Have I Been Pwned MCP Server
for AI Agents
Connect your AI agent to StackOne's Have I Been Pwned MCP server and give it ready-to-use MCP tools out of the box. Auth, tool execution, and security all managed.
StackOne 
Coverage
18 Agent Actions
Agents can read and write in Have I Been Pwned. Extend your agent's capabilities with custom actions.
Authentication
Agent Tool Authentication
Per-user OAuth in one call. Your Have I Been Pwned MCP server gets session-scoped tokens with zero credentials stored on your infra.
Agent Auth →
Security
Agent Protection
Every Have I Been Pwned tool response scanned for prompt injection in milliseconds, with 88.7% accuracy, all running on CPU.
Prompt Injection Defense →
Performance
Max Agent Context. Min Cost.
Free up to 96% of your agent's context window to enhance reasoning and reduce cost, on every Have I Been Pwned call.
Tools Discovery →What is the Have I Been Pwned MCP Server?
A Have I Been Pwned MCP server lets AI agents read and write Have I Been Pwned data through the Model Context Protocol, Anthropic's open standard for connecting LLMs to external tools. StackOne's Have I Been Pwned MCP server ships with pre-built actions, fully extensible via the Connector Builder, plus managed authentication, prompt injection defense, observability, and agent execution runtime. Connect it from MCP clients like Claude Desktop, Claude Code, Cursor, Goose, and VS Code, or from agent frameworks like OpenAI Agents SDK, LangChain, and Vercel AI SDK.
All Have I Been Pwned MCP Tools
Every StackOne action for Have I Been Pwned, ready for your agent. Read and write, scoped to exactly what you need.
Other (18)
- Send Domain Verification Email
Sends a verification email to an alias on the domain so domain control can be approved by link.
- List Account Breaches
Returns the breaches an email address, username, or phone number appears in.
- Search Account Breach Range
Returns breached email hash suffixes and their breach names for a 6-character SHA-1 prefix (k-anonymity).
- List Breaches
Returns the full catalogue of breaches loaded into Have I Been Pwned.
- Get Breach
Returns the full breach model for a single breach by its Name.
- Get Latest Breach
Returns the breach most recently added to Have I Been Pwned.
- List Data Classes
Returns the alphabetical list of data class names seen across breaches.
- List Data Class Descriptions
Returns the alphabetical list of data classes seen across breaches, with a description of each.
- List Domain Breached Emails
Returns every breached email alias on a verified domain and the breaches each alias appears in.
- List Subscribed Domains
Returns the verified domains linked to the API key, with breach counts.
- Search Pwned Password Range
Returns pwned password hash suffixes and their breach counts for a 5-character hash prefix (k-anonymity).
- List Account Pastes
Returns the pastes an email address has appeared in.
- List Stealer Logs By Email
Returns the website domains an email address's credentials were captured on by info-stealer malware.
- List Stealer Logs By Website Domain
Returns the email addresses whose credentials were captured on a website domain by info-stealer malware.
- List Stealer Logs By Email Domain
Returns the email aliases on a domain that appear in stealer logs, mapped to the website domains they were captured on.
- Get Subscription Status
Returns the plan, rate limit, expiry, and capabilities of the subscription behind the API key.
- Generate Domain DNS Token
Generates the TXT record value used to verify control of a domain via DNS.
- Verify Domain DNS Token
Checks the domain's hibp-verify TXT record and marks the domain verified when it matches.
Set Up Your Have I Been Pwned MCP Server in Minutes
One endpoint. Any framework. Your agent is talking to Have I Been Pwned in under 10 lines of code.
Agent Frameworks
JSON{
"mcpServers": {
"stackone": {
"command": "npx",
"args": [
"-y",
"mcp-remote@latest",
"https://api.stackone.com/mcp?x-account-id=<account_id>",
"--header",
"Authorization: Basic <YOUR_BASE64_TOKEN>"
]
}
}
}Platform Resources
Comparing BM25, TF-IDF, and Hybrid Search for MCP Tool Discovery
Benchmarking BM25, TF-IDF, and hybrid search for MCP tool discovery across 916 tools. The 80/20 TF-IDF/BM25 hybrid hits 21% Top-1 accuracy in under 1ms.
10 min
Indirect Prompt Injection Defense for MCP Tools: A Technical Guide
MCP tools that read emails, CRM records, and tickets are indirect prompt injection vectors. Here's how we built a two-tier defense that scans tool results in ~11ms.
12 min
MCP vs A2A: Architecture, Security, and When to Use Each
MCP vs A2A: what each protocol standardizes, how they differ, their shared security risks including indirect prompt injection, and when to use one, both, or a hybrid architecture.
12 min
MCP vs API: What Hundreds of Connector Builds Taught Us
MCP wraps APIs, it doesn't replace them. After building hundreds of connectors that serve both, here's when each approach wins.
14 min read
Have I Been Pwned MCP Server FAQ
Does StackOne have a Have I Been Pwned MCP server?
Have I Been Pwned MCP server vs direct API integration: what's the difference?
How does Have I Been Pwned authentication work for AI agents?
origin_owner_id.Are Have I Been Pwned MCP tools vulnerable to prompt injection?
What is the context bloat of a Have I Been Pwned agent and how do I avoid it?
Can I limit which actions my Have I Been Pwned agent can access?
Can I create custom agent actions for my Have I Been Pwned MCP server?
When should I NOT use a Have I Been Pwned MCP server?
What AI frameworks and AI clients does the StackOne Have I Been Pwned MCP server support?
Put your AI agents to work
All the tools you need to build and scale AI agent integrations, with best-in-class connectivity, execution, and security.