Have I Been Pwned is a free online service that allows users to check if their personal data has been compromised in data breaches. It was created by Troy Hunt, a security researcher, to help people discover if their email addresses or passwords have been exposed in known data breaches.
Provides breach intelligence via Have I Been Pwned: search the breach catalogue, retrieve breach details, look up breaches affecting a domain, check email addresses when HIBP_API_KEY is configured, and check passwords using Pwned Passwords k-anonymity.
Enables MCP clients to look up data breaches and leaked passwords, search NVD CVEs and the CISA KEV catalogue, and generate passive attack-surface reports for a domain covering security headers, TLS, email/DNS security, and CT-log subdomains. All checks are read-only and passive, using only public third-party data sources.
10
MIT
Why this server?
Provides tools to check if email addresses have been found in data breaches, verify if passwords have been exposed, get detailed information about specific data breaches, and list all breaches in the system with optional domain filtering.
A Model Context Protocol (MCP) server that provides integration with the Have I Been Pwned API to check if your accounts or passwords have been compromised in data breaches.
4
2
MIT
Why this server?
Allows AI agents to search for breached accounts, credentials, and pastes using the Have I Been Pwned API.
Dark web & threat intelligence for AI agents. HIBP, ThreatFox, ransomware tracking, Tor .onion access, blockchain intel, exploit search, stealer logs, malware analysis — unified into a single MCP server.
66
240 npm
477
MIT
Why this server?
Enables checking email addresses for known data breaches as part of Maltego investigations.
Turns an LLM into a Maltego CE investigation copilot, enabling AI-assisted OSINT investigations by building, analyzing, and exporting Maltego graph files.
52
MIT
Why this server?
Allows checking email addresses and domains against known data breaches and paste dumps through Have I Been Pwned.
Unified dark web and threat intelligence MCP server providing 66 tools across 16 data sources, including breach databases, ransomware tracking, Tor .onion access, blockchain intel, and malware analysis for AI agents.
66
240 npm
3
MIT
Why this server?
Checks whether a password or its SHA-1/NTLM hash appears in known breach dumps via Have I Been Pwned's Pwned Passwords, returning exposure count while hashing passwords locally and sending only the first five hex digits of the hash.
Gives AI agents threat-intelligence verdicts for IPs, domains, URLs and hashes, CVE lookups with EPSS and CISA KEV data, and a prompt-injection gate that scans untrusted text before the agent acts on it. Agents can also batch-check up to 100 indicators, hunt brand-lookalike domains, and track scan and request quotas.
1
0
MIT
Why this server?
Provides password breach checking via the Have I Been Pwned Pwned Passwords range API, using k-anonymity so only the first five SHA-1 hash characters are sent and the match is evaluated locally.
Enables an AI assistant to perform read-only defensive security lookups and analysis, including privacy-preserving breach checks, CVE and MITRE ATT&CK queries, log parsing, IOC defanging/refanging, hashing, and Windows event ID explanations.
9
MIT
Why this server?
Provides tools for checking if email addresses have been exposed in data breaches via the Have I Been Pwned API.
Enables LLMs to perform OSINT link-analysis by exposing transforms (DNS, WHOIS, Shodan, etc.) as MCP tools for autonomous investigation and graph enrichment.
MIT
Why this server?
Checks if a password has been breached using the Have I Been Pwned API with k-anonymity; the password never leaves the local machine.
A keyless, defensive code-security auditor that scans codebases for hardcoded secrets, audits dependencies for known CVEs, and checks passwords against breach data using k-anonymity.
