# Have I Been Pwned MCP for AI Agents AI Agent Connect

> Have I Been Pwned MCP lets you check if your email, username, or passwords have appeared in known data breaches. It connects your AI client to the HIBP database so you can audit your digital footprint instantly. You can also search for public pastes or verify if a specific password has been seen before using a secure K-Anonymity method.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_sMA0l35Ca22YXDFphuzvJ8zBvh4k5c4TwRKFbcfW/ai-agent-connect
- **Tags:** data-breach, cybersecurity, identity-protection, password-security, threat-intelligence, account-safety

## Description

Have I Been Pwned MCP lets you check if your email, username, or passwords have appeared in known data breaches. It connects your AI client to the HIBP database so you can audit your digital footprint instantly. You can also search for public pastes or verify if a specific password has been seen before using a secure K-Anonymity method. Imagine you're trying to figure out why you keep getting weird login attempts. Instead of manually searching every major leak site, you can just ask your AI to check your credentials against the Have I Been Pwned database. It pulls the history of every breach your info was part of, telling you exactly what was stolen, like plain-text passwords or phone numbers. It's a huge time saver for anyone trying to clean up their digital life or secure a company's domain. If you're worried about a specific password you've used in the past, the Connector handles that securely too. It uses a K-Anonymity model, which means your actual password never leaves your machine. You just get a "yes" or "no" on whether it's been seen before. You can also see what's floating around on public paste sites or browse the entire history of major internet leaks to see which companies are the biggest offenders. Finding these tools in the Vinkius catalog makes it easy to plug this security layer directly into your existing workflow. You get a clear picture of your risk without ever having to navigate a complex dashboard or copy-paste data between tabs.

## Tools

### search_account_breaches
Check which leaks an email or username appeared in. It returns the breach names and data types stolen.

### search_account_pastes
Find mentions of your account on public paste sites. This identifies if your info is being shared on the open web.

### get_breach_details
Pull specific information about a named data breach. Use this to see what happened during a specific event.

### list_all_breaches
Get a complete list of every data breach in the HIBP database. Use this to see the scale of historical leaks.

### check_password_safety
Verify if a password has been leaked using a secure K-Anonymity check. This keeps your password private.

## Prompt Examples

**Prompt:** 
```
Has my email test@example.com been involved in any breaches?
```

**Response:** 
```
Checking breaches for 'test@example.com'... I found 3 breaches:

| Breach Name | Year | Data Types Exposed |
| :--- | :--- | :--- |
| Adobe | 2013 | Email addresses, Passwords |
| LinkedIn | 2016 | Usernames, Emails |
| Canva | 2019 | Passwords, Emails |

**Action Recommended:** Consider changing your password for these services immediately.
```

**Prompt:** 
```
Is the password P@ssword123 safe to use?
```

**Response:** 
```
⚠️ **DANGER!** This password has appeared in **45,210** data breaches.

Because this password is widely known and publicly leaked, you should **NEVER** use it. It is easily guessable and provides zero protection for your accounts.
```

**Prompt:** 
```
What happened in the Adobe breach?
```

**Response:** 
```
The **Adobe** breach involved the exposure of sensitive user data. 

**Details:**
- **Data Types:** Passwords, Email addresses, Usernames
- **Impact:** Users who had accounts with Adobe were potentially compromised.
- **Status:** This is one of the largest historical breaches in our records.
```

## Capabilities

### Scan email breaches
Check if an email address is in any known leaks.

### Find public pastes
Search for your account info on sites like Pastebin.

### Verify password safety
Check if a password is leaked without sending it to the cloud.

### View breach details
Get the specific data types stolen in a named breach.

### Browse all breaches
See a full list of every recorded data leak.

## Use Cases

### Checking a new email
A new employee wants to know if their work email is safe for a new account. They ask their AI agent to scan the address and get a list of every breach it appeared in, helping them decide on security settings.

### Password validation
A developer wants to know if a common phrase like Summer2024 is safe to use for a new internal tool. The agent uses `check_password_safety` to check the history and warns them of the high risk.

### Corporate audit
An IT lead needs to know which major historical breaches hit their company domain. They ask the agent to pull a full history using `list_all_breaches` to identify which third-party services were compromised.

### Pastebin hunting
A user suspects their personal data might be floating around on a public paste site. They ask their AI agent to use `search_account_pastes` to scan for any mentions of their specific username.

## Benefits

- Get instant alerts on leaks by using `search_account_breaches` to see exactly what data was stolen in the past. This lets you know if your email or username is currently exposed on known lists.
- Prevent password reuse by checking new passwords with `check_password_safety` before you even create an account. This ensures you don't pick a phrase that is already circulating in the wild.
- Identify exposed credentials on public sites using `search_account_pastes` to find mentions on platforms like Pastebin. It helps you find where your info might be public without manual searching.
- Audit corporate risk by using `list_all_breaches` to see every recorded data leak in the system. It helps you understand the scale of historical security failures across the internet.
- Understand the scope of a specific leak by using `get_breach_details` to see exactly what data types were compromised. You can see if it was just emails or if phone numbers were also taken.

## How It Works

The bottom line is you get instant visibility into your personal or corporate data leaks through a simple chat interface.

1. Get your API key from the Have I Been Pwned website.
2. Add the key to your Connector configuration in your AI client.
3. Ask your agent to check your email, passwords, or specific breach history.

## Frequently Asked Questions

**Can I check if my email was leaked with Have I Been Pwned?**
Yes, you can check any email address. The Connector will scan the database and tell you every time that email appeared in a breach, including what kind of data was exposed.

**Is it safe to check passwords with this Connector?**
It is very safe. The Connector uses a K-Anonymity model, which means your actual password is never sent to any external server. Your AI client only receives a simple confirmation.

**How does the K-Anonymity work for Have I Been Pwned?**
K-Anonymity works by grouping your password with others like it. It checks if that group exists in a breach database. This allows the service to tell you if your password is leaked without ever seeing it.

**Can I see a list of all data breaches?**
You can request a full list of all recorded breaches. The AI will pull the data and show you the history of major leaks, which helps you understand the scale of historical security issues.

**Does this check Pastebin for my info?**
Yes, the Connector can search for your account information on public paste sites. It checks places like Pastebin to see if your details are being shared publicly by others.

**How do I get an API key for Have I Been Pwned?**
You can get your API key by visiting the official Have I Been Pwned website. Once you have it, you just need to add it to your Connector configuration to start using the tools.

**Is it safe to check my password using this tool?**
Yes. This agent uses the K-Anonymity model. Only the first 5 characters of your password's SHA-1 hash are sent to the HIBP server. The full password or full hash never leaves your local environment, making it cryptographically safe.

**Where can I get an API Key?**
You can purchase an API key directly from the [HIBP website](https://haveibeenpwned.com/API/Key). It requires a small monthly subscription to prevent mass scraping and abuse.