MCP server

Hibp

io.github.pipeworx-io/hibp

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

Have I Been Pwned MCP

Working at last checkOfficial: pipeworx.io's GitHub account (pipeworx-io)About 27,098 tokens per request once connected48 tools

https://gateway.pipeworx.io/hibp/mcp

At a glance

Type: MCP server
Publisher: pipeworx.io (verified by the MCP Registry)
Status: Working at last check
Tools: 48
Token cost: About 27,098 tokens per request
Sets up in: Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok
Last checked: 26 Oct 2026, 08:29 UTC

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http hibp https://gateway.pipeworx.io/hibp/mcp

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.hibp]
url = "https://gateway.pipeworx.io/hibp/mcp"

Gemini CLI

{"mcpServers":{"hibp":{"httpUrl":"https://gateway.pipeworx.io/hibp/mcp"}}}

Cursor

{"mcpServers":{"hibp":{"url":"https://gateway.pipeworx.io/hibp/mcp"}}}

VS Code

{"servers":{"hibp":{"type":"http","url":"https://gateway.pipeworx.io/hibp/mcp"}}}

Antigravity

agy mcp add hibp https://gateway.pipeworx.io/hibp/mcp

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"hibp","server_url":"https://gateway.pipeworx.io/hibp/mcp","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"hibp","server_url":"https://gateway.pipeworx.io/hibp/mcp"}

check_account ~184 tokens
Look up breaches an email account has been seen in. REQUIRES a paid HIBP subscription key (pass _apiKey). Returns the set of breach names; combine with get_breach for details.
check_password ~163 tokens
Check whether a password appears in known breach corpora. Uses k-anonymity: the password is SHA-1ed locally, only the first 5 hex chars leave the worker, and the response is filtered to match the rest. Returns pwned count (0 = not seen). The password itself is never transmitted.
check_password_prefix ~133 tokens
Direct k-anonymity lookup: pass the first 5 hex chars of a SHA-1 password hash, get back all SHA-1 suffixes with their pwned counts. Use this if you're hashing client-side and only want to send the prefix.
get_breach ~102 tokens
Fetch a single breach by name (the "Name" field from list_breaches, e.g., "Adobe", "LinkedIn"). Returns full breach metadata.
list_breaches ~136 tokens
List all publicly-known data breaches catalogued by HIBP. Optionally filter to a specific domain (e.g., "linkedin.com"). Returns name, title, breach date, added date, affected accounts, description, data classes exposed, and verification status.
list_data_classes ~77 tokens
Canonical list of HIBP "data class" tags (e.g., "Email addresses", "Passwords", "Geographic locations"). Useful for filtering breaches.

Have I Been Pwned
Breach intelligence API: email search, domain monitoring, passwords and stealer logs.
Presend MCP Server
Before an AI agent installs an npm/PyPI package: typosquat, vulnerability and existence checks.
ContrastAPI
55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
k-anonymity 5-hex prefix, value discarded
k-anonymity 5-hex prefix, value discarded
Could Have Been Email
could-have-been-email MCP — wraps StupidAPIs (keyless — no credential needed)
HaveIBeenPwned k-prefix shape, value discarded
HaveIBeenPwned k-prefix shape, value discarded
Biorxiv
bioRxiv / medRxiv MCP
Workorai
WorkorAI talent marketplace MCP: candidate job search and employer hiring with explainable matching

[![AptLynx](https://aptlynx.net/badge/io.github.pipeworx-io/hibp.svg)](https://aptlynx.net/servers/io.github.pipeworx-io/hibp)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents