Your Data · Attack Surface

`list_my_exposed_credentials`

List breached/leaked credentials discovered for your domains: email, username and breach source, plus a total and a breakdown by source. Actual passwords (plaintext and hashes) are never returned — only flags indicating their presence. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Scope: mcp:org · Response shape: jsonb

Returns data scoped to your own organisation only — the organisation is resolved from your API key and injected server-side, never read from the request.

Passwords are never exposed

The underlying password_plaintext and password_hash values are intentionally omitted from MCP responses. This tool returns only the has_plaintext and has_hash presence flags, so you can gauge exposure severity without ever handling the credentials themselves.

Parameters

limitintegeroptionaldefault: 100

Maximum number of credential records to return in items. Accepted range: 1–500.

Example invocation

Ask your agent: "Have any of our corporate emails shown up in breaches?"

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_my_exposed_credentials","arguments":{"limit":100}}}'

Response

result.content[0].text (parsed)

{
  "total": 960,
  "by_source": {
    "LinkedIn": 848,
    "Adobe": 112
  },
  "returned": 2,
  "note": "Password plaintext and hash values are intentionally omitted. Only has_plaintext and has_hash presence flags are returned.",
  "items": [
    {
      "email": "alice@precursorsecurity.com",
      "username": "alice",
      "breach_source": "LinkedIn",
      "hash_algorithm": "SHA1",
      "has_plaintext": false,
      "has_hash": true,
      "created_at": "2026-03-11T00:00:00.000Z"
    },
    {
      "email": "bob@precursorsecurity.com",
      "username": "bob",
      "breach_source": "Adobe",
      "hash_algorithm": null,
      "has_plaintext": true,
      "has_hash": false,
      "created_at": "2026-02-27T00:00:00.000Z"
    }
  ],
  "generated_at": "2026-06-18T08:15:00.000Z"
}

The full MCP envelope, including _meta.precursor with request_id, credits, and response_truncated, is documented in Response Format.

Response fields

totalintegeroptional

Total number of breached credential matches for your organisation, across all sources (not limited by limit).

by_sourceobjectoptional

Breakdown of the total by breach source name, mapping each source to its match count, e.g. { "LinkedIn": 848, "Adobe": 112 }.

returnedintegeroptional

Number of credential records included in items (equals items.length).

notestringoptional

A fixed advisory explaining that password plaintext and hash values are omitted, and only presence flags are returned.

itemsarrayoptional

Breached credential records discovered for your domains. Each object contains the fields below.

items[].emailstringoptional

The exposed email address.

items[].usernamestring | nulloptional

The exposed username, when present in the breach data.

items[].breach_sourcestringoptional

The name of the breach the credential was found in, e.g. LinkedIn.

items[].hash_algorithmstring | nulloptional

The password hashing algorithm recorded in the breach, e.g. SHA1. null when no hash was present.

items[].has_plaintextbooleanoptional

Whether a plaintext password was present in the breach. The password value itself is never returned.

items[].has_hashbooleanoptional

Whether a password hash was present in the breach. The hash value itself is never returned.

items[].created_atstringoptional

ISO 8601 timestamp of when the record was ingested (UTC).

generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Code	Message	When
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:500`	`limit` exceeds 500
`-32001`	`unauthorized`	The API key is invalid/revoked, the IP is not allowed, or the key lacks the `mcp:org` scope.
`-32002`	`insufficient_credits`	Your credit balance is zero; top up from the dashboard
`-32603`	`internal`	Unexpected server error; the credit is automatically refunded