AlertsBar
Domain exposure counters: breaches, infostealers, ULP heap, cookies. Counts only, free.
Should I use this
Quality & Safety
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"alertsbar": {
"url": "https://mcp.alerts.bar/mcp"
}
}
}Remote endpoints
https://mcp.alerts.bar/mcpstreamable-httpWhat it can do
Tool inventory
Tools (1)
🟢exposure_counts_for_domain(domain)
Credential-exposure counters for a domain. Counts only - no credential values or per-account detail. Sources: known breaches, infostealer infections, unattributed ULP bundles (heap), stolen cookies. All figures are INDEXATION dates, not incident dates: _month/_week mean 'newly indexed', never 'newly leaked' - the underlying leak may be months old. Windows nest (_total includes _month includes _week) - never sum them. Counters are rebuilt once daily, so figures are up to 24h old and never real-time. Repeated calls for the same input within a day return identical values — do not re-query to check for changes. Accepts a bare domain, URL or IDN in punycode (xn--) form normalized to the registrable domain. Free, no auth.
Input Schema
{
"type": "object",
"properties": {
"domain": {
"description": "Domain to check, e.g. example.com.",
"type": "string"
}
},
"required": [
"domain"
]
}Output Schema
{
"type": "object",
"properties": {
"breaches_month": {
"description": "Indexed in last 30d. Subset of breaches_total.",
"type": "integer"
},
"breaches_total": {
"description": "Records from known breach incidents, indexed all time.",
"type": "integer"
},
"breaches_week": {
"description": "Indexed in last 7d. Subset of breaches_month.",
"type": "integer"
},
"cookies_month": {
"description": "Indexed in last 30d. Subset of cookies_total.",
"type": "integer"
},
"cookies_total": {
"description": "Stolen browser session cookies, indexed all time. Non-zero means session-hijacking risk that a password reset alone does not fix.",
"type": "integer"
},
"cookies_week": {
"description": "Indexed in last 7d. Subset of cookies_month.",
"type": "integer"
},
"domain": {
"description": "Normalized domain actually queried. May differ from the input - report this one to the user.",
"type": "string"
},
"heap_staff_month": {
"description": "Indexed in last 30d. Subset of heap_staff_total.",
"type": "integer"
},
"heap_staff_total": {
"description": "Staff logins in unattributed ULP bundles - no linkable breach, device or leak date. Credentials circulating in the wild.",
"type": "integer"
},
"heap_staff_week": {
"description": "Indexed in last 7d. Subset of heap_staff_month.",
"type": "integer"
},
"heap_users_month": {
"description": "Indexed in last 30d. Subset of heap_users_total.",
"type": "integer"
},
"heap_users_total": {
"description": "Customer logins in unattributed ULP bundles - no linkable breach, device or leak date.",
"type": "integer"
},
"heap_users_week": {
"description": "Indexed in last 7d. Subset of heap_users_month.",
"type": "integer"
},
"stealers_staff_month": {
"description": "Indexed in last 30d. Subset of stealers_staff_total.",
"type": "integer"
},
"stealers_staff_total": {
"description": "Staff logins from infostealer-infected devices, indexed all time. Implies a compromised machine, not just a leaked password.",
"type": "integer"
},
"stealers_staff_week": {
"description": "Indexed in last 7d. Subset of stealers_staff_month.",
"type": "integer"
},
"stealers_users_month": {
"description": "Indexed in last 30d. Subset of stealers_users_total.",
"type": "integer"
},
"stealers_users_total": {
"description": "Customer logins for this domain's site from infostealer-infected devices, indexed all time.",
"type": "integer"
},
"stealers_users_week": {
"description": "Indexed in last 7d. Subset of stealers_users_month.",
"type": "integer"
}
},
"required": [
"domain",
"breaches_total",
"breaches_month",
"breaches_week",
"cookies_total",
"cookies_month",
"cookies_week",
"stealers_staff_total",
"stealers_staff_month",
"stealers_staff_week",
"stealers_users_total",
"stealers_users_month",
"stealers_users_week",
"heap_staff_total",
"heap_staff_month",
"heap_staff_week",
"heap_users_total",
"heap_users_month",
"heap_users_week"
],
"description": "Counters as of the last daily rebuild. Windows count back from that rebuild, not from request time. Every _total/_month/_week is counted by INDEXATION date, not by when the leak or infection happened. staff = login is an address at this domain (employees); users = login belongs elsewhere but the record is for this domain's site (customers)."
}Community
Evidence