Have I Been Pwned

io.github.troyhuntPublished by GitHub account troyhuntv1.0.0Updated Oct 24, 2026

Breach intelligence API: email search, domain monitoring, passwords and stealer logs.

The publisher's own server: pwned.coffee

VerifiedStreamable HTTPWeb executableSecurity & Monitoring

Overview

AI-generated overview

Lets an assistant query Have I Been Pwned breach intelligence for email addresses, domains, passwords and stealer logs.

What you can do
This remote MCP server exposes Have I Been Pwned's breach intelligence API to an assistant. According to the registry description, it covers email search, domain monitoring, passwords and stealer logs. That means an assistant can look up whether an address appears in known breaches, check domain-level exposure, and check password or stealer-log data.
When to use it
Useful when an assistant needs to check whether an email address or domain has appeared in known data breaches, or to look up password and stealer-log exposure as part of a security or account-hygiene workflow.
Requirements
A remote streamable HTTP endpoint at haveibeenpwned.com; no packages, environment variables or headers are declared. Network access to that endpoint is required. The manifest declares no authentication, but the service may still require an API key depending on usage.
Before you install
The server sends the email addresses, domains or passwords you query to a third-party service, so treat queries as data shared outside your environment. Password and stealer-log lookups are sensitive; avoid submitting real credentials unless you accept that exposure. No credentials are declared in the manifest, but the underlying service may require an API key.

Installation

In SourceWeft

  1. Open Have I Been Pwned in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.troyhunt%2Fhibp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "have-i-been-pwned": {
      "type": "http",
      "url": "https://haveibeenpwned.com/mcp"
    }
  }
}

Tools

17

hibp_list_breaches

Have I Been Pwned - Breaches

List public HIBP breaches, optionally filtered by domain, spam-list flag, and verification status.

ParameterslimitdomainoffsetisSpamListresponse_formatincludeUnverified

hibp_get_breach

Have I Been Pwned - Breach

Look up a single public HIBP breach by its canonical breach name, such as Adobe.

Parametersnamerequiredresponse_format

hibp_get_latest_breach

Have I Been Pwned - Latest Breach

Return the most recently added public breach currently loaded into HIBP.

Parametersresponse_format

hibp_list_data_classes

Have I Been Pwned - Data Classes

List the data classes used across public HIBP breach models, such as email addresses or passwords.

Parametersresponse_format

hibp_get_pwned_passwords_range

Pwned Passwords Range Search

Query the public Pwned Passwords k-anonymity API with a 5-character SHA-1 or NTLM prefix and return matching suffixes with prevalence counts.

ParametersmodelimitoffsetprefixrequiredaddPaddingresponse_format

hibp_get_breached_account

Have I Been Pwned - Breached Account

Search HIBP for breaches affecting a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; use domain and verification filters to refine the result.

ParameterslimitdomainoffsetaccountrequiredresponseModeresponse_formatincludeUnverified

hibp_get_breached_account_range

Have I Been Pwned - Breached Account Range

Query the authenticated HIBP k-anonymity breached-account range endpoint with the first 6 characters of a SHA-1 email hash. Requires a subscription with k-anonymity access; compare each returned suffix with the remaining hash characters locally because a prefix alone cannot identify an account.

Parameterslimitoffsetprefixrequiredresponse_format

hibp_get_paste_account

Have I Been Pwned - Paste Account

Search for public pastes containing a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; run this separately from breached-account lookup.

Parameterslimitoffsetaccountrequiredresponse_format

hibp_get_breached_domain

Have I Been Pwned - Breached Domain

Return breached aliases for a verified domain. This tool requires an authorized subscription via OAuth bearer token.

Parameterslimitdomainrequiredoffsetresponse_format

hibp_list_subscribed_domains

Have I Been Pwned - Subscribed Domains

List the domains associated with the authenticated HIBP subscription.

Parameterslimitoffsetresponse_format

hibp_get_subscription_status

Have I Been Pwned - Subscription Status

Return the current plan, quotas, rate limits, expiry, and feature flags for the active HIBP API subscription linked to the authenticated OAuth connection. Use it to confirm access before feature-dependent lookups.

Parametersresponse_format

hibp_get_stealer_logs_by_email

Have I Been Pwned - Stealer Logs by Email

Return website domains historically observed in stealer logs for an email address. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.

Parametersemailrequiredlimitoffsetresponse_format

hibp_get_stealer_logs_by_website_domain

Have I Been Pwned - Stealer Logs by Website Domain

Return email addresses historically observed in stealer logs for a website domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.

Parameterslimitdomainrequiredoffsetresponse_format

hibp_get_stealer_logs_by_email_domain

Have I Been Pwned - Stealer Logs by Email Domain

Return email aliases and associated website domains historically observed in stealer logs for an email domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.

Parameterslimitdomainrequiredoffsetresponse_format

hibp_generate_domain_verification_dns_token

Have I Been Pwned - Generate Domain Verification DNS Token

Generate the TXT record value required to verify domain control via DNS, creating or reusing the private HIBP domain-verification records needed for the request. Requires an authenticated subscription with domain-verification access.

Parametersdomainrequiredresponse_format

hibp_verify_domain_verification_dns_token

Have I Been Pwned - Verify Domain Verification DNS Token

Complete domain verification by checking the expected HIBP TXT record on the target domain. Requires an authenticated subscription with domain-verification access.

Parametersdomainrequiredresponse_format

hibp_send_domain_verification_email

Have I Been Pwned - Send Domain Verification Email

Send a domain verification email to an approved alias such as admin or security. Requires an authenticated subscription with domain-verification access.

ParametersdomainrequiredemailAliasrequiredresponse_format

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.

Other Pwned integrations

pwned.coffee

coffee.pwnedOfficial publisher

pwned.coffee's hosted MCP server, published by pwned.coffee; no sign-in required; Streamable HTTP; 6 tools.

Streamable HTTPWeb executable
6 toolsNov 3, 2026

HaveIBeenPwned k-prefix shape, value discarded

Published by GitHub account sadri-dridi

Remote MCP endpoint bundling small utility tools (time, URL/JSON checks, HTTP status, geo, arithmetic) plus promotional "index" tools that route agents to…

Streamable HTTPWeb executable
Web Search & Scraping31 toolsNov 2, 2026