Have I Been Pwned

Working · 1.5 s

io.github.troyhunt/hibpv1.0.0

Breach intelligence API: email search, domain monitoring, passwords and stealer logs.

Security

Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://haveibeenpwned.com/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

hibp_generate_domain_verification_dns_token

Generate the TXT record value required to verify domain control via DNS, creating or reusing the private HIBP domain-verification records needed for the request. Requires an authenticated subscription with domain-verification access.

domainstring, required

The domain to generate a verification token for.

response_formatstring

Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Tools (17)

hibp_generate_domain_verification_dns_token

Argument	Type	Description
domain*	string	The domain to generate a verification token for.
response_format	string	Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

Input schema (JSON)

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "description": "The domain to generate a verification token for."
    },
    "response_format": {
      "enum": [
        "markdown",
        "json"
      ],
      "type": "string",
      "default": "markdown",
      "description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent."
    }
  }
}

Try it

Call this server's tools from your browser. Nothing to install.

https://haveibeenpwned.com/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

hibp_generate_domain_verification_dns_token

domainstring, required

The domain to generate a verification token for.

response_formatstring

Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

This tool isn't marked read-only, so it may change something on the server or in an account you connected.

I understand, run it anyway

Tools (17)

hibp_generate_domain_verification_dns_token

Argument	Type	Description
domain*	string	The domain to generate a verification token for.
response_format	string	Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

Input schema (JSON)

{
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "description": "The domain to generate a verification token for."
    },
    "response_format": {
      "enum": [
        "markdown",
        "json"
      ],
      "type": "string",
      "default": "markdown",
      "description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent."
    }
  }
}

Argument

Type

Description

limit

integer

Maximum number of items to include in the response. Defaults to 25.

domain

string

Filter results to a specific breach domain.

offset

integer

Number of items to skip before returning results. Defaults to 0.

account*

string

The email address to search for.

responseMode

string

Choose full breach objects, truncated objects, or breach names.

response_format

string

Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

includeUnverified

boolean

Include unverified breaches. Defaults to true.

{ "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "account" ], "properties": { "limit": { "type": "integer", "default": 25, "maximum": 100, "minimum": 1, "description": "Maximum number of items to include in the response. Defaults to 25." }, "domain": { "type": "string", "description": "Filter results to a specific breach domain." }, "offset": { "type": "integer", "default": 0, "maximum": 9007199254740991, "minimum": 0, "description": "Number of items to skip before returning results. Defaults to 0." }, "account": { "type": "string", "description": "The email address to search for." }, "responseMode": { "enum": [ "full", "truncated", "names" ], "type": "string", "default": "full", "description": "Choose full breach objects, truncated objects, or breach names." }, "response_format": { "enum": [ "markdown", "json" ], "type": "string", "default": "markdown", "description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent." }, "includeUnverified": { "type": "boolean", "default": true, "description": "Include unverified breaches. Defaults to true." } } }

Argument

Type

Description

limit

integer

Maximum number of items to include in the response. Defaults to 25.

offset

integer

Number of items to skip before returning results. Defaults to 0.

prefix*

string

The first 6 hexadecimal characters of the SHA-1 hash of an email address. Compare each returned suffix with the remaining 34 characters locally; a prefix alone does not identify an account.

response_format

string

Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

{ "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "prefix" ], "properties": { "limit": { "type": "integer", "default": 25, "maximum": 100, "minimum": 1, "description": "Maximum number of items to include in the response. Defaults to 25." }, "offset": { "type": "integer", "default": 0, "maximum": 9007199254740991, "minimum": 0, "description": "Number of items to skip before returning results. Defaults to 0." }, "prefix": { "type": "string", "pattern": "^[0-9A-Fa-f]{6}$", "description": "The first 6 hexadecimal characters of the SHA-1 hash of an email address. Compare each returned suffix with the remaining 34 characters locally; a prefix alone does not identify an account." }, "response_format": { "enum": [ "markdown", "json" ], "type": "string", "default": "markdown", "description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent." } } }

Argument

Type

Description

mode

string

Use SHA-1 by default or NTLM when mode is set to ntlm.

limit

integer

Maximum number of items to include in the response. Defaults to 25.

offset

integer

Number of items to skip before returning results. Defaults to 0.

prefix*

string

The first 5 hexadecimal characters of a SHA-1 or NTLM hash.

addPadding

boolean

Send the Add-Padding header and discard padded zero-count entries.

response_format

string

Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

{ "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "prefix" ], "properties": { "mode": { "enum": [ "sha1", "ntlm" ], "type": "string", "default": "sha1", "description": "Use SHA-1 by default or NTLM when mode is set to ntlm." }, "limit": { "type": "integer", "default": 25, "maximum": 100, "minimum": 1, "description": "Maximum number of items to include in the response. Defaults to 25." }, "offset": { "type": "integer", "default": 0, "maximum": 9007199254740991, "minimum": 0, "description": "Number of items to skip before returning results. Defaults to 0." }, "prefix": { "type": "string", "pattern": "^[0-9A-Fa-f]{5}$", "description": "The first 5 hexadecimal characters of a SHA-1 or NTLM hash." }, "addPadding": { "type": "boolean", "default": false, "description": "Send the Add-Padding header and discard padded zero-count entries." }, "response_format": { "enum": [ "markdown", "json" ], "type": "string", "default": "markdown", "description": "Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent." } } }

Argument	Type	Description
name*	string	The breach name to retrieve, for example Adobe.
response_format	string	Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

Argument	Type	Description
email*	string	The email address to search for in stealer logs.
limit	integer	Maximum number of items to include in the response. Defaults to 25.
offset	integer	Number of items to skip before returning results. Defaults to 0.
response_format	string	Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

Argument	Type	Description
domain*	string	The domain to verify by email.
emailAlias*	string	The approval alias to send the verification email to, for example admin.
response_format	string	Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

Argument	Type	Description
domain*	string	The domain to verify by DNS.
response_format	string	Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.