Skip to content
mcp/harbor
Verified official

Have I Been Pwned MCP

v1.0.0

io.github.troyhunt/hibp

Breach intelligence API: email search, domain monitoring, passwords and stealer logs.

transport:streamable-http tools:17

Target client

run in your project directory 

claude mcp add --transport http hibp https://haveibeenpwned.com/mcp

setup guides: Claude Code Claude Desktop Cursor VS Code Zed Windsurf Cline Gemini CLI Grok ChatGPT Claude.ai LangChain

Adds it for this project only. Append --scope user to make it available everywhere. Claude Code docs

hibp_list_breaches

hibp list breaches

hibp_get_breach

hibp get breach

hibp_get_latest_breach

hibp get latest breach

hibp_list_data_classes

hibp list data classes

hibp_get_pwned_passwords_range

hibp get pwned passwords range

hibp_get_breached_account

hibp get breached account

hibp_get_breached_account_range

hibp get breached account range

hibp_get_paste_account

hibp get paste account

hibp_get_breached_domain

hibp get breached domain

hibp_list_subscribed_domains

hibp list subscribed domains

hibp_get_subscription_status

hibp get subscription status

hibp_get_stealer_logs_by_email

hibp get stealer logs by email

hibp_get_stealer_logs_by_website_domain

hibp get stealer logs by website domain

hibp_get_stealer_logs_by_email_domain

hibp get stealer logs by email domain

hibp_generate_domain_verification_dns_token

hibp generate domain verification dns token

hibp_verify_domain_verification_dns_token

hibp verify domain verification dns token

hibp_send_domain_verification_email

hibp send domain verification email

All 17 tools, one page each

2 prompts you invoke yourself

500 resources you attach as context

Mutating and Read-only are read off each tool's name, not its schema — a hint, not a guarantee. Check the server's own documentation before granting access.