Have I Been Pwned

liveSecurity

Password breach checks (k-anonymity, no key) + breach catalog (no key) + breached-account lookup (paid BYO key).

6tools
0msauth
free tier50 calls/day
🔑Authentication

Password checks and breach-catalog tools are free with no key. check_account requires a paid HIBP subscription key passed as _apiKey.

Config with credentials
{
  "mcpServers": {
    "pipeworx-hibp": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://gateway.pipeworx.io/hibp/mcp?_apiKey=your_hibp_key"
      ]
    }
  }
}

Get an API key →

Tools

check_passwordrequired: password

Check whether a password appears in known breach corpora. Uses k-anonymity: the password is SHA-1ed locally, only the first 5 hex chars leave the worker, and the response is filtered to match the rest

Parameters
NameTypeDescription
passwordreqstringPassword to check
▶Try it
check_password_prefixrequired: sha1_prefix

Direct k-anonymity lookup: pass the first 5 hex chars of a SHA-1 password hash, get back all SHA-1 suffixes with their pwned counts. Use this if you're hashing client-side and only want to send the pr

Parameters
NameTypeDescription
sha1_prefixreqstring5 hex chars
▶Try it
list_breaches

List all publicly-known data breaches catalogued by HIBP. Optionally filter to a specific domain (e.g., "linkedin.com"). Returns name, title, breach date, added date, affected accounts, description, d

Parameters
NameTypeDescription
domainoptstringOptional domain
▶Try it
get_breachrequired: name

Fetch a single breach by name (the "Name" field from list_breaches, e.g., "Adobe", "LinkedIn"). Returns full breach metadata.

Parameters
NameTypeDescription
namereqstringBreach name
▶Try it
list_data_classes

Canonical list of HIBP "data class" tags (e.g., "Email addresses", "Passwords", "Geographic locations"). Useful for filtering breaches.

No parameters required.

▶Try it
check_accountrequired: account

Look up breaches an email account has been seen in. REQUIRES a paid HIBP subscription key (pass _apiKey). Returns the set of breach names; combine with get_breach for details.

Parameters
NameTypeDescription
accountreqstringEmail address
truncateoptbooleanReturn only breach names (default true)
▶Try it

Test with curl

The gateway speaks JSON-RPC 2.0 over HTTP POST. You can test any pack directly from the terminal.

List available tools
bash
curl -X POST https://gateway.pipeworx.io/hibp/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Call a tool
bash
curl -X POST https://gateway.pipeworx.io/hibp/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"check_password","arguments":{"password": "example"}}}'

Use with the SDK

Install @pipeworx/sdk to call tools from any TypeScript/Node project.

TypeScript
import { Pipeworx } from '@pipeworx/sdk';
const px = new Pipeworx();
const result = await px.call("check_password", {"password":"example"});
ask_pipeworx
// Or ask in plain English:
const answer = await px.ask("password breach checks (k-anonymity, no key) + breach catalog (no key) + breached-account lookup (paid byo key)");