A Model Context Protocol (MCP) server that provides integration with the Have I Been Pwned API to check if your accounts or passwords have been compromised in data breaches.
Verify if an email address has been exposed in data breaches using the Have I Been Pwned API. Includes options to check unverified breaches and truncate response data for streamlined results.
Verify if a password has been exposed in data breaches using k-anonymity via the Have I Been Pwned API. Ensure account security by identifying compromised passwords.
Has this password appeared in a dump? — Have I Been Pwned Pwned Passwords via k-anonymity: only a 5-char SHA-1 prefix leaves the server. Returns pwned + occurrence count and a GO/HOLD/STOP. Password is not stored. Email breach lookup not offered. Required input: password. Priced $0.005 per call over x402 on Base; send a prepaid x-credit-token header for unlimited calls, or get 1 free call/day per tool. No wallet or API key required.
Checks whether a password appears in known data breaches (Have I Been Pwned) and how many times, using k-anonymity towards HIBP. Breach check only; password_check adds strength scoring and sends the password in a POST body.
Check whether a domain appears in known public data breaches (via the Have I Been Pwned breach catalog). Returns matching breaches with dates, exposed data classes, and account counts. Domain-level only — no personal email is queried.
Check whether an email address or domain appears in known credential-breach corpora (Have I Been Pwned), with the breaches and data classes exposed. Use when assessing account-takeover exposure. Costs $2 per call.
Get a structured summary of your recent activity over the last hours: per-app time-on-task, focus sessions, OCR keyword hits, and idle gaps. Use when you ask 'what have I been doing?'.