Integration

Have I Been Pwned integration

Have I Been Pwned (HIBP) is Troy Hunt's catalogue of public data breaches. Check which breaches and how many pastes an email address, username or phone number appears in, find the website domains where a work email on your verified domain was captured by info-stealer malware, browse the breach catalogue (filter by domain or spam lists, read one breach or the latest one added) and its data classes, and read your own subscription and verified domains. Routes that return other people's email addresses or aliases (domain search, stealer logs by website or email domain), the k-anonymity hash range (its results must be discarded unless they match), domain verification and the plain-text Pwned Passwords range are not exposed, and paste ids and titles are not returned. Authentication is the HIBP API key sent in the hibp-api-key header; account, paste and subscription routes need a paid plan (Core, Pro or High RPM, stealer logs Pro only), the catalogue routes are free, and the per-minute rate limit depends on the plan (HTTP 429 with retry-after when exceeded). HIBP's terms permit searching addresses supplied by or relating to you or your own users, customers or clients, and forbid queries that disadvantage people or amount to solicitation (such as checking purchased, scraped or third-party lists to contact or market to them) or that aim to harm breach victims. Data is licensed CC BY 4.0: wherever it is shown, credit Have I Been Pwned with a link to haveibeenpwned.com.

Connect Have I Been Pwned How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Have I Been Pwned.Built from the 10 Have I Been Pwned tools below, on the connection you add once.

What you can do with Have I Been Pwned

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Breach, 4 operations

get_breachGet breachGETReturns the full record of one breach by its Name (from list_breaches or list_breaches_for_account): dates, address count, data classes and flags. HTTP 404 means no such breach. Free.
get_latest_breachGet latest breachGETReturns the full record of the breach most recently added to HIBP (by AddedDate, which can be long after the breach itself). Free, no paid plan needed.
list_breachesList breachesGETLists every breach in the HIBP catalogue with its full record, sorted by title; filter with domain or isSpamList (the unfiltered list is large). Free, no paid plan needed.
list_breaches_for_accountList breaches for accountGETLists the public breaches an email address, username or phone number appears in (only each Name unless truncateResponse=false); HTTP 404 means none. Paid plan. Search only your own or your users' or clients' accounts.

Data class, 2 operations

list_data_class_descriptionsList data class descriptionsGETLists every data class seen across breaches with a short description of each, alphabetically; the same names as list_data_classes. Free, no paid plan needed.
list_data_classesList data classesGETLists the names of every data class (a kind of compromised data, e.g. Email addresses, Passwords) seen across breaches, alphabetically. Free. list_data_class_descriptions adds a description of each.

Domain, 1 operation

list_subscribed_domainsList subscribed domainsGETLists the domains verified for this API key in the HIBP domain search dashboard, with their breached address counts at last search and the subscription renewal date. Core or Pro plan.

Paste, 1 operation

list_pastes_for_accountList pastes for accountGETLists the pastes (public dumps on Pastebin and similar sites) an email address appears in, newest first, with source, date and email count. HTTP 404 means none. Paid plan. Search only your own or your users' or clients' addresses.

Stealer log, 1 operation

list_stealer_log_domains_for_emailList stealer log domains for emailGETLists the website domains where info-stealer malware captured credentials for an email address; the address must be on a domain verified for your key. HTTP 404 means none. Pro plan with stealer logs only.

Subscription, 1 operation

get_subscription_statusGet subscription statusGETReturns the plan behind this API key (name, end date, requests per minute) and what it includes: stealer logs, k-anonymity search, bulk domain add, customer domains, domain limits. HTTP 404 means no active plan.

Use Have I Been Pwned from Claude Code, Cursor or Codex

Connect Have I Been Pwned in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Have I Been Pwned operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Have I Been Pwned

Create your workspace
Sign up free. Nothing to install.
Connect Have I Been Pwned once
Add your Have I Been Pwned connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.