Have I Been Pwned MCP Server

Have I Been Pwned MCP 服务

一个 Model Context Protocol（MCP）服务，可集成 Have I Been Pwned API，检查你的账户或密码是否在数据泄露事件中遭到泄露。

功能

此 MCP 服务提供以下工具：

免费（无需 API 密钥）

1. check_password：检查密码是否在数据泄露事件中暴露（使用 k-匿名性）
2. get_breach_details：获取特定数据泄露事件的详细信息
3. list_all_breaches：列出系统中的所有泄露事件，可按域名筛选
4. get_data_classes：列出可能出现在泄露事件中的所有数据类型（数据类别）
5. get_latest_breach：获取系统中最近添加的泄露事件

需要付费的 HIBP API 密钥

6. check_email：检查电子邮件地址是否出现在数据泄露事件中
7. get_pastes_for_account：检查电子邮件地址是否出现在粘贴内容中（例如 Pastebin）
8. check_stealer_logs_by_email：检查哪些网站域名上有信息窃取恶意软件捕获的该电子邮件地址凭据（Pro 层级或更高）
9. check_stealer_logs_by_website_domain：检查信息窃取恶意软件捕获了哪些与网站域名关联的电子邮件别名凭据（Pro 层级或更高）
10. check_stealer_logs_by_email_domain：检查已验证电子邮件域名下的哪些电子邮件别名有信息窃取恶意软件捕获的凭据，以及对应的网站（Pro 层级或更高）

信息窃取日志属于与传统泄露列表不同、保真度更高的威胁类别：它们显示的是信息窃取恶意软件直接从受害者设备上捕获的凭据（例如，从浏览器保存的密码中获取），而不是公司数据库遭到攻击后泄露的凭据。

安装

通过 Smithery 安装

要通过 Smithery 自动为 Claude Desktop 安装 hibp-mcp-server：

npx -y @smithery/cli install @Cyreslab-AI/hibp-mcp-server --client claude

前置条件

• Node.js（v14 或更高版本）
• npm（v6 或更高版本）
• Have I Been Pwned API 密钥（可在 haveibeenpwned.com/API/Key 获取）

设置

1. 克隆此仓库：

   git clone https://github.com/Cyreslab-AI/hibp-mcp-server.git
   cd hibp-mcp-server
   

2. 安装依赖项：

   npm install
   

3. 构建服务：

   npm run build
   

4. 在 MCP 设置文件中配置服务：

   对于 Claude VSCode 扩展，将以下内容添加到 ~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json：

   {
     "mcpServers": {
       "hibp": {
         "command": "node",
         "args": ["/path/to/hibp-mcp-server/build/index.js"],
         "env": {
           "HIBP_API_KEY": "YOUR_API_KEY_HERE"
         },
         "disabled": false,
         "autoApprove": []
       }
     }
   }
   

   对于 Claude 桌面应用，将以下内容添加到 ~/Library/Application Support/Claude/claude_desktop_config.json（macOS）或其他平台上的相应路径。

使用示例

配置好服务后，你就可以在 Claude 中使用它来检查数据泄露情况：

检查电子邮件

User: Has my email address [email protected] been pwned?

Claude: Good news! This email address has not been found in any known data breaches.

或者，如果该电子邮件出现在泄露事件中：

User: Has my email address [email protected] been pwned?

Claude: ⚠️ This email address was found in 3 data breaches.

Breach details:

1. Adobe (2013-10-04)
   Domain: adobe.com
   Description: In October 2013, 153 million Adobe accounts were breached...
   Compromised data: Email addresses, Password hints, Passwords, Usernames

2. LinkedIn (2012-05-05)
   Domain: linkedin.com
   Description: In May 2016, LinkedIn had 164 million email addresses and passwords exposed...
   Compromised data: Email addresses, Passwords

3. Dropbox (2012-07-01)
   Domain: dropbox.com
   Description: In mid-2012, Dropbox suffered a data breach which exposed...
   Compromised data: Email addresses, Passwords

Recommendations:
- Change your password for these services immediately
- If you used the same password elsewhere, change those too
- Enable two-factor authentication where available
- Consider using a password manager

检查密码

User: Has the password "password123" been exposed in any breaches?

Claude: ⚠️ This password has been exposed in data breaches 123,456 times!

Recommendations:
- Stop using this password immediately
- Change it on any site where you use it
- Use a unique, strong password for each account
- Consider using a password manager

获取泄露事件详情

User: Tell me about the LinkedIn data breach

Claude: # LinkedIn Data Breach

**Date:** 2012-05-05
**Domain:** linkedin.com
**Accounts affected:** 164,611,595
**Verified:** Yes
**Data leaked:** Email addresses, Passwords

**Description:**
In May 2016, LinkedIn had 164 million email addresses and passwords exposed. Originally hacked in 2012, the data remained out of sight until being offered for sale on a dark market site 4 years later. The passwords in the breach were stored as SHA1 hashes without salt, the vast majority of which were quickly cracked in the days following the release of the data.

**Recommendations:**
- If you had an account on this service, change your password
- If you used the same password elsewhere, change those too
- Monitor your accounts for suspicious activity
- Be cautious of phishing attempts that may use this leaked information

列出所有泄露事件

User: List all Adobe data breaches

Claude: Found 1 breaches for domain adobe.com:

1. Adobe (2013-10-04)
   Domain: adobe.com
   Accounts affected: 152,445,165
   Compromised data: Email addresses, Password hints, Passwords, Usernames

获取数据类别

User: What types of data does HIBP track?

Claude: Have I Been Pwned tracks 165 types of compromised data:

- Academic records
- Account balances
- ...

获取最新泄露事件

User: What's the most recent breach added to HIBP?

Claude: # Latest Breach: Chess2026

**Date:** 2026-08-03
**Domain:** chess.com
**Accounts affected:** 4,653,212
**Data leaked:** Email addresses, Geographic locations, Names, Usernames

获取账户的粘贴内容（需要 API 密钥）

User: Has my email been found in any pastes?

Claude: ⚠️ This email address was found in 1 paste.

1. Source: Pastebin
   Date: 2014-03-04T19:14:54Z
   Email addresses in paste: 139

按电子邮件检查信息窃取日志（需要 Pro 层级或更高的 API 密钥）

User: Has my email shown up in any stealer logs?

Claude: ⚠️ This email address's credentials were found in stealer logs for 2 websites.

Websites: netflix.com, spotify.com

Recommendations:
- Change your password on these websites immediately
- Run an up-to-date malware scan on any device you use to log in
- Enable two-factor authentication where available

按网站域名检查信息窃取日志（需要 Pro 层级或更高的 API 密钥）

User: Which of our users had credentials for netflix.com captured by stealer malware?

Claude: ⚠️ Found 2 email aliases with credentials for netflix.com captured in stealer logs.

Email aliases: [email protected], [email protected]

按电子邮件域名检查信息窃取日志（需要 Pro 层级或更高的 API 密钥，且域名已验证）

User: Have any of our employees at example.com shown up in stealer logs?

Claude: ⚠️ Found 2 email aliases at example.com with credentials captured in stealer logs.

1. [email protected]: netflix.com
2. [email protected]: netflix.com, spotify.com

安全说明

• 密码检查功能使用 k-匿名性来检查密码，不会将完整密码发送到 Have I Been Pwned API
• 仅将密码 SHA-1 哈希的前 5 个字符发送到 API
• API 会返回与此前缀匹配的哈希后缀列表，并在本地完成检查

API 密钥配置

根据 HIBP API，某些端点免费且公开，其他端点则需要付费 API 密钥：

• 免费，无需密钥： check_password、get_breach_details、list_all_breaches、get_data_classes、get_latest_breach
• 需要付费 API 密钥： check_email、get_pastes_for_account（Core、Pro 或 High RPM 层级）
• 需要具备 Pro 层级或更高级别访问权限的付费 API 密钥： check_stealer_logs_by_email、check_stealer_logs_by_website_domain、check_stealer_logs_by_email_domain（这些按邮箱/域名限定的窃取日志端点还要求先在 HIBP 验证该域名）

你可以在 haveibeenpwned.com/API/Key 获取 API 密钥。

应在 MCP 设置配置中将 API 密钥作为名为 HIBP_API_KEY 的环境变量提供。若未设置此变量，上述免费工具仍可使用；需要密钥的工具会返回明确的错误消息，而不会静默失败。

许可证

MIT