Skip to main content
All Have I Been Pwned integration capabilities

​
About

This is an MCP connector that gives the Sazabi agent tools from Have I Been Pwned’s hosted MCP server (haveibeenpwned.com/mcp). Sazabi exposes the five public read-only tools, which need no authentication: hibp_list_breaches (public breaches, optionally for one domain), hibp_get_breach (one breach by name), hibp_get_latest_breach (the newest breach), hibp_list_data_classes (the kinds of data breaches expose), and hibp_get_pwned_passwords_range (the Pwned Passwords range for the first five characters of a hash). Have I Been Pwned is on by default in every project. Sazabi adds it automatically, so there is nothing to connect, no credentials to enter, and no per-project setup. It is managed by Sazabi: it cannot be renamed or disconnected. What the agent can do:
  • Check whether a company or site appears in a known data breach
  • Read a breach’s date, size, and the data it exposed
  • Check whether a password appears in known breaches without sending it: the agent hashes the password locally and sends only the first five characters of the hash
What stays read-only and public: Have I Been Pwned’s tools that look up email addresses, pastes, domains, stealer logs, and subscriptions need a signed-in Have I Been Pwned account, and its domain-verification tools change Have I Been Pwned’s records or send email. Sazabi blocks them, so the agent cannot tell you whether a specific email address was in a breach.

​
Prerequisites

  • None. Have I Been Pwned is on by default in every project and its public tools need no sign-in.

​
Set up in the dashboard

There is nothing to set up. Find Have I Been Pwned in Settings > MCP connectors, where it appears as connected and managed by Sazabi.

​
Set up with the CLI

There is nothing to set up with the CLI either. With the Sazabi CLI installed and authenticated (see sazabi mcp-connectors reference), list the project’s connectors to see Have I Been Pwned:

​
Verify

Open Settings > MCP connectors and confirm Have I Been Pwned is listed as connected and managed by Sazabi. Then, in a thread, ask the agent about a known breach, for example “what did the Adobe breach expose?”, and confirm it answers with details from Have I Been Pwned.

​
Troubleshooting

Have I Been Pwned is not listed — Sazabi can turn the default off for every project at once if the Have I Been Pwned server has problems. Check back later or contact Sazabi support. The agent cannot say whether an email address was breached — That lookup needs a signed-in Have I Been Pwned account, which this connector does not use. Check the address yourself at haveibeenpwned.com.

​
Further reading

Agent tools

How the agent uses connector tools.

MCP connectors

Browse the connector catalog.