AlertsBar

Domain exposure counters: breaches, infostealers, ULP heap, cookies. Counts only, free.

Should I use this

Quality & Safety

A
Description quality
100%
Schema completeness
100%
Naming quality
80%
Poisoning risk
100%
Permission match
100%
Protocol compliance
100%

Based on automated analysis of tool definitions and protocol compliance.

Context Cost

~881Tokens (tool definitions)
~9.4 KBTypical response size
Moderate attention impact (0.69% of 128k context)

This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.

Install

One-Click Install

Add this to your `claude_desktop_config.json` file:

{
  "mcpServers": {
    "alertsbar": {
      "url": "https://mcp.alerts.bar/mcp"
    }
  }
}

Remote endpoints

https://mcp.alerts.bar/mcpstreamable-http

What it can do

Tool inventory

Tools (1)

🟢 Read-only🟡 Write🔴 Delete⚪ Unknown
🟢exposure_counts_for_domain(domain)

Credential-exposure counters for a domain. Counts only - no credential values or per-account detail. Sources: known breaches, infostealer infections, unattributed ULP bundles (heap), stolen cookies. All figures are INDEXATION dates, not incident dates: _month/_week mean 'newly indexed', never 'newly leaked' - the underlying leak may be months old. Windows nest (_total includes _month includes _week) - never sum them. Counters are rebuilt once daily, so figures are up to 24h old and never real-time. Repeated calls for the same input within a day return identical values — do not re-query to check for changes. Accepts a bare domain, URL or IDN in punycode (xn--) form normalized to the registrable domain. Free, no auth.

Input Schema

{
  "type": "object",
  "properties": {
    "domain": {
      "description": "Domain to check, e.g. example.com.",
      "type": "string"
    }
  },
  "required": [
    "domain"
  ]
}

Output Schema

{
  "type": "object",
  "properties": {
    "breaches_month": {
      "description": "Indexed in last 30d. Subset of breaches_total.",
      "type": "integer"
    },
    "breaches_total": {
      "description": "Records from known breach incidents, indexed all time.",
      "type": "integer"
    },
    "breaches_week": {
      "description": "Indexed in last 7d. Subset of breaches_month.",
      "type": "integer"
    },
    "cookies_month": {
      "description": "Indexed in last 30d. Subset of cookies_total.",
      "type": "integer"
    },
    "cookies_total": {
      "description": "Stolen browser session cookies, indexed all time. Non-zero means session-hijacking risk that a password reset alone does not fix.",
      "type": "integer"
    },
    "cookies_week": {
      "description": "Indexed in last 7d. Subset of cookies_month.",
      "type": "integer"
    },
    "domain": {
      "description": "Normalized domain actually queried. May differ from the input - report this one to the user.",
      "type": "string"
    },
    "heap_staff_month": {
      "description": "Indexed in last 30d. Subset of heap_staff_total.",
      "type": "integer"
    },
    "heap_staff_total": {
      "description": "Staff logins in unattributed ULP bundles - no linkable breach, device or leak date. Credentials circulating in the wild.",
      "type": "integer"
    },
    "heap_staff_week": {
      "description": "Indexed in last 7d. Subset of heap_staff_month.",
      "type": "integer"
    },
    "heap_users_month": {
      "description": "Indexed in last 30d. Subset of heap_users_total.",
      "type": "integer"
    },
    "heap_users_total": {
      "description": "Customer logins in unattributed ULP bundles - no linkable breach, device or leak date.",
      "type": "integer"
    },
    "heap_users_week": {
      "description": "Indexed in last 7d. Subset of heap_users_month.",
      "type": "integer"
    },
    "stealers_staff_month": {
      "description": "Indexed in last 30d. Subset of stealers_staff_total.",
      "type": "integer"
    },
    "stealers_staff_total": {
      "description": "Staff logins from infostealer-infected devices, indexed all time. Implies a compromised machine, not just a leaked password.",
      "type": "integer"
    },
    "stealers_staff_week": {
      "description": "Indexed in last 7d. Subset of stealers_staff_month.",
      "type": "integer"
    },
    "stealers_users_month": {
      "description": "Indexed in last 30d. Subset of stealers_users_total.",
      "type": "integer"
    },
    "stealers_users_total": {
      "description": "Customer logins for this domain's site from infostealer-infected devices, indexed all time.",
      "type": "integer"
    },
    "stealers_users_week": {
      "description": "Indexed in last 7d. Subset of stealers_users_month.",
      "type": "integer"
    }
  },
  "required": [
    "domain",
    "breaches_total",
    "breaches_month",
    "breaches_week",
    "cookies_total",
    "cookies_month",
    "cookies_week",
    "stealers_staff_total",
    "stealers_staff_month",
    "stealers_staff_week",
    "stealers_users_total",
    "stealers_users_month",
    "stealers_users_week",
    "heap_staff_total",
    "heap_staff_month",
    "heap_staff_week",
    "heap_users_total",
    "heap_users_month",
    "heap_users_week"
  ],
  "description": "Counters as of the last daily rebuild. Windows count back from that rebuild, not from request time. Every _total/_month/_week is counted by INDEXATION date, not by when the leak or infection happened. staff = login is an address at this domain (employees); users = login belongs elsewhere but the record is for this domain's site (customers)."
}

Community

Rate this Server

Evidence

Recent observations

verifiedversion not recorded1 tools