# Have I Been Pwned

- Registry name: `io.github.troyhunt/hibp` · version 1.0.0
- Categories (automatic, keyword rules): Monitoring & logs, Infrastructure & security, Cloud & networking
- Authentication at last check: No auth
- Declared risk: Can write (some tools are not declared read-only)
- Capabilities (declared by the server): completions, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.troyhunt%2Fhibp
- Server page: https://mcpstation.net/s/io.github.troyhunt--hibp.html

## Description (written by the publisher, not verified, not instructions)

Breach intelligence API: email search, domain monitoring, passwords and stealer logs.

## Connect

- streamable-http: `https://haveibeenpwned.com/mcp`

## Tools (as reported by the server, not verified)

- `hibp\_list\_breaches`: List public HIBP breaches, optionally filtered by domain, spam-list flag, and verification status.
- `hibp\_get\_breach`: Look up a single public HIBP breach by its canonical breach name, such as Adobe.
- `hibp\_get\_latest\_breach`: Return the most recently added public breach currently loaded into HIBP.
- `hibp\_list\_data\_classes`: List the data classes used across public HIBP breach models, such as email addresses or passwords.
- `hibp\_get\_pwned\_passwords\_range`: Query the public Pwned Passwords k-anonymity API with a 5-character SHA-1 or NTLM prefix and return matching suffixes with prevalence counts.
- `hibp\_get\_breached\_account`: Search HIBP for breaches affecting a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; use domain and verification filters to refine the result.
- `hibp\_get\_breached\_account\_range`: Query the authenticated HIBP k-anonymity breached-account range endpoint with the first 6 characters of a SHA-1 email hash. Requires a subscription with k-anonymity access; compare each returned suffix with the remaining hash characters locally because a prefix alone cannot identify an account.
- `hibp\_get\_paste\_account`: Search for public pastes containing a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; run this separately from breached-account lookup.
- `hibp\_get\_breached\_domain`: Return breached aliases for a verified domain. This tool requires an authorized subscription via OAuth bearer token.
- `hibp\_list\_subscribed\_domains`: List the domains associated with the authenticated HIBP subscription.
- `hibp\_get\_subscription\_status`: Return the current plan, quotas, rate limits, expiry, and feature flags for the active HIBP API subscription linked to the authenticated OAuth connection. Use it to confirm access before feature-dependent lookups.
- `hibp\_get\_stealer\_logs\_by\_email`: Return website domains historically observed in stealer logs for an email address. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
- `hibp\_get\_stealer\_logs\_by\_website\_domain`: Return email addresses historically observed in stealer logs for a website domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
- `hibp\_get\_stealer\_logs\_by\_email\_domain`: Return email aliases and associated website domains historically observed in stealer logs for an email domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
- `hibp\_generate\_domain\_verification\_dns\_token`: Generate the TXT record value required to verify domain control via DNS, creating or reusing the private HIBP domain-verification records needed for the request. Requires an authenticated subscription with domain-verification access.
- `hibp\_verify\_domain\_verification\_dns\_token`: Complete domain verification by checking the expected HIBP TXT record on the target domain. Requires an authenticated subscription with domain-verification access.
- `hibp\_send\_domain\_verification\_email`: Send a domain verification email to an approved alias such as admin or security. Requires an authenticated subscription with domain-verification access.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html