Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "hibp": {
      "type": "http",
      "url": "https://haveibeenpwned.com/mcp"
    }
  }
}

claude mcp add --transport http hibp https://haveibeenpwned.com/mcp

[mcp_servers.hibp]
url = "https://haveibeenpwned.com/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hibp": {
      "type": "remote",
      "url": "https://haveibeenpwned.com/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "hibp": {
      "type": "http",
      "url": "https://haveibeenpwned.com/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=hibp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vaGF2ZWliZWVucHduZWQuY29tL21jcCJ9"
}

{
  "servers": {
    "hibp": {
      "type": "http",
      "url": "https://haveibeenpwned.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "hibp": {
      "httpUrl": "https://haveibeenpwned.com/mcp"
    }
  }
}

extensions:
  "hibp":
    enabled: true
    name: "hibp"
    type: streamable_http
    uri: "https://haveibeenpwned.com/mcp"
    timeout: 300

Quality 100 / 100good

protocol100 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
pass
protocol.list_ttltool list is cacheable (ttlMs 3600000)

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene100 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations17 of 17 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
pass
tools.token_costabout 4,010 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

17 tools, about 4,010 tokens to load them all · tool set 3a9ea3b4dd00 · checked 2026-10-20 11:08 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 74 / 100

no-repository

provenance35

liveness100

freshness85

hygiene80

+reachable +uptime-100% ~updated-90d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://haveibeenpwned.com/mcp` streamable-http	none	yes	100%	164 ms	2026-07-28	2026-10-20

Tools (17)

`hibp_generate_domain_verification_dns_token`	Generate the TXT record value required to verify domain control via DNS, creating or reusing the private HIBP domain-verification records needed for the request. Requires an authenticated subscription with domain-verification access.
`hibp_get_breach`read-only	Look up a single public HIBP breach by its canonical breach name, such as Adobe.
`hibp_get_breached_account`read-only	Search HIBP for breaches affecting a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; use domain and verification filters to refine the result.
`hibp_get_breached_account_range`read-only	Query the authenticated HIBP k-anonymity breached-account range endpoint with the first 6 characters of a SHA-1 email hash. Requires a subscription with k-anonymity access; compare each returned suffix with the remaining hash characters locally because a prefix alone cannot identify an account.
`hibp_get_breached_domain`read-only	Return breached aliases for a verified domain. This tool requires an authorized subscription via OAuth bearer token.
`hibp_get_latest_breach`read-only	Return the most recently added public breach currently loaded into HIBP.
`hibp_get_paste_account`read-only	Search for public pastes containing a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; run this separately from breached-account lookup.
`hibp_get_pwned_passwords_range`read-only	Query the public Pwned Passwords k-anonymity API with a 5-character SHA-1 or NTLM prefix and return matching suffixes with prevalence counts.
`hibp_get_stealer_logs_by_email`read-only	Return website domains historically observed in stealer logs for an email address. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
`hibp_get_stealer_logs_by_email_domain`read-only	Return email aliases and associated website domains historically observed in stealer logs for an email domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
`hibp_get_stealer_logs_by_website_domain`read-only	Return email addresses historically observed in stealer logs for a website domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
`hibp_get_subscription_status`read-only	Return the current plan, quotas, rate limits, expiry, and feature flags for the active HIBP API subscription linked to the authenticated OAuth connection. Use it to confirm access before feature-dependent lookups.
`hibp_list_breaches`read-only	List public HIBP breaches, optionally filtered by domain, spam-list flag, and verification status.
`hibp_list_data_classes`read-only	List the data classes used across public HIBP breach models, such as email addresses or passwords.
`hibp_list_subscribed_domains`read-only	List the domains associated with the authenticated HIBP subscription.
`hibp_send_domain_verification_email`	Send a domain verification email to an approved alias such as admin or security. Requires an authenticated subscription with domain-verification access.
`hibp_verify_domain_verification_dns_token`	Complete domain verification by checking the expected HIBP TXT record on the target domain. Requires an authenticated subscription with domain-verification access.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "io.github.troyhunt/hibp",
  "icons": [
    {
      "src": "https://haveibeenpwned.com/favicon-96x96.png",
      "sizes": [
        "96x96"
      ],
      "mimeType": "image/png"
    }
  ],
  "title": "Have I Been Pwned",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://haveibeenpwned.com/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.0.0",
  "description": "Breach intelligence API: email search, domain monitoring, passwords and stealer logs."
}