# Have I Been Pwned (remote · haveibeenpwned.com)

Breach intelligence API: email search, domain monitoring, passwords and stealer logs.

- Trust score: 79/100 (medium)
- Change this week: +6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `haveibeenpwned.com`: 79/100 (this document), [markdown](https://verifymcp.io/servers/troyhunt-hibp/haveibeenpwned.md), [page](https://verifymcp.io/servers/troyhunt-hibp/haveibeenpwned)

## Channel facts

- Endpoint: `https://haveibeenpwned.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 83/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 21697 tokens (~20/item across 1045 items; 17 tools + 1028 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http troyhunt-hibp https://haveibeenpwned.com/mcp
```

### Codex

```toml
[mcp_servers.troyhunt-hibp]
url = "https://haveibeenpwned.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "troyhunt-hibp": {
      "type": "remote",
      "url": "https://haveibeenpwned.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add troyhunt-hibp --url https://haveibeenpwned.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  troyhunt-hibp:
    url: "https://haveibeenpwned.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "troyhunt-hibp": {
      "type": "http",
      "url": "https://haveibeenpwned.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 79, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 78, +1)

- [functional] Schema quality: good → excellent
- [functional] New resource “SplitVPN”

### 2026-07-31 (score 77, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 74, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 73, 0)

- [functional] Schema quality: excellent → good

### 2026-07-27 (score 73, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 72)

First indexed and scored.

## MCP tools (17)

### `hibp_list_breaches` (~150 tokens)

Have I Been Pwned - Breaches

List public HIBP breaches, optionally filtered by domain, spam-list flag, and verification status.

Input parameters:

- `domain` (string): Filter to breaches for a specific domain.
- `includeUnverified` (boolean): Include unverified breaches. Defaults to true.
- `isSpamList` (boolean): Filter to breaches that are or are not flagged as spam lists.
- `limit` (integer): Maximum number of items to include in the response. Defaults to 25.
- `offset` (integer): Number of items to skip before returning results. Defaults to 0.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `breaches` (array)
- `guidance` (string): Additional guidance for resolving the tool error.
- `hasMore` (boolean)
- `limit` (integer)
- `message` (string): Present when the tool returns an error.
- `nextOffset` (integer)
- `offset` (integer)
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `returnedCount` (integer)
- `statusCode` (integer): Present when the tool returns an error.
- `totalCount` (integer)

### `hibp_get_breach` (~71 tokens)

Have I Been Pwned - Breach

Look up a single public HIBP breach by its canonical breach name, such as Adobe.

Input parameters:

- `name` (string, required): The breach name to retrieve, for example Adobe.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `breach` (object)
- `guidance` (string): Additional guidance for resolving the tool error.
- `message` (string): Present when the tool returns an error.
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `statusCode` (integer): Present when the tool returns an error.

### `hibp_get_latest_breach` (~51 tokens)

Have I Been Pwned - Latest Breach

Return the most recently added public breach currently loaded into HIBP.

Input parameters:

- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `breach` (object)
- `guidance` (string): Additional guidance for resolving the tool error.
- `message` (string): Present when the tool returns an error.
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `statusCode` (integer): Present when the tool returns an error.

### `hibp_list_data_classes` (~56 tokens)

Have I Been Pwned - Data Classes

List the data classes used across public HIBP breach models, such as email addresses or passwords.

Input parameters:

- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `dataClasses` (array)
- `guidance` (string): Additional guidance for resolving the tool error.
- `message` (string): Present when the tool returns an error.
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `statusCode` (integer): Present when the tool returns an error.

### `hibp_get_pwned_passwords_range` (~180 tokens)

Pwned Passwords Range Search

Query the public Pwned Passwords k-anonymity API with a 5-character SHA-1 or NTLM prefix and return matching suffixes with prevalence counts.

Input parameters:

- `addPadding` (boolean): Send the Add-Padding header and discard padded zero-count entries.
- `limit` (integer): Maximum number of items to include in the response. Defaults to 25.
- `mode` (string): Use SHA-1 by default or NTLM when mode is set to ntlm.
- `offset` (integer): Number of items to skip before returning results. Defaults to 0.
- `prefix` (string, required): The first 5 hexadecimal characters of a SHA-1 or NTLM hash.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `addPadding` (boolean)
- `guidance` (string): Additional guidance for resolving the tool error.
- `hasMore` (boolean)
- `limit` (integer)
- `matchCount` (integer)
- `matches` (array)
- `message` (string): Present when the tool returns an error.
- `mode` (string)
- `nextOffset` (integer)
- `offset` (integer)
- `prefix` (string)
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `returnedCount` (integer)
- `statusCode` (integer): Present when the tool returns an error.
- `totalCount` (integer)

### `hibp_get_breached_account` (~162 tokens)

Have I Been Pwned - Breached Account

Search HIBP for breaches affecting a single email address. This tool requires an OAuth bearer token.

Input parameters:

- `account` (string, required): The email address to search for.
- `domain` (string): Filter results to a specific breach domain.
- `includeUnverified` (boolean): Include unverified breaches. Defaults to true.
- `limit` (integer): Maximum number of items to include in the response. Defaults to 25.
- `offset` (integer): Number of items to skip before returning results. Defaults to 0.
- `responseMode` (string): Choose full breach objects, truncated objects, or breach names.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `account` (string)
- `breaches` (array)
- `guidance` (string): Additional guidance for resolving the tool error.
- `hasMore` (boolean)
- `limit` (integer)
- `message` (string): Present when the tool returns an error.
- `nextOffset` (integer)
- `offset` (integer)
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `responseMode` (string)
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `returnedCount` (integer)
- `statusCode` (integer): Present when the tool returns an error.
- `totalCount` (integer)

### `hibp_get_breached_account_range` (~131 tokens)

Have I Been Pwned - Breached Account Range

Query the authenticated HIBP k-anonymity breached-account range endpoint with the first 6 characters of a SHA-1 email hash.

Input parameters:

- `limit` (integer): Maximum number of items to include in the response. Defaults to 25.
- `offset` (integer): Number of items to skip before returning results. Defaults to 0.
- `prefix` (string, required): The first 6 hexadecimal characters of a SHA-1 hash of an email address.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `guidance` (string): Additional guidance for resolving the tool error.
- `hasMore` (boolean)
- `limit` (integer)
- `matchCount` (integer)
- `matches` (array)
- `message` (string): Present when the tool returns an error.
- `nextOffset` (integer)
- `offset` (integer)
- `prefix` (string)
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `returnedCount` (integer)
- `statusCode` (integer): Present when the tool returns an error.
- `totalCount` (integer)

### `hibp_get_paste_account` (~111 tokens)

Have I Been Pwned - Paste Account

Search for public pastes containing an email address. This tool requires an OAuth bearer token.

Input parameters:

- `account` (string, required): The email address to search for pastes.
- `limit` (integer): Maximum number of items to include in the response. Defaults to 25.
- `offset` (integer): Number of items to skip before returning results. Defaults to 0.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `account` (string)
- `guidance` (string): Additional guidance for resolving the tool error.
- `hasMore` (boolean)
- `limit` (integer)
- `message` (string): Present when the tool returns an error.
- `nextOffset` (integer)
- `offset` (integer)
- `pastes` (array)
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `returnedCount` (integer)
- `statusCode` (integer): Present when the tool returns an error.
- `totalCount` (integer)

### `hibp_get_breached_domain` (~110 tokens)

Have I Been Pwned - Breached Domain

Return breached aliases for a verified domain. This tool requires an authorized subscription via OAuth bearer token.

Input parameters:

- `domain` (string, required): The verified domain to search.
- `limit` (integer): Maximum number of items to include in the response. Defaults to 25.
- `offset` (integer): Number of items to skip before returning results. Defaults to 0.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `aliasCount` (integer)
- `breachesByAlias` (object)
- `domain` (string)
- `guidance` (string): Additional guidance for resolving the tool error.
- `hasMore` (boolean)
- `limit` (integer)
- `message` (string): Present when the tool returns an error.
- `nextOffset` (integer)
- `offset` (integer)
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `returnedCount` (integer)
- `statusCode` (integer): Present when the tool returns an error.
- `totalCount` (integer)

### `hibp_list_subscribed_domains` (~90 tokens)

Have I Been Pwned - Subscribed Domains

List the domains associated with the authenticated HIBP subscription.

Input parameters:

- `limit` (integer): Maximum number of items to include in the response. Defaults to 25.
- `offset` (integer): Number of items to skip before returning results. Defaults to 0.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `guidance` (string): Additional guidance for resolving the tool error.
- `hasMore` (boolean)
- `limit` (integer)
- `message` (string): Present when the tool returns an error.
- `nextOffset` (integer)
- `offset` (integer)
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `returnedCount` (integer)
- `statusCode` (integer): Present when the tool returns an error.
- `subscribedDomains` (array)
- `totalCount` (integer)

### `hibp_get_subscription_status` (~54 tokens)

Have I Been Pwned - Subscription Status

Return the current subscription details and feature flags for the authenticated OAuth-linked HIBP subscription.

Input parameters:

- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `guidance` (string): Additional guidance for resolving the tool error.
- `message` (string): Present when the tool returns an error.
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `statusCode` (integer): Present when the tool returns an error.
- `subscription` (object)

### `hibp_get_stealer_logs_by_email` (~121 tokens)

Have I Been Pwned - Stealer Logs by Email

Return website domains observed in stealer logs for an email address. Requires an authenticated subscription with stealer-log access.

Input parameters:

- `email` (string, required): The email address to search for in stealer logs.
- `limit` (integer): Maximum number of items to include in the response. Defaults to 25.
- `offset` (integer): Number of items to skip before returning results. Defaults to 0.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `domains` (array)
- `email` (string)
- `guidance` (string): Additional guidance for resolving the tool error.
- `hasMore` (boolean)
- `limit` (integer)
- `message` (string): Present when the tool returns an error.
- `nextOffset` (integer)
- `offset` (integer)
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `returnedCount` (integer)
- `statusCode` (integer): Present when the tool returns an error.
- `totalCount` (integer)

### `hibp_get_stealer_logs_by_website_domain` (~123 tokens)

Have I Been Pwned - Stealer Logs by Website Domain

Return email addresses observed in stealer logs for a website domain. Requires an authenticated subscription with stealer-log access.

Input parameters:

- `domain` (string, required): The website domain to search for in stealer logs.
- `limit` (integer): Maximum number of items to include in the response. Defaults to 25.
- `offset` (integer): Number of items to skip before returning results. Defaults to 0.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `domain` (string)
- `emails` (array)
- `guidance` (string): Additional guidance for resolving the tool error.
- `hasMore` (boolean)
- `limit` (integer)
- `message` (string): Present when the tool returns an error.
- `nextOffset` (integer)
- `offset` (integer)
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `returnedCount` (integer)
- `statusCode` (integer): Present when the tool returns an error.
- `totalCount` (integer)

### `hibp_get_stealer_logs_by_email_domain` (~126 tokens)

Have I Been Pwned - Stealer Logs by Email Domain

Return email aliases and associated website domains observed in stealer logs for an email domain. Requires an authenticated subscription with stealer-log access.

Input parameters:

- `domain` (string, required): The email domain to search for in stealer logs.
- `limit` (integer): Maximum number of items to include in the response. Defaults to 25.
- `offset` (integer): Number of items to skip before returning results. Defaults to 0.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `aliasCount` (integer)
- `aliases` (object)
- `domain` (string)
- `guidance` (string): Additional guidance for resolving the tool error.
- `hasMore` (boolean)
- `limit` (integer)
- `message` (string): Present when the tool returns an error.
- `nextOffset` (integer)
- `offset` (integer)
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `returnedCount` (integer)
- `statusCode` (integer): Present when the tool returns an error.
- `totalCount` (integer)

### `hibp_generate_domain_verification_dns_token` (~77 tokens)

Have I Been Pwned - Generate Domain Verification DNS Token

Generate the TXT record value required to verify domain control via DNS. Requires an authenticated subscription with domain-verification access.

Input parameters:

- `domain` (string, required): The domain to generate a verification token for.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `domain` (string)
- `guidance` (string): Additional guidance for resolving the tool error.
- `message` (string): Present when the tool returns an error.
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `statusCode` (integer): Present when the tool returns an error.
- `txtRecordValue` (string)

### `hibp_verify_domain_verification_dns_token` (~79 tokens)

Have I Been Pwned - Verify Domain Verification DNS Token

Complete domain verification by checking the expected HIBP TXT record on the target domain. Requires an authenticated subscription with domain-verification access.

Input parameters:

- `domain` (string, required): The domain to verify by DNS.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `domain` (string)
- `guidance` (string): Additional guidance for resolving the tool error.
- `message` (string): Present when the tool returns an error.
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `statusCode` (integer): Present when the tool returns an error.
- `verified` (boolean)

### `hibp_send_domain_verification_email` (~97 tokens)

Have I Been Pwned - Send Domain Verification Email

Send a domain verification email to an approved alias such as admin or security. Requires an authenticated subscription with domain-verification access.

Input parameters:

- `domain` (string, required): The domain to verify by email.
- `emailAlias` (string, required): The approval alias to send the verification email to, for example admin.
- `response_format` (string): Format the text response as markdown (default) or JSON. structuredContent is always returned.

Output parameters:

- `domain` (string)
- `emailAlias` (string)
- `emailSent` (boolean)
- `guidance` (string): Additional guidance for resolving the tool error.
- `message` (string): Present when the tool returns an error.
- `rateLimitResetAt` (string): UTC timestamp indicating when the current rate limit window should have reset.
- `retryAfterHeaders` (object): Retry headers that mirror the standard HTTP rate-limit response when applicable.
- `retryAfterSeconds` (integer): How long to wait before retrying, when the tool is rate limited.
- `statusCode` (integer): Present when the tool returns an error.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/troyhunt-hibp/haveibeenpwned#diagnostics

## Score history

- 2026-08-03: 79
- 2026-08-02: 79
- 2026-08-01: 78
- 2026-07-31: 77
- 2026-07-30: 74
- 2026-07-29: 73
- 2026-07-28: 73
- 2026-07-27: 73
- 2026-07-26: 72

## Links

- Remote endpoint: https://haveibeenpwned.com/mcp
- Changelog RSS feed: https://verifymcp.io/servers/troyhunt-hibp/haveibeenpwned/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/troyhunt-hibp/haveibeenpwned/changelog.json
- HTML version of this page: https://verifymcp.io/servers/troyhunt-hibp/haveibeenpwned