plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "haveibeensquatted",
  "version": "1.1.2",
  "description": "Analyze domains, hunt lookalikes and search certificate transparency; triage your organization's detections and alerts, send responses to its connected tools, and manage its domains, rules and takedowns.",
  "author": {
    "name": "Have I Been Squatted",
    "url": "https://haveibeensquatted.com"
  },
  "homepage": "https://haveibeensquatted.com",
  "repository": "https://github.com/haveibeensquatted/agent-plugins",
  "license": "MIT",
  "keywords": [
    "security",
    "typosquatting",
    "lookalike-domains",
    "certificate-transparency",
    "brand-protection",
    "takedowns",
    "threat-intelligence",
    "mcp"
  ],
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "Have I Been Squatted",
        "shortDescription": "Catch attacker infrastructure",
        "longDescription": "Have I Been Squatted finds attacker infrastructure while it is being set up. Lookalike domains, mail servers, staging hosts and their certificates often appear before a phishing campaign launches. This plugin brings detection, investigation and response for them into ChatGPT and Codex.\n\nEnrich and hunt, for any domain\n- Analyze: live DNS, mail, registration, hosting, HTTP and classification for one domain, with a verdict profile and an interactive view with a screenshot and hosting map. Fast depth takes under a minute; slow depth renders the page and reports what it asks visitors for, such as passwords, one-time codes or payment data.\n- Certificate transparency search: find certificate names matching a pattern, such as lookalike spellings of your brand, with the last time each was seen. Answers immediately.\n- Typosquat scan: generate permutations of a domain and check which are registered or live, ranked by evidence. Typically 5 to 10 minutes.\n- Discover: find unregistered lookalikes of a domain that could still be registered defensively.\n\nWork your organization's detections\n- Query: search lookalikes found for your monitored domains, and Email Intelligence and Site Canary events, from the last 30 days. The model reads the field catalog before writing a query, so you can ask in plain language.\n- Alerts: review the alerts your detection rules raised, the evidence each cites and whether each response reached its destination, then resolve, ignore or mark them false positive.\n- Results: tag a result as owned, ignored, false positive or malicious; the tag carries over to later results for the same domain. Add a domain you analyzed to a monitored domain's results.\n- Rules: list, validate, create, update, enable, disable and delete detection rules and the responses they trigger in your connected tools.\n- Responses: send one result to a connected tool now, outside any rule, such as a SIEM finding, a Slack message or a block in Microsoft Defender or Cloudflare Gateway, and check that it was delivered.\n- Monitored domains: list, add, tune and remove the domains you monitor.\n- Takedowns: open a managed takedown case for a malicious domain, follow its timeline, add updates and link related alerts.\n\nBackground jobs\nScans and deeper analyses take longer than a single reply. They start a background job and return straight away; ask for the status later in the conversation to get ranked results. Jobs expire after 24 hours, and each organization runs three at a time.\n\nChanges\nTools that change your organization's data need an organization admin, and ChatGPT asks you to confirm each one. Takedown cases are reviewed by the Have I Been Squatted operations team before any report reaches a registrar or host. Sending a response changes your own security tools; the monitored domain itself is never blocked. Removing a monitored domain or deleting a rule cannot be undone.\n\nExample prompts\n- \"Show this week's lookalike detections for my organization and group them by monitored domain.\"\n- \"Which alerts are still active, and did their Splunk responses get delivered?\"\n- \"Analyze secure-examp1e-login.com and tell me whether it is live and what it is hosting.\"\n- \"Create a rule that alerts on lookalikes of example.com within one character that ask visitors for a password.\"\n\nAccess requirements\n- Requires a Have I Been Squatted account. You sign in with OAuth and choose which organization to connect; every call is scoped to that organization and to your role in it.\n- Lookups work for every account. Organization tools need domain monitoring, and querying detections needs at least one monitored domain with a completed scan.\n- Email Intelligence, Site Canary and Takedowns tools work when those features are enabled for your organization; the plugin lists only the tools your organization can use.",
        "developerName": "Have I Been Squatted",
        "category": "Security",
        "capabilities": [
          "Analyze any domain live: DNS, registration, hosting, HTTP, classification and a verdict, with a screenshot view",
          "Search certificate transparency logs for certificate names matching a pattern",
          "Scan a domain for registered and live typosquats, ranked by evidence",
          "Find unregistered lookalikes of a domain that could still be registered defensively",
          "Query your organization's lookalike, Email Intelligence and Site Canary detections from the last 30 days",
          "Review and triage the alerts your detection rules raised, and check where each response was delivered",
          "Tag results as owned, ignored, false positive or malicious (organization admins)",
          "Create, test, update, toggle and delete detection rules and their responses (organization admins)",
          "List, add, tune and remove monitored domains (organization admins)",
          "Open and follow managed takedown cases (organization admins)",
          "Send one result to a connected SIEM, chat or security control and check its delivery (organization admins)"
        ],
        "websiteURL": "https://haveibeensquatted.com",
        "supportURL": "https://haveibeensquatted.com/contact",
        "privacyPolicyURL": "https://haveibeensquatted.com/about/privacy",
        "termsOfServiceURL": "https://haveibeensquatted.com/about/terms",
        "defaultPrompt": [
          "Triage this week's lookalike detections for my organization and flag the ones that look malicious",
          "Which alerts did my organization's rules raise this week, and which still need attention?",
          "Analyze this suspicious domain and tell me whether it looks like phishing infrastructure"
        ],
        "brandColor": "#0A0A0A",
        "composerIcon": "./assets/icon.png",
        "logo": "./assets/logo.png"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Query recent lookalike detections and tag one as malicious",
              "prompt": "Show lookalikes of openai.com found in the last 7 days with MX records, and mark the most suspicious one malicious.",
              "tools_triggered": "describe_catalog, query, annotate_result",
              "expected_behavior": "Reads the field catalog, runs a 7-day query and lists records with mail servers. Asks the user to confirm before tagging, then tags the chosen result malicious and reports changed: true."
            },
            {
              "description": "Triage alerts and check response delivery",
              "prompt": "Which alerts are still active? Explain the newest one and whether its responses were delivered, then resolve it.",
              "tools_triggered": "list_alerts, get_alert, set_alert_status",
              "expected_behavior": "Lists active alerts with rule and domain, explains the newest alert's evidence and each response's delivery state, asks to confirm, then sets it to resolved and reports it as updated."
            },
            {
              "description": "Create a detection rule after validating it",
              "prompt": "Create a rule that alerts on lookalikes of openai.com within one character that ask visitors for a password.",
              "tools_triggered": "describe_catalog, validate_rule, create_rule",
              "expected_behavior": "Writes an expression, validates it first, shows the rule and asks to confirm, then creates it and returns the rule_id with source domain."
            },
            {
              "description": "Analyze a suspicious domain and show the domain view",
              "prompt": "Analyze billingchatgpt.com and show it to me.",
              "tools_triggered": "analyze, get_job, show_domain",
              "expected_behavior": "Starts an analysis, polls until it completes, summarizes the verdict and the most telling signals, and renders the domain view with screenshot and hosting map."
            },
            {
              "description": "Search certificate transparency for brand impersonation",
              "prompt": "Search certificate transparency for certificates imitating openai.com in the last 30 days.",
              "tools_triggered": "ct_search",
              "expected_behavior": "Returns matching certificate names with their last-seen times in the same reply."
            }
          ],
          "negative": [
            {
              "description": "Checking a personal email or password for data breaches (a similar name, but a different service)",
              "prompt": "Has my email address been in a data breach?"
            },
            {
              "description": "Buying or registering a domain",
              "prompt": "Register the domain example-shop.com for me and tell me what it costs."
            },
            {
              "description": "Configuring DNS or email authentication",
              "prompt": "Set up SPF, DKIM and DMARC records for my domain."
            }
          ]
        },
        "demo_recording_url": "https://youtu.be/VwdAOKK94qI",
        "commerce": false
      },
      "publication": {
        "release_notes": "Adds organization tools on top of the initial lookup and query tools: detection rules (list, validate, create, update, enable/disable, delete), alert triage, monitored domains, retroactive results, takedown cases (Takedowns add-on) and one-off responses to connected tools. dispatch_action sends one result to a connected SIEM, chat, webhook or security control outside any rule, and list_dispatches shows its delivery. query now also searches Email Intelligence and Site Canary events. show_domain and show_domains render an interactive view of a scanned domain or a scan's results. Every tool that changes data requires an organization admin and its own OAuth scope; dispatch_action, create_takedown, remove_domain and delete_rule tell the model to confirm with the user first."
      },
      "apps": "./.app.json"
    }
  }
}