# hibp

An MCP server that wires the Have I Been Pwned API into your coding agent. Handy when you want a breach lookup without leaving the editor.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 5
- Author: darrenjrobinson
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/darrenjrobinson/HIBP-MCP-Server
- Updated: 2026-10-14
- HTML: https://affpapa.org/en/nevibecode/mcp/hibp

## What it does

The server exposes the Have I Been Pwned API to your agent, so a question about an address or a domain gets answered in the same conversation.

It runs through `npx -y @darrenjrobinson/hibp-mcp`, so there is nothing to install globally. Two environment variables are required: `HIBP_API_KEY` and `HIBP_SUBSCRIPTION_PLAN`. Without the key the server cannot reach the API, and the plan value tells it which endpoints your subscription covers.

Setup differs by platform. Claude and Claude take a `claude mcp add` or `codex mcp add` line, Cursor and GitHub Copilot use a JSON block in their config, and Gemini CLI gets a `gemini mcp add` command.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `HIBP_API_KEY`, `HIBP_SUBSCRIPTION_PLAN` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add hibp -e HIBP_API_KEY=<HIBP_API_KEY> -e HIBP_SUBSCRIPTION_PLAN=<HIBP_SUBSCRIPTION_PLAN> -- npx -y @darrenjrobinson/hibp-mcp
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add hibp --env HIBP_API_KEY=<HIBP_API_KEY> --env HIBP_SUBSCRIPTION_PLAN=<HIBP_SUBSCRIPTION_PLAN> -- npx -y @darrenjrobinson/hibp-mcp
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "hibp": {
            "command": "npx",
            "args": [
                "-y",
                "@darrenjrobinson/hibp-mcp"
            ],
            "env": {
                "HIBP_API_KEY": "<HIBP_API_KEY>",
                "HIBP_SUBSCRIPTION_PLAN": "<HIBP_SUBSCRIPTION_PLAN>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "hibp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@darrenjrobinson/hibp-mcp"
            ],
            "env": {
                "HIBP_API_KEY": "<HIBP_API_KEY>",
                "HIBP_SUBSCRIPTION_PLAN": "<HIBP_SUBSCRIPTION_PLAN>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e HIBP_API_KEY=<HIBP_API_KEY> -e HIBP_SUBSCRIPTION_PLAN=<HIBP_SUBSCRIPTION_PLAN> hibp npx -y @darrenjrobinson/hibp-mcp
```
Replace <…> with your own values

## When to use it
- check an address for breaches without opening a browser
- see whether a domain shows up in HIBP data
- pull a breach summary into the agent's reply
- keep breach lookups inside the IDE workflow

## Example prompts
- Check user@example.com against hibp
- What breaches are known for example.com?
- Run this list of addresses through hibp and flag the matches

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md