# XposedOrNot Breach Intelligence

A remote MCP server that gives your agent access to breach data: check an email or domain and see whether it appeared in known leaks.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 100
- Author: XposedOrNot
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/XposedOrNot/XposedOrNot-API
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/xposedornot-breach-intelligence

## What it does

The server connects to the XposedOrNot API at `https://api.xposedornot.com/mcp` and exposes tools for email checks, breach analytics, known breach listings and metrics. Basic endpoints like `/v1/check-email` and `/v1/breach-analytics` need no key, so a quick address check works out of the box.

Domains are different. Domain breach data is only available after you verify ownership: sign in at xposedornot.com, open the CxO Dashboard, verify the domain, then grab a key under API Key Management. The key goes in the `x-api-key` header, and the call itself is a POST to `/v1/domain-breaches/` with no body. Without a verified domain that endpoint returns nothing.

Rate limits apply per IP, per endpoint: `GET /v1/check-email/{email}` allows 2 requests per second, 25 per hour and 100 per day. Exceed it and you get `429 Too Many Requests` with a `Retry-After` header plus `retry_after` and `reset_time` in the body, so a client can back off precisely. If you're building a product on this data, xonAPI+ paid plans start at $5/month with limits up to 25,000 requests per minute.

## Requirements
- Remote server: `https://api.xposedornot.com/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http xposedornot https://api.xposedornot.com/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add xposedornot-breach-intelligence --url https://api.xposedornot.com/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "xposedornot-breach-intelligence": {
            "url": "https://api.xposedornot.com/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "xposedornot-breach-intelligence": {
            "type": "http",
            "url": "https://api.xposedornot.com/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http xposedornot-breach-intelligence https://api.xposedornot.com/mcp
```

## When to use it
- check whether an email shows up in known breaches
- see which leaks affect a specific domain
- pull breach metrics for a report
- subscribe to fresh breach updates via RSS
- size up a leak before rotating passwords

## Example prompts
- Check `test@example.com` with XposedOrNot and list the breaches it appears in
- Give me breach analytics for `user@company.com`
- List known breaches for the domain `example.com`

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md