hibp_check_account

What hibp_check_account does on UnClick

AI agents call hibp_check_account to retrieve information from UnClick without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Parameters from the server's own tool schema.

Why hibp_check_account is rated Low

This tool queries the HIBP (Have I Been Pwned) service to retrieve historical breach status for an email account. It is a read-only operation with no data modification, deletion, or external execution. The severity is low as misuse primarily poses information disclosure risks rather than system compromise or data destruction. No financial impact or destructive actions are possible.

From the tool's definition Tool name 'hibp_check_account' and description 'Check if an email account has been in a data breach' indicate a query operation that retrieves breach information without modifying data or triggering external side effects.

Risk signalsHandles credentials or secrets (api_key)

The rule that runs hibp_check_account safely

PolicyLayer is an MCP gateway: it sits between your AI agents and UnClick, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For hibp_check_account, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "hibp_check_account": {}
  }
}

Questions about hibp_check_account