{"serverInfo":{"name":"xonplus","title":"xonPlus Breach Intelligence","version":"3.0.0","description":"xonPlus breach intelligence for AI agents: email exposure checks for every customer, domain breach summaries and domain management for xonPartner keys. The threat-intel webhook is managed in the console or over REST only.","vendor":"XposedOrNot","homepage":"https://plus.xposedornot.com","documentation":"https://plus-api.xposedornot.com/docs","support":"help@xposedornot.com"},"protocolVersion":"2025-06-18","supportedProtocolVersions":["2025-06-18","2025-03-26"],"transport":{"type":"http","url":"https://plus-api.xposedornot.com/mcp"},"authentication":{"type":"apiKey","in":"header","name":"x-api-key","description":"Your xonPlus API key, the same one the REST API takes. Every method, including initialize and tools/list, requires it. Create keys in the xonPlus console."},"capabilities":{"tools":{"listChanged":false}},"instructions":"xonPlus breach intelligence for AI agents. Every call needs the customer's xonPlus API key in the x-api-key header; tools/list shows only the tools that key may use. Tool calls share the key's REST quota and rate limits, so pace retries by the retry_after a tool returns.","tools":[{"name":"check_email","title":"Check an email address for breaches","description":"Look up one email address in the XposedOrNot breach index and return the breaches it appears in. Works with any xonPlus API key; one call costs one request against the key's rate limit. Default response: status, email and a list of breach ids. Set detailed=true for one object per breach (date, exposed data types, records, description) and analytics=true for the full breach-analytics payload (risk score, year/industry/password breakdowns); both are larger, ask only when needed. An address with no exposure returns an empty breaches list; a malformed address returns a not-found result. Passwords are never returned.","inputSchema":{"type":"object","properties":{"email":{"type":"string","description":"The email address to check."},"detailed":{"type":"boolean","default":false,"description":"Return one object per breach instead of ids."},"analytics":{"type":"boolean","default":false,"description":"Return the breach-analytics payload (opt-in add-on)."}},"additionalProperties":false,"required":["email"]},"annotations":{"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true},"x-xonplus-key":"any"},{"name":"partner_domain_summary","title":"Breach summary for one of your approved domains","description":"Breach exposure for a domain the partner has submitted and had approved. Requires an xonPartner API key; the domain must belong to this partner (others return a 403 error result). Default: aggregate counts per breach. details=true returns the matched addresses in pages of at most 1000 rows by default (limit up to 10000); continue with the response's next_cursor as cursor until has_more is false. For monitoring pass since=<ISO 8601 date or timestamp> to get only breaches ingested after that instant, and feed the response's as_of back as the next since. Each page is one request against the key's rate limit.","inputSchema":{"type":"object","properties":{"domain":{"type":"string","description":"An approved partner domain."},"details":{"type":"boolean","default":false,"description":"Return matched addresses (paged) instead of counts."},"limit":{"type":"integer","minimum":1,"maximum":10000,"description":"Rows per details page."},"cursor":{"type":"string","description":"next_cursor from the previous details page."},"since":{"type":"string","description":"ISO 8601 date or timestamp; only breaches ingested after it."}},"additionalProperties":false,"required":["domain"]},"annotations":{"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false},"x-xonplus-key":"xonPartner"},{"name":"partner_list_domains","title":"List your submitted domains","description":"The partner's submitted domains with validation status, processing status, record counts and quota information. Requires an xonPartner API key. Returns 100 rows by default (limit up to 500); to see more, pass the response's next_page_token as cursor and repeat until it is null. Never guess page numbers. Filter with domain (exact, or a wildcard such as *.example.com), domain_status or processing_status. Each page is one request against the key's rate limit.","inputSchema":{"type":"object","properties":{"domain":{"type":"string","description":"Exact domain or wildcard pattern with *."},"domain_status":{"type":"string","enum":["pending_validation","approved","rejected","pending_approval"]},"processing_status":{"type":"string","enum":["queued","processing","completed","failed","pending_approval","large_domain_approved","large_domain_rejected"]},"limit":{"type":"integer","minimum":1,"maximum":500,"default":100},"cursor":{"type":"string","description":"next_page_token from the previous page."}},"additionalProperties":false},"annotations":{"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false},"x-xonplus-key":"xonPartner"},{"name":"partner_quota","title":"Domain quota status","description":"How many domain slots the partner's plan allows, how many are used (active plus deleted this month), how many are free, and the per-upload caps. Requires an xonPartner API key. Call this before submitting domains to know whether they fit.","inputSchema":{"type":"object","properties":{},"additionalProperties":false},"annotations":{"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false},"x-xonplus-key":"xonPartner"},{"name":"partner_batch_status","title":"Status of a bulk domain submission","description":"Progress of a bulk submission by its batch_id: counts of accepted, rejected and pending domains and the per-domain outcomes. Requires an xonPartner API key. Unknown batch ids return a not-found result.","inputSchema":{"type":"object","properties":{"batch_id":{"type":"string","description":"The batch id returned by a bulk submission."}},"additionalProperties":false,"required":["batch_id"]},"annotations":{"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false},"x-xonplus-key":"xonPartner"},{"name":"partner_submit_domain","title":"Submit a domain for validation","description":"Submit one domain to the partner's portfolio. Requires an xonPartner API key, a free quota slot and confirm=true. Every accepted domain holds one quota slot until the end of the current UTC month, even if it is deleted later. Check partner_quota first and submit only domains the user named. The domain is validated and then queued for breach processing; large domains may wait for admin approval. Re-submitting a domain that is already in the portfolio returns a 409 error result, so retrying after a timeout is safe. Follow progress with partner_list_domains. This tool has a tighter per-key rate limit than the REST route.","inputSchema":{"type":"object","properties":{"domain":{"type":"string","description":"The domain to add, e.g. example.com."},"confirm":{"type":"boolean","description":"Must be true: the user approved spending a slot on this domain."}},"additionalProperties":false,"required":["domain","confirm"]},"annotations":{"readOnlyHint":false,"destructiveHint":true,"idempotentHint":true,"openWorldHint":false},"x-xonplus-key":"xonPartner"},{"name":"partner_submit_domains","title":"Submit many domains for validation","description":"Submit a list of domains in one call (the REST bulk upload without a file). Requires an xonPartner API key and confirm=true. Every accepted domain holds one quota slot until the end of the current UTC month, even if it is deleted later. Check partner_quota first and submit only domains the user named. Up to 1000 entries; the route applies the per-upload cap and the quota exactly as for a file upload and returns a batch_id plus accepted / rejected counts (invalid, duplicate, over quota). Duplicates within the list and against the portfolio are skipped, so a retry does not double-submit. Poll partner_batch_status with the batch_id. This tool has a tighter per-key rate limit than the REST route.","inputSchema":{"type":"object","properties":{"domains":{"type":"array","items":{"type":"string"},"minItems":1,"maxItems":1000,"description":"Domains to add."},"confirm":{"type":"boolean","description":"Must be true: the user approved one slot per accepted domain."}},"additionalProperties":false,"required":["domains","confirm"]},"annotations":{"readOnlyHint":false,"destructiveHint":true,"idempotentHint":true,"openWorldHint":false},"x-xonplus-key":"xonPartner"},{"name":"partner_delete_domain","title":"Delete a domain from your portfolio","description":"Remove a domain from the partner's portfolio. Requires an xonPartner API key and confirm=true. The slot stays used until the end of the current UTC month; a domain cannot be deleted while its validation or processing is running (400 error result). Deleting an already deleted domain succeeds with 'already deleted', so a retry is safe. This tool has a tighter per-key rate limit than the REST route.","inputSchema":{"type":"object","properties":{"domain":{"type":"string","description":"The domain to delete."},"confirm":{"type":"boolean","description":"Must be true; the user has approved the deletion."}},"additionalProperties":false,"required":["domain","confirm"]},"annotations":{"readOnlyHint":false,"destructiveHint":true,"idempotentHint":true,"openWorldHint":false},"x-xonplus-key":"xonPartner"}]}