Have I Been Pwned

Breach intelligence API: email search, domain monitoring, passwords and stealer logs.

CommunityOnlineNo sign-inGlobalFreeRead-only

What it can do

    What data it sees

    Do you need an account

    No: the server works without sign-in

    Breach intelligence API: email search, domain monitoring, passwords and stealer logs.

    How to connect

    How to connect Have I Been Pwned to Claude

    The server address to paste into Claude settings:

    https://haveibeenpwned.com/mcp

    1. Open Claude (claude.ai or the desktop app).
    2. Go to Settings → Connectors.
    3. Click Add custom connector.
    4. Paste the server address copied below into Remote MCP server URL and click Add.
    5. In a chat, click + → Connectors and switch the new connector on.

    Custom connectors are available on Free, Pro, Max, Team and Enterprise plans (Free is limited to one). On Team and Enterprise an organization Owner adds the connector first under Organization settings → Connectors.

    Authorization

    After you click Add, a sign-in window for the service opens. Sign in with your own account and approve access. Claude never sees your password.

    How to connect Have I Been Pwned to ChatGPT

    The server address to paste into ChatGPT settings:

    https://haveibeenpwned.com/mcp

    1. Open ChatGPT in a browser (chatgpt.com). A Plus, Pro, Business, Enterprise or Edu plan is required.
    2. Turn on developer mode once: Settings → Apps → Advanced settings → Developer mode.
    3. Open Settings → Connectors and click Create.
    4. Fill in the form: Name (anything), Description (one line about what the service does), MCP server URL (copy it below).
    5. Under Authentication choose OAuth if the service requires sign-in, otherwise None. Click Create.
    6. In a new chat open + → Apps/Connectors and enable the connector.

    OpenAI has renamed this section before (Connectors → Apps/Plugins). If the label differs, search settings for "developer mode". On Business/Enterprise workspaces an admin must allow custom connectors first.

    Authorization

    On first use ChatGPT opens the service's sign-in window. Sign in and approve access.

    How to connect Have I Been Pwned to Cursor

    The server address to paste into Cursor settings:

    https://haveibeenpwned.com/mcp

    Fastest: click Open in Cursor below and confirm the prompt.

    Manually:

    1. In Cursor open Settings → Cursor Settings → MCP and click Add new global MCP server.
    2. Paste the JSON copied below into ~/.cursor/mcp.json (per project: .cursor/mcp.json in the repo root).
    3. Save the file. The server appears in the MCP list; authorize it there if asked.

    Authorization

    If the service needs sign-in, an authorize button appears next to the server in the MCP list.

    Server tool list (17)

    Raw names from tools/list. Only developers need these.

    hibp_list_breachesList public HIBP breaches, optionally filtered by domain, spam-list flag, and verification status.
    hibp_get_breachLook up a single public HIBP breach by its canonical breach name, such as Adobe.
    hibp_get_latest_breachReturn the most recently added public breach currently loaded into HIBP.
    hibp_list_data_classesList the data classes used across public HIBP breach models, such as email addresses or passwords.
    hibp_get_pwned_passwords_rangeQuery the public Pwned Passwords k-anonymity API with a 5-character SHA-1 or NTLM prefix and return matching suffixes with prevalence counts.
    hibp_get_breached_accountSearch HIBP for breaches affecting a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; use domain and verification filters to refine the result.
    hibp_get_breached_account_rangeQuery the authenticated HIBP k-anonymity breached-account range endpoint with the first 6 characters of a SHA-1 email hash. Requires a subscription with k-anonymity access; compare each returned suffix with the remaining hash characters locally because a prefix alone cannot identify an account.
    hibp_get_paste_accountSearch for public pastes containing a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; run this separately from breached-account lookup.
    hibp_get_breached_domainReturn breached aliases for a verified domain. This tool requires an authorized subscription via OAuth bearer token.
    hibp_list_subscribed_domainsList the domains associated with the authenticated HIBP subscription.
    hibp_get_subscription_statusReturn the current plan, quotas, rate limits, expiry, and feature flags for the active HIBP API subscription linked to the authenticated OAuth connection. Use it to confirm access before feature-dependent lookups.
    hibp_get_stealer_logs_by_emailReturn website domains historically observed in stealer logs for an email address. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
    hibp_get_stealer_logs_by_website_domainReturn email addresses historically observed in stealer logs for a website domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
    hibp_get_stealer_logs_by_email_domainReturn email aliases and associated website domains historically observed in stealer logs for an email domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
    hibp_generate_domain_verification_dns_tokenGenerate the TXT record value required to verify domain control via DNS, creating or reusing the private HIBP domain-verification records needed for the request. Requires an authenticated subscription with domain-verification access.
    hibp_verify_domain_verification_dns_tokenComplete domain verification by checking the expected HIBP TXT record on the target domain. Requires an authenticated subscription with domain-verification access.
    hibp_send_domain_verification_emailSend a domain verification email to an approved alias such as admin or security. Requires an authenticated subscription with domain-verification access.