Have I Been Pwned MCP Server

A Model Context Protocol (MCP) server for the Have I Been Pwned (HIBP) API that allows you to query breach data using natural language.

Overview

This MCP server provides tools to interact with the Have I Been Pwned API, allowing you to:

• Check if an email address has been in a data breach
• Get details about specific breaches
• Check if a password has been exposed in known data breaches
• Check if an email address appears in pastes

GitHub Repo

NPM Package

Blog

Your browser does not support the video tag.

Installation & Configuration

Option 1: NPM Installation (Recommended)

1. Install Node.js (v22.10.0 or higher recommended)
2. Get your HIBP API key from https://haveibeenpwned.com/API/Key
3. Configure your MCP client (e.g., Claude Desktop ) with:

{
  "mcpServers": {
    "HIBP-MCP": {
      "command": "npx",
      "args": ["-y", "@darrenjrobinson/hibp-mcp"],
      "env": {
        "HIBP_API_KEY": "",
        "HIBP_SUBSCRIPTION_PLAN": "Pwned 1"
      }
    }
  }
}

Option 2: Local Development

1. Clone this repository:

git clone https://github.com/darrenjrobinson/HIBP-MCP-Server.git

2. Install dependencies:

cd HIBP-MCP-Server
npm install

3. Build the project:

npm run build

4. Configure your MCP client with:

{
  "mcpServers": {
    "HIBP-MCP": {
      "command": "node",
      "args": ["path/to/hibp-mcp/build/main.js"],
      "env": {
        "HIBP_API_KEY": "",
        "HIBP_SUBSCRIPTION_PLAN": "Pwned 1"
      }
    }
  }
}

Environment Variables

Usage Examples

Once configured, you can ask Claude natural language questions about data breaches. Here are some examples:

Checking Email Breaches

• “Has email address [email protected] appeared in any data breaches?”
• “What breaches contain the email address [email protected]?”
• “Show me all breaches for [email protected]”

Checking Specific Breaches

• “Tell me about the LinkedIn data breach”
• “What data was exposed in the Adobe breach?”
• “List all known data breaches”

Checking Passwords