How to Use the Have I Been Pwned MCP in LlamaIndex

Q: How do I configure Have I Been Pwned with LlamaIndex?

Install llama-index-tools-mcp via pip. Initialize a BasicMCPClient with your MCP Server URL, then wrap it in an McpToolSpec to expose the tools to your RAG application.

Q: Does Have I Been Pwned work with LlamaIndex FunctionAgents?

Just call await mcptoolspec.totoollistasync() and pass the array to your agent. It decides when to fetch live breach data based on the user prompt.

Index breach data directly into LlamaIndex. Turn scattered credential leaks into a searchable, vector-grounded knowledge base.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Have I Been Pwned MCP to LlamaIndex

Create your Vinkius account to connect Have I Been Pwned to LlamaIndex and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Have I Been Pwned with LlamaIndex

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Vectorize global breach records

The `list_all_breaches` tool pulls the entire catalog of known data leaks into your LlamaIndex workspace. You feed this raw API output straight into your vector store. Your RAG application now has a permanent, queryable history of global security incidents. When an incident occurs, your agent uses `get_breach_details` to pull specific metrics like compromised data classes. This data gets indexed alongside your internal security policies. You can ask your agent questions about historical breaches and get answers grounded in actual database records.

Ground security queries in reality

The `search_account_breaches` tool checks specific emails against the leak database. Your FunctionAgent takes a list of employee emails, runs the checks, and indexes the results. Stop guessing who got caught in a third-party breach. Storing this in LlamaIndex means you build a semantic search tool for your security team. They query the system for specific engineers involved in the 2023 leaks and get exact answers. The MCP Server handles the data fetching behind the scenes.

Monitor unindexed text dumps via MCP Server

The `search_account_pastes` tool scrapes public paste sites for target emails. Attackers frequently use these text bins to share raw credential dumps. Your agent pulls this unstructured data and indexes it for future correlation. Verify specific hashes using `check_password_safety` during incident response. The results become part of your RAG pipeline's context window. Your system builds a living timeline of exposure events.

Setup guide

Set up Have I Been Pwned MCP in LlamaIndex

Prerequisites

Python 3.10+ installed
llama-index-tools-mcp package
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install llama-index-tools-mcp llama-index-llms-openai. The MCP tools package provides BasicMCPClient and McpToolSpec.
2

Connect with BasicMCPClient
Point BasicMCPClient to your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. Supports SSE and Streamable HTTP transports.
3

Convert to LlamaIndex tools
Call mcp_tool_spec.to_tool_list_async() to convert all Have I Been Pwned MCP tools into native FunctionTool objects that any LlamaIndex agent can use.
4

Run with any LLM
Create a FunctionAgent with the tools and your preferred LLM. Swap OpenAI for Anthropic, Gemini, or any LlamaIndex-supported provider.

agent.py

from llama_index.tools.mcp import BasicMCPClient, McpToolSpec
from llama_index.core.agent.workflow import FunctionAgent
from llama_index.llms.openai import OpenAI

# Connect to the MCP
mcp_client = BasicMCPClient(
    "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)
mcp_tool_spec = McpToolSpec(client=mcp_client)

# Convert MCP tools to LlamaIndex tools
tools = await mcp_tool_spec.to_tool_list_async()

# Create and run the agent
agent = FunctionAgent(
    tools=tools,
    llm=OpenAI(model="gpt-4o"),
    system_prompt="You have access to Have I Been Pwned tools.",
)
response = await agent.run("List recent Have I Been Pwned data")

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Have I Been Pwned. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Have I Been Pwned now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Have I Been Pwned MCP in LlamaIndex

Install `llama-index-tools-mcp` via pip. Initialize a `BasicMCPClient` with your MCP Server URL, then wrap it in an `McpToolSpec` to expose the tools to your RAG application.

Yes. You pull the data once using the tools and store it in your vector database. Future queries hit the local index instead of making repeated API calls.

Just call `await mcp_tool_spec.to_tool_list_async()` and pass the array to your agent. It decides when to fetch live breach data based on the user prompt.

Raw API data lacks context. Indexing leak records alongside your corporate directories lets your agent cross-reference external threats with internal targets instantly.

Email addresses are sent to the remote API to check for breach history. LlamaIndex transmits the exact string you provide to the endpoint. If you have strict data sovereignty rules, only query addresses you are legally authorized to monitor.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript