Have I Been Pwned MCP integration for AI agents.
Connect AI agents to Have I Been Pwned through 7 structured actions, including get breach, get latest breach, and get subscription status. Review authenticat…
- ACTION CONTRACTS
- 7
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Have I Been Pwned integration exposes
The Have I Been Pwned Agent App exposes 7 provider-backed actions for security and data work. Its current contract lets an authorized agent get one breach by its stable hibp name value, get the most recently added breach in have i been pwned, and get the current subscription details for the connected hibp api key. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Have I Been Pwned account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Have I Been Pwned capabilities.
Showing 7 of 7 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_breachREADGet one breach by its stable HIBP Name value.
INPUTS: name
get_latest_breachREADGet the most recently added breach in Have I Been Pwned.
get_subscription_statusREADGet the current subscription details for the connected HIBP API key.
list_breachesREADList breaches in Have I Been Pwned and optionally filter by domain or spam-list flag.
INPUTS: domain / isSpamList
list_data_classesREADList all data classes currently used by breaches in Have I Been Pwned.
list_pastes_for_accountREADList paste exposures for an email address from Have I Been Pwned.
INPUTS: emailAddress
search_breached_accountREADSearch full HIBP breach models for an email address, with optional domain and unverified-breach filters.
INPUTS: emailAddress / domain / includeUnverified
INPUT CONTRACTS
Know what the action needs before it runs.
get_breach
nameREQUIRED- Stable breach Name value to retrieve from HIBP.
list_breaches
domainOPTIONAL- Optional domain filter passed to the HIBP breaches endpoint.
isSpamListOPTIONAL- Optional spam-list filter passed to the HIBP breaches endpoint.
list_pastes_for_account
emailAddressREQUIRED- Email address to search for paste exposures in HIBP.
search_breached_account
emailAddressREQUIRED- Email address to search in Have I Been Pwned.
domainOPTIONAL- Optional domain filter applied to the breached account search.
includeUnverifiedOPTIONAL- Whether to include breaches flagged as unverified in the HIBP account search.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Breach
Get one breach by its stable HIBP Name value. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_breachVerify with Get Latest Breach
Get the most recently added breach in Have I Been Pwned. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_latest_breachSAFETY BOUNDARY
Operate Have I Been Pwned with explicit limits
- Authorize Have I Been Pwned with API key and grant only the provider access required by the selected actions.
- The current action names appear read-oriented, but returned Have I Been Pwned data may still be sensitive and should be minimized before it enters model context.
- Do not infer permission from catalog visibility. Workspace policy, connection identity, and upstream authorization still govern execution.
- No provider scope string is declared on the sampled actions. Verify the connected account's actual permissions in Have I Been Pwned rather than assuming unrestricted access.
- After a call, inspect the structured result and execution record before reporting that the Have I Been Pwned task completed successfully.
CONNECTION MODEL
API key
Have I Been Pwned API key sent with the hibp-api-key request header. Buy or view it on the official API key page: https://haveibeenpwned.com/API/Key.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 7
- WRITE SIGNALS
- 0
- HIGH IMPACT
- 0
- REVIEW SIGNALS
- 0
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Have I Been Pwned.