io.github.troyhunt/hibp

Est-ce que io.github.troyhunt/hibp est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.troyhunt/hibp » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 17 outils

• hibp_generate_domain_verification_dns_token≈ 517 tokens

  Generate the TXT record value required to verify domain control via DNS, creating or reusing the private HIBP domain-verification records needed for the request. Requires an authenticated subscription with domain-verification access.

  Paramètres, retour & exemple (2)

  Paramètres

  • domain · string · requis
    The domain to generate a verification token for.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_generate_domain_verification_dns_token", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"domain": "texte", "message": "texte", "guidance": "texte", "statusCode": 1, "txtRecordValue": "texte", "rateLimitResetAt": "texte", "retryAfterHeaders": {}, "retryAfterSeconds": 1}}

• hibp_get_breach≈ 469 tokens

  Look up a single public HIBP breach by its canonical breach name, such as Adobe.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
    The breach name to retrieve, for example Adobe.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_get_breach", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"breach": {}, "message": "texte", "guidance": "texte", "statusCode": 1, "rateLimitResetAt": "texte", "retryAfterHeaders": {}, "retryAfterSeconds": 1}}

• hibp_get_breached_account≈ 875 tokens

  Search HIBP for breaches affecting a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; use domain and verification filters to refine the result.

  Paramètres, retour & exemple (7)

  Paramètres

  • limit · integer · optionnel
    Maximum number of items to include in the response. Defaults to 25.
  • domain · string · optionnel
    Filter results to a specific breach domain.
  • offset · integer · optionnel
    Number of items to skip before returning results. Defaults to 0.
  • account · string · requis
    The email address to search for.
  • responseMode · string · optionnel · full | truncated | names
    Choose full breach objects, truncated objects, or breach names.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.
  • includeUnverified · boolean · optionnel
    Include unverified breaches. Defaults to true.

  Exemple d'appel

  {"name": "hibp_get_breached_account", "arguments": {"account": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"limit": 1, "offset": 1, "account": "texte", "hasMore": true, "message": "texte", "breaches": [], "guidance": "texte", "nextOffset": 1, "statusCode": 1, "totalCount": 1, "responseMode": "full", "returnedCount": 1}}

• hibp_get_breached_account_range≈ 894 tokens

  Query the authenticated HIBP k-anonymity breached-account range endpoint with the first 6 characters of a SHA-1 email hash. Requires a subscription with k-anonymity access; compare each returned suffix with the remaining hash characters locally because a prefix alone cannot identify an account.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · integer · optionnel
    Maximum number of items to include in the response. Defaults to 25.
  • offset · integer · optionnel
    Number of items to skip before returning results. Defaults to 0.
  • prefix · string · requis
    The first 6 hexadecimal characters of the SHA-1 hash of an email address. Compare each returned suffix with the remaining 34 characters locally; a prefix alone does not identify an account.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_get_breached_account_range", "arguments": {"prefix": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"limit": 1, "offset": 1, "prefix": "texte", "hasMore": true, "matches": [], "message": "texte", "guidance": "texte", "matchCount": 1, "nextOffset": 1, "statusCode": 1, "totalCount": 1, "returnedCount": 1}}

• hibp_get_breached_domain≈ 730 tokens

  Return breached aliases for a verified domain. This tool requires an authorized subscription via OAuth bearer token.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · integer · optionnel
    Maximum number of items to include in the response. Defaults to 25.
  • domain · string · requis
    The verified domain to search.
  • offset · integer · optionnel
    Number of items to skip before returning results. Defaults to 0.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_get_breached_domain", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"limit": 1, "domain": "texte", "offset": 1, "hasMore": true, "message": "texte", "guidance": "texte", "aliasCount": 1, "nextOffset": 1, "statusCode": 1, "totalCount": 1, "returnedCount": 1, "breachesByAlias": {}}}

• hibp_get_latest_breach≈ 441 tokens

  Return the most recently added public breach currently loaded into HIBP.

  Paramètres, retour & exemple (1)

  Paramètres

  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_get_latest_breach", "arguments": {"response_format": "markdown"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"breach": {}, "message": "texte", "guidance": "texte", "statusCode": 1, "rateLimitResetAt": "texte", "retryAfterHeaders": {}, "retryAfterSeconds": 1}}

• hibp_get_paste_account≈ 782 tokens

  Search for public pastes containing a single email address. Requires an OAuth bearer token linked to an active HIBP API subscription; run this separately from breached-account lookup.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · integer · optionnel
    Maximum number of items to include in the response. Defaults to 25.
  • offset · integer · optionnel
    Number of items to skip before returning results. Defaults to 0.
  • account · string · requis
    The email address to search for pastes.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_get_paste_account", "arguments": {"account": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"limit": 1, "offset": 1, "pastes": [], "account": "texte", "hasMore": true, "message": "texte", "guidance": "texte", "nextOffset": 1, "statusCode": 1, "totalCount": 1, "returnedCount": 1, "rateLimitResetAt": "texte"}}

• hibp_get_pwned_passwords_range≈ 874 tokens

  Query the public Pwned Passwords k-anonymity API with a 5-character SHA-1 or NTLM prefix and return matching suffixes with prevalence counts.

  Paramètres, retour & exemple (6)

  Paramètres

  • mode · string · optionnel · sha1 | ntlm
    Use SHA-1 by default or NTLM when mode is set to ntlm.
  • limit · integer · optionnel
    Maximum number of items to include in the response. Defaults to 25.
  • offset · integer · optionnel
    Number of items to skip before returning results. Defaults to 0.
  • prefix · string · requis
    The first 5 hexadecimal characters of a SHA-1 or NTLM hash.
  • addPadding · boolean · optionnel
    Send the Add-Padding header and discard padded zero-count entries.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_get_pwned_passwords_range", "arguments": {"prefix": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"mode": "sha1", "limit": 1, "offset": 1, "prefix": "texte", "hasMore": true, "matches": [], "message": "texte", "guidance": "texte", "addPadding": true, "matchCount": 1, "nextOffset": 1, "statusCode": 1}}

• hibp_get_stealer_logs_by_email≈ 714 tokens

  Return website domains historically observed in stealer logs for an email address. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.

  Paramètres, retour & exemple (4)

  Paramètres

  • email · string · requis
    The email address to search for in stealer logs.
  • limit · integer · optionnel
    Maximum number of items to include in the response. Defaults to 25.
  • offset · integer · optionnel
    Number of items to skip before returning results. Defaults to 0.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_get_stealer_logs_by_email", "arguments": {"email": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"email": "texte", "limit": 1, "offset": 1, "domains": [], "hasMore": true, "message": "texte", "guidance": "texte", "nextOffset": 1, "statusCode": 1, "totalCount": 1, "returnedCount": 1, "rateLimitResetAt": "texte"}}

• hibp_get_stealer_logs_by_email_domain≈ 768 tokens

  Return email aliases and associated website domains historically observed in stealer logs for an email domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · integer · optionnel
    Maximum number of items to include in the response. Defaults to 25.
  • domain · string · requis
    The email domain to search for in stealer logs.
  • offset · integer · optionnel
    Number of items to skip before returning results. Defaults to 0.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_get_stealer_logs_by_email_domain", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"limit": 1, "domain": "texte", "offset": 1, "aliases": {}, "hasMore": true, "message": "texte", "guidance": "texte", "aliasCount": 1, "nextOffset": 1, "statusCode": 1, "totalCount": 1, "returnedCount": 1}}

• hibp_get_stealer_logs_by_website_domain≈ 719 tokens

  Return email addresses historically observed in stealer logs for a website domain. Requires an OAuth-linked active subscription with the stealer-log feature; results do not establish current account access.

  Paramètres, retour & exemple (4)

  Paramètres

  • limit · integer · optionnel
    Maximum number of items to include in the response. Defaults to 25.
  • domain · string · requis
    The website domain to search for in stealer logs.
  • offset · integer · optionnel
    Number of items to skip before returning results. Defaults to 0.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_get_stealer_logs_by_website_domain", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"limit": 1, "domain": "texte", "emails": [], "offset": 1, "hasMore": true, "message": "texte", "guidance": "texte", "nextOffset": 1, "statusCode": 1, "totalCount": 1, "returnedCount": 1, "rateLimitResetAt": "texte"}}

• hibp_get_subscription_status≈ 991 tokens

  Return the current plan, quotas, rate limits, expiry, and feature flags for the active HIBP API subscription linked to the authenticated OAuth connection. Use it to confirm access before feature-dependent lookups.

  Paramètres, retour & exemple (1)

  Paramètres

  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_get_subscription_status", "arguments": {"response_format": "markdown"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"message": "texte", "guidance": "texte", "statusCode": 1, "subscription": {}, "rateLimitResetAt": "texte", "retryAfterHeaders": {}, "retryAfterSeconds": 1}}

• hibp_list_breaches≈ 742 tokens

  List public HIBP breaches, optionally filtered by domain, spam-list flag, and verification status.

  Paramètres, retour & exemple (6)

  Paramètres

  • limit · integer · optionnel
    Maximum number of items to include in the response. Defaults to 25.
  • domain · string · optionnel
    Filter to breaches for a specific domain.
  • offset · integer · optionnel
    Number of items to skip before returning results. Defaults to 0.
  • isSpamList · boolean · optionnel
    Filter to breaches that are or are not flagged as spam lists.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.
  • includeUnverified · boolean · optionnel
    Include unverified breaches. Defaults to true.

  Exemple d'appel

  {"name": "hibp_list_breaches", "arguments": {"limit": 1, "domain": "texte", "offset": 1, "isSpamList": true, "response_format": "markdown", "includeUnverified": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"limit": 1, "offset": 1, "hasMore": true, "message": "texte", "breaches": [], "guidance": "texte", "nextOffset": 1, "statusCode": 1, "totalCount": 1, "returnedCount": 1, "rateLimitResetAt": "texte", "retryAfterHeaders": {}}}

• hibp_list_data_classes≈ 440 tokens

  List the data classes used across public HIBP breach models, such as email addresses or passwords.

  Paramètres, retour & exemple (1)

  Paramètres

  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_list_data_classes", "arguments": {"response_format": "markdown"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"message": "texte", "guidance": "texte", "statusCode": 1, "dataClasses": [], "rateLimitResetAt": "texte", "retryAfterHeaders": {}, "retryAfterSeconds": 1}}

• hibp_list_subscribed_domains≈ 824 tokens

  List the domains associated with the authenticated HIBP subscription.

  Paramètres, retour & exemple (3)

  Paramètres

  • limit · integer · optionnel
    Maximum number of items to include in the response. Defaults to 25.
  • offset · integer · optionnel
    Number of items to skip before returning results. Defaults to 0.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_list_subscribed_domains", "arguments": {"limit": 1, "offset": 1, "response_format": "markdown"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"limit": 1, "offset": 1, "hasMore": true, "message": "texte", "guidance": "texte", "nextOffset": 1, "statusCode": 1, "totalCount": 1, "returnedCount": 1, "rateLimitResetAt": "texte", "retryAfterHeaders": {}, "retryAfterSeconds": 1}}

• hibp_send_domain_verification_email≈ 530 tokens

  Send a domain verification email to an approved alias such as admin or security. Requires an authenticated subscription with domain-verification access.

  Paramètres, retour & exemple (3)

  Paramètres

  • domain · string · requis
    The domain to verify by email.
  • emailAlias · string · requis
    The approval alias to send the verification email to, for example admin.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_send_domain_verification_email", "arguments": {"domain": "texte", "emailAlias": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"domain": "texte", "message": "texte", "guidance": "texte", "emailSent": true, "emailAlias": "texte", "statusCode": 1, "rateLimitResetAt": "texte", "retryAfterHeaders": {}, "retryAfterSeconds": 1}}

• hibp_verify_domain_verification_dns_token≈ 492 tokens

  Complete domain verification by checking the expected HIBP TXT record on the target domain. Requires an authenticated subscription with domain-verification access.

  Paramètres, retour & exemple (2)

  Paramètres

  • domain · string · requis
    The domain to verify by DNS.
  • response_format · string · optionnel · markdown | json
    Format only the text content as markdown (default) or a JSON string. The same machine-readable data is always returned in structuredContent.

  Exemple d'appel

  {"name": "hibp_verify_domain_verification_dns_token", "arguments": {"domain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"domain": "texte", "message": "texte", "guidance": "texte", "verified": true, "statusCode": 1, "rateLimitResetAt": "texte", "retryAfterHeaders": {}, "retryAfterSeconds": 1}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://haveibeenpwned.com/mcp