mcpbeat

Have I Been Pwned MCP Server

io.github.troyhunt/hibp
answering

Have I Been Pwned is answering right now. Last checked moments ago. It exposes 17 tools.

Breach intelligence API: email search, domain monitoring, passwords and stealer logs.

Uptime history 41 hours of history
41 hours agonow
100.0%
Uptime 24h
92 of 92 checks
17
Tools
read from the server
44 ms
Response time
average over 24h
open, no key
Access
streamable-http

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 0 min ago.

run in your terminal
claude mcp add hibp --transport http https://haveibeenpwned.com/mcp
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "hibp": {
      "url": "https://haveibeenpwned.com/mcp"
    }
  }
}
~/.codex/config.toml
[mcp_servers.hibp]
url = "https://haveibeenpwned.com/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "hibp": {
      "url": "https://haveibeenpwned.com/mcp"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "hibp": {
      "url": "https://haveibeenpwned.com/mcp"
    }
  }
}

Available tools 17

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

hibp
hibp_generate_domain_verification_dns_token
Generate the TXT record value required to verify domain control via DNS. Requires an authenticated subscription with domain-verification access.
hibp_get_breach
Look up a single public HIBP breach by its canonical breach name, such as Adobe.
hibp_get_breached_account
Search HIBP for breaches affecting a single email address. This tool requires an OAuth bearer token.
hibp_get_breached_account_range
Query the authenticated HIBP k-anonymity breached-account range endpoint with the first 6 characters of a SHA-1 email hash.
hibp_get_breached_domain
Return breached aliases for a verified domain. This tool requires an authorized subscription via OAuth bearer token.
hibp_get_latest_breach
Return the most recently added public breach currently loaded into HIBP.
hibp_get_paste_account
Search for public pastes containing an email address. This tool requires an OAuth bearer token.
hibp_get_pwned_passwords_range
Query the public Pwned Passwords k-anonymity API with a 5-character SHA-1 or NTLM prefix and return matching suffixes with prevalence counts.
hibp_get_stealer_logs_by_email
Return website domains observed in stealer logs for an email address. Requires an authenticated subscription with stealer-log access.
hibp_get_stealer_logs_by_email_domain
Return email aliases and associated website domains observed in stealer logs for an email domain. Requires an authenticated subscription with stealer-log access.
hibp_get_stealer_logs_by_website_domain
Return email addresses observed in stealer logs for a website domain. Requires an authenticated subscription with stealer-log access.
hibp_get_subscription_status
Return the current subscription details and feature flags for the authenticated OAuth-linked HIBP subscription.
hibp_list_breaches
List public HIBP breaches, optionally filtered by domain, spam-list flag, and verification status.
hibp_list_data_classes
List the data classes used across public HIBP breach models, such as email addresses or passwords.
hibp_list_subscribed_domains
List the domains associated with the authenticated HIBP subscription.
hibp_send_domain_verification_email
Send a domain verification email to an approved alias such as admin or security. Requires an authenticated subscription with domain-verification access.
hibp_verify_domain_verification_dns_token
Complete domain verification by checking the expected HIBP TXT record on the target domain. Requires an authenticated subscription with domain-verification access.

Endpoints

URLTransportStateLatencyChecked
https://haveibeenpwned.com/mcp streamable-http answering 63 ms 0 min ago

Have I Been Pwned — questions

Answers built from our own checks of this server.

What can Have I Been Pwned do?
It exposes 17 tools, read directly from the server on our last check. Among them: hibp_generate_domain_verification_dns_token, hibp_get_breach, hibp_get_breached_account, hibp_get_breached_account_range, hibp_get_breached_domain, hibp_get_latest_breach and 11 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Have I Been Pwned working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 92 of 92 checks got a reply (100.0%), average response time 44 ms. The bar chart above shows every period we have measured.
How do I connect Have I Been Pwned?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Have I Been Pwned need an API key?
No. Have I Been Pwned completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 17 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Have I Been Pwned?
It answers our handshake in 44 ms on average, which is faster than 98% of all working MCP servers we measure. That puts it in the quick quarter of the ecosystem. The comparison comes from our own checks across the whole registry, every 15 minutes.