Is my password safe when I check it?

Yes. The capability uses a k-anonymity model, which means your full password is never actually sent to the server.

How do I get an API key?

You can obtain your HIBP API key directly from the official Have I Been Pwned website.

Can I check usernames as well as emails?

Yes, the capability allows you to search for breaches involving both email addresses and usernames.

What kind of data is usually leaked?

Breaches often include email addresses, passwords, usernames, and phone numbers.

Does this work with Cursor or VS Code?

Yes, this MCP works with any MCP-compatible client including Cursor, Windsurf, and VS Code.

Is it safe to check my password using this capability?

Yes. This agent uses the K-Anonymity model. Only the first 5 characters of your password's SHA-1 hash are sent to the HIBP server. The full password or full hash never leaves your local environment, making it cryptographically safe.

Where can I get an API Key?

You can purchase an API key directly from the HIBP website. It requires a small monthly subscription to prevent mass scraping and abuse.

An astronaut overseeing a futuristic data hub

Download PDF Markdown Version

Connect Have I Been Pwned to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Audit your digital safety through your AI client.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 5 capabilities

We ship only the actions that matter.

Capability set01 / 02

01-03

3 capabilities in this set.

Part of 5 available through Have I Been Pwned.

01
Search account breaches
This capability searches for every data breach associated with a specific email or account.
02
Search account pastes
This capability scans public paste sites like Pastebin to see if an email or account appears in leaked text dumps.
03
List all breaches
This capability provides a full list of all data breaches currently recorded in the system.

Capability set02 / 02

04-05

2 capabilities in this set.

Part of 5 available through Have I Been Pwned.

04
Check password safety
This capability uses k-anonymity to check if a password has appeared in a breach without ever sending the full password to the server.
05
Get breach details
This capability retrieves specific information about a known breach by its name.

Real work

What teams actually run

Personal Account Audit

You ask your agent to check your primary email to see if you need to change any passwords.

Password Strength Testing

You verify if a new password has been leaked in the past before you start using it.

Corporate Domain Monitoring

An IT professional checks if company emails appear in recent large-scale leaks.

Data Leak Investigation

You use the capability to find out exactly what kind of data was stolen in a specific breach.

Automate a task

Put Have I Been Pwned to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

Have I Been Pwned works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

Building your own app? The connector is yours to use.

You don't need a client to put Have I Been Pwned to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

894ms average. Fast in production.

Have I Been Pwned is checked daily against the live service.

Daily averagePeak 1192ms

Oct 3Today

Fastest day: 700ms
Slowest day: 1192ms
14-day trend: Slowing+21%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 5 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of Have I Been Pwned, so you can see the experience inside your AI.

It does not authenticate your account with Have I Been Pwned. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

Have I Been Pwned Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_sMA0l35Ca22YXDFphuzvJ8zBvh4k5c4TwRKFbcfW/mcp

Claude Desktop

Follow the steps below to connect in seconds.

1In Claude Desktop, open Settings → Connectors.
2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
3Click Add and start a new chat — Have I Been Pwned capabilities are ready to use.

Configuration · claude_desktop_config.jsonCopy

{
  "mcpServers": {
    "have-i-been-pwned-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_sMA0l35Ca22YXDFphuzvJ8zBvh4k5c4TwRKFbcfW/mcp"
    }
  }
}

Claude
ChatGPT
Cursor
VS Code
Windsurf
Claude Code
JetBrains
Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up Have I Been Pwned in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work Have I Been Pwned owners hand off.

This MCP is built for anyone needing to monitor digital exposure through an AI interface.

01
Security-Conscious Users
They use the agent to monitor personal or family account safety.
02
IT Professionals
They hand off domain and account compromise checks to their AI client.
03
Researchers
They use the capability to analyze breach trends and impact data.

FAQ

Questions Have I Been Pwned owners ask.

01
Is my password safe when I check it?
Yes. The capability uses a k-anonymity model, which means your full password is never actually sent to the server.
02
How do I get an API key?
You can obtain your HIBP API key directly from the official Have I Been Pwned website.
03
Can I check usernames as well as emails?
Yes, the capability allows you to search for breaches involving both email addresses and usernames.
04
What kind of data is usually leaked?
Breaches often include email addresses, passwords, usernames, and phone numbers.
05
Does this work with Cursor or VS Code?
Yes, this MCP works with any MCP-compatible client including Cursor, Windsurf, and VS Code.
06
Is it safe to check my password using this capability?
Yes. This agent uses the K-Anonymity model. Only the first 5 characters of your password's SHA-1 hash are sent to the HIBP server. The full password or full hash never leaves your local environment, making it cryptographically safe.
07
Where can I get an API Key?
You can purchase an API key directly from the HIBP website. It requires a small monthly subscription to prevent mass scraping and abuse.

Explore

More in Fort Knox

Connect Have I Been Pwned to Claude, Cursor, ChatGPT & more

Your AI does the work. We keep it safe and sound.

Each Connector runs inside its own sealed environment.

One switch stops every agent. Instantly.

Spending limits that pause instead of surprise.

We ship only the actions that matter.

01-03

Search account breaches

Search account pastes

List all breaches

04-05

Check password safety

Get breach details

What teams actually run

Personal Account Audit

Password Strength Testing

Corporate Domain Monitoring

Data Leak Investigation

Building your own app? The connector is yours to use.

Have I Been Pwned Connector

Claude Desktop

Security-Conscious Users

IT Professionals

Researchers

Is my password safe when I check it?

How do I get an API key?

Can I check usernames as well as emails?

What kind of data is usually leaked?

Does this work with Cursor or VS Code?

Is it safe to check my password using this capability?

Where can I get an API Key?

DataDome AI Connector

Password Manager Export Analyzer AI Connector

Pangea (Security APIs) AI Connector

Data Pipeline Prover AI Connector

Suggestions

Hevo Data (ETL & Data Pipeline) AI Connector

Data.gov Catalog AI Connector

data.world AI Connector

People Data Labs AI Connector