> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Have I Been Pwned

> Give the Sazabi agent tools to look up public data breaches, the data they exposed, and whether a password appears in known breaches. On by default in every project.

[All Have I Been Pwned integration capabilities](https://docs.sazabi.com/catalogs/integrations/hibp)

## About

This is an MCP connector that gives the Sazabi agent tools from Have I Been Pwned's hosted MCP server (`haveibeenpwned.com/mcp`). Sazabi exposes the five public read-only tools, which need no authentication: `hibp_list_breaches` (public breaches, optionally for one domain), `hibp_get_breach` (one breach by name), `hibp_get_latest_breach` (the newest breach), `hibp_list_data_classes` (the kinds of data breaches expose), and `hibp_get_pwned_passwords_range` (the Pwned Passwords range for the first five characters of a hash).

Have I Been Pwned is on by default in every project. Sazabi adds it automatically, so there is nothing to connect, no credentials to enter, and no per-project setup. It is managed by Sazabi: it cannot be renamed or disconnected.

**What the agent can do:**

* Check whether a company or site appears in a known data breach
* Read a breach's date, size, and the data it exposed
* Check whether a password appears in known breaches without sending it: the agent hashes the password locally and sends only the first five characters of the hash

**What stays read-only and public:** Have I Been Pwned's tools that look up email addresses, pastes, domains, stealer logs, and subscriptions need a signed-in Have I Been Pwned account, and its domain-verification tools change Have I Been Pwned's records or send email. Sazabi blocks them, so the agent cannot tell you whether a specific email address was in a breach.

## Prerequisites

* None. Have I Been Pwned is on by default in every project and its public tools need no sign-in.

## Set up in the dashboard

There is nothing to set up. Find Have I Been Pwned in [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors), where it appears as connected and managed by Sazabi.

## Set up with the CLI

There is nothing to set up with the CLI either. With the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) installed and authenticated (see [`sazabi mcp-connectors` reference](https://docs.sazabi.com/reference/cli/mcp-connectors)), list the project's connectors to see Have I Been Pwned:

```bash theme={"system"}
sazabi mcp-connectors list
```

## Verify

Open [**Settings > MCP connectors**](https://app.sazabi.com/settings/mcp-connectors) and confirm Have I Been Pwned is listed as connected and managed by Sazabi. Then, in a thread, ask the agent about a known breach, for example "what did the Adobe breach expose?", and confirm it answers with details from Have I Been Pwned.

## Troubleshooting

**Have I Been Pwned is not listed** — Sazabi can turn the default off for every project at once if the Have I Been Pwned server has problems. Check back later or contact Sazabi support.

**The agent cannot say whether an email address was breached** — That lookup needs a signed-in Have I Been Pwned account, which this connector does not use. Check the address yourself at haveibeenpwned.com.

## Further reading

> [card] [Agent tools](https://docs.sazabi.com/guides/investigate/agent-tools.md)
>
> How the agent uses connector tools.

> [card] [MCP connectors](https://docs.sazabi.com/catalogs/mcp-connectors.md)
>
> Browse the connector catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.