OpenApps

Have I Been Pwned MCP server — tools & history

Have I Been Pwned MCP server: observed open status, tool schemas, linked apps and version history.

Have I Been Pwned

Endpoint: https://haveibeenpwned.com/mcp

Observed status: open. Checked: 2026-10-11T06:22:10+00:00.

Linked apps

Observed tools

  • hibp_generate_domain_verification_dns_token — Generate the TXT record value required to verify domain control via DNS, creating or reusing the private HIBP domain-verification records needed for the request. Requires an authenticated subscription with domain-verification access.
  • hibp_get_breach — Look up a single public HIBP breach by its canonical breach name, such as Adobe.
  • hibp_get_breached_account — Search HIBP for breaches affecting a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; use domain and verification filters to refine the result.
  • hibp_get_breached_account_range — Query the authenticated HIBP k-anonymity breached-account range endpoint with the first 6 characters of a SHA-1 email hash. Requires a subscription with k-anonymity access; compare each returned suffix with the remaining hash characters locally because a prefix alone cannot identify an account.
  • hibp_get_breached_domain — Return breached aliases for a verified domain. This tool requires an authorized subscription via OAuth bearer token.
  • hibp_get_latest_breach — Return the most recently added public breach currently loaded into HIBP.
  • hibp_get_paste_account — Search for public pastes containing a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; run this separately from breached-account lookup.
  • hibp_get_pwned_passwords_range — Query the public Pwned Passwords k-anonymity API with a 5-character SHA-1 or NTLM prefix and return matching suffixes with prevalence counts.
  • hibp_get_stealer_logs_by_email — Return website domains historically observed in stealer logs for an email address. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
  • hibp_get_stealer_logs_by_email_domain — Return email aliases and associated website domains historically observed in stealer logs for an email domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
  • hibp_get_stealer_logs_by_website_domain — Return email addresses historically observed in stealer logs for a website domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.
  • hibp_get_subscription_status — Return the current plan, quotas, rate limits, expiry, and feature flags for the active HIBP API subscription linked to the authenticated OAuth connection. Use it to confirm access before feature-dependent lookups.
  • hibp_list_breaches — List public HIBP breaches, optionally filtered by domain, spam-list flag, and verification status.
  • hibp_list_data_classes — List the data classes used across public HIBP breach models, such as email addresses or passwords.
  • hibp_list_subscribed_domains — List the domains associated with the authenticated HIBP subscription.
  • hibp_send_domain_verification_email — Send a domain verification email to an approved alias such as admin or security. Requires an authenticated subscription with domain-verification access.
  • hibp_verify_domain_verification_dns_token — Complete domain verification by checking the expected HIBP TXT record on the target domain. Requires an authenticated subscription with domain-verification access.

Data as of 2026-10-11T06:22:10+00:00.

OpenApps records store listings and observed changes. Store ranks are not download counts; launch dates may be derived or use the first observation. Coverage gaps are shown in the interactive catalog.

REST API specification · Guide for AI clients · Manage API keys and MCP connections