Query Have I Been Pwned directly from your own environment for account-level checks.

• A clean domain and an unknown domain look identical

  Both return breached false with an empty list. The upstream does not distinguish "we know this domain and it is clean" from "we have no record of this domain at all", so absence of a breach is not evidence of good security.

• Coverage is curated, not exhaustive

  Have I Been Pwned lists breaches that were disclosed, obtained and verified by its operator. Undisclosed breaches, breaches still under embargo, and incidents never traded publicly are absent.

• Qualifier flags change what a row means

  is_verified false means the operator could not confirm the dump's provenance; is_fabricated, is_spam_list and is_stealer_log mark rows that are not conventional service breaches. Counting every row equally overstates exposure.

• total_accounts_exposed double-counts across breaches

  It is the sum of each breach's account count. One person present in three breaches of the same company is counted three times; it is not a distinct-person figure.