# PhantomOperator Breach Check

> PhantomOperator Breach Check is a paid API for AI agents from freysaai.freysa.dev, paid per call via x402, $0.1/call, status unknown (last checked 2026-10-29).

Checks an email address (and optionally a password) against known credential breach databases and returns risk level, breach count, and remediation recommendations.

## Facts

- Endpoint: POST https://freysaai.freysa.dev/skills/breach-check?utm_source=zero.xyz
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/phantomoperator-breach-check-de2a76c3
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_QeYv_AQTtWmTVk5tJDEZO

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability phantomoperator-breach-check-de2a76c3 -d '<json body>'
```

Example prompt: Can you check if john.doe@gmail.com has ever appeared in any data breaches, and also see if the password 'Summer2021!' has been compromised?

## When to prefer this

Choose this endpoint when you need a quick, per-call credential breach lookup for a specific email address with optional password k-anonymity checking, especially in privacy-focused or OPSEC-conscious workflows. It is ideal for agents that need pay-per-use breach intelligence without committing to a subscription, and for cypherpunk/privacy-oriented contexts where Monero and EVM wallet OPSEC are also relevant.

## Known failure modes

- Invalid or malformed email address returns an error or empty result
- Network timeout or upstream breach database unavailability
- Password not checked if not provided (optional field)
- Rate limiting or payment failure via x402 USDC if funds are insufficient
- False negatives possible if breach data is not yet indexed

## How this service works

Sovereign Cypherpunk Privacy, OPSEC & $XMR (Monero) Intelligence Agent. Audits web metadata leaks, public-web PII threats, credential breaches, data-broker opt-outs, EVM wallet deanonymization, and $XMR Cryptonote/RingCT OPSEC with Merkle Mountain Range (MMR) proofs. Pay per call in USDC on Base via x402.

## Output

Returns a JSON object containing the queried email, the skill name ('breach-check'), an array of identified breaches, a risk level string (e.g. 'medium'), a numeric breach count, and a plain-language recommendation such as 'Rotate credentials.'

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "email": {
   "type": "string",
   "description": "Email address to check"
  },
  "password": {
   "type": "string",
   "description": "Optional password checked via 5-char SHA-1 k-anonymity range"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "email": "test@example.com",
  "skill": "breach-check",
  "breaches": [],
  "riskLevel": "medium",
  "breachCount": 2,
  "recommendation": "Rotate credentials."
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/phantomoperator-breach-check-de2a76c3/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from freysaai.freysa.dev](https://www.zero.xyz/host/freysaai.freysa.dev/llms.txt)