Have I Been Pwned FAQs

Question 1

What is the Have I Been Pwned MCP Server?

Accepted Answer

It's a Model Context Protocol (MCP) server that enables natural language querying of the Have I Been Pwned (HIBP) API. This allows AI models to easily check for data breaches, passwords, and pastes using simple conversational commands.

Question 2

How does the tool ensure password security when checking for exposure?

Accepted Answer

Passwords are securely checked using k-anonymity. Your password is locally hashed (SHA-1), and only the first 5 characters of that hash are sent to the HIBP Pwned Passwords API, ensuring your full password is never transmitted in plain text.

Question 3

What types of HIBP data can I query with this tool?

Accepted Answer

You can check if email addresses have appeared in data breaches or public pastes, verify if a password has been exposed in known breaches, and retrieve detailed information about specific data breaches, all using natural language queries.

Question 4

Is an HIBP API key required to use this MCP server?

Accepted Answer

Yes, an HIBP API key is essential for the server to function. You must obtain one from the official Have I Been Pwned website and configure it as an environment variable (HIBP_API_KEY) during installation.

Have I Been Pwned

Características Principales

Casos de Uso

Have I Been Pwned

Características Principales

Casos de Uso