Have I Been Pwned MCP 服务器

这是一个 Model Context Protocol (MCP) 服务器，它提供了与 Have I Been Pwned API 的集成，用于检查您的账户或密码是否在数据泄露中被泄露。

功能

此 MCP 服务器提供了四个主要工具：

1. check_email: 检查电子邮件地址是否在数据泄露中被发现
2. check_password: 检查密码是否在数据泄露中被暴露（使用 k-匿名性）
3. get_breach_details: 获取特定数据泄露的详细信息
4. list_all_breaches: 列出系统中的所有泄露事件，可选地按域名过滤

安装

通过 Smithery 安装

要通过 Smithery 自动为 Claude Desktop 安装 hibp-mcp-server：

npx -y @smithery/cli install @Cyreslab-AI/hibp-mcp-server --client claude

先决条件

• Node.js (v14 或更高版本)
• npm (v6 或更高版本)
• 一个 Have I Been Pwned API 密钥（请在 haveibeenpwned.com/API/Key 获取）

设置

1. 克隆此仓库：

   git clone https://github.com/Cyreslab-AI/hibp-mcp-server.git
   cd hibp-mcp-server
   

2. 安装依赖项：

   npm install
   

3. 构建服务器：

   npm run build
   

4. 在您的 MCP 设置文件中配置服务器：

   对于 Claude VSCode 扩展，在 ~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json 中添加：

   {
     "mcpServers": {
       "hibp": {
         "command": "node",
         "args": ["/path/to/hibp-mcp-server/build/index.js"],
         "env": {
           "HIBP_API_KEY": "YOUR_API_KEY_HERE"
         },
         "disabled": false,
         "autoApprove": []
       }
     }
   }
   

   对于 Claude 桌面应用程序，在 ~/Library/Application Support/Claude/claude_desktop_config.json（macOS）或其他平台上的类似路径中添加。

使用示例

一旦配置好服务器，您就可以使用 Claude 检查数据泄露情况：

检查电子邮件

User: Has my email address example@gmail.com been pwned?

Claude: Good news! This email address has not been found in any known data breaches.

如果电子邮件在泄露事件中被找到：

User: Has my email address breached@example.com been pwned?

Claude: ⚠️ This email address was found in 3 data breaches.

Breach details:

1. Adobe (2013-10-04)
   Domain: adobe.com
   Description: In October 2013, 153 million Adobe accounts were breached...
   Compromised data: Email addresses, Password hints, Passwords, Usernames

2. LinkedIn (2012-05-05)
   Domain: linkedin.com
   Description: In May 2016, LinkedIn had 164 million email addresses and passwords exposed...
   Compromised data: Email addresses, Passwords

3. Dropbox (2012-07-01)
   Domain: dropbox.com
   Description: In mid-2012, Dropbox suffered a data breach which exposed...
   Compromised data: Email addresses, Passwords

Recommendations:
- Change your password for these services immediately
- If you used the same password elsewhere, change those too
- Enable two-factor authentication where available
- Consider using a password manager

检查密码

User: Has the password "password123" been exposed in any breaches?

Claude: ⚠️ This password has been exposed in data breaches 123,456 times!

Recommendations:
- Stop using this password immediately
- Change it on any site where you use it
- Use a unique, strong password for each account
- Consider using a password manager

获取泄露详情

User: Tell me about the LinkedIn data breach

Claude: # LinkedIn Data Breach

**Date:** 2012-05-05
**Domain:** linkedin.com
**Accounts affected:** 164,611,595
**Verified:** Yes
**Data leaked:** Email addresses, Passwords

**Description:**
In May 2016, LinkedIn had 164 million email addresses and passwords exposed. Originally hacked in 2012, the data remained out of sight until being offered for sale on a dark market site 4 years later. The passwords in the breach were stored as SHA1 hashes without salt, the vast majority of which were quickly cracked in the days following the release of the data.

**Recommendations:**
- If you had an account on this service, change your password
- If you used the same password elsewhere, change those too
- Monitor your accounts for suspicious activity
- Be cautious of phishing attempts that may use this leaked information

列出所有泄露事件

User: List all Adobe data breaches

Claude: Found 1 breaches for domain adobe.com:

1. Adobe (2013-10-04)
   Domain: adobe.com
   Accounts affected: 152,445,165
   Compromised data: Email addresses, Password hints, Passwords, Usernames

安全注意事项

• 密码检查功能使用 k-匿名性来检查密码，而无需将完整的密码发送到 Have I Been Pwned API
• 只有密码的 SHA-1 哈希值的前 5 个字符会被发送到 API
• API 返回与前缀匹配的哈希后缀列表，并在本地完成检查

API 密钥配置

此服务器需要一个 Have I Been Pwned API 密钥才能使大多数功能正常工作（除了密码检查）。您可以在 haveibeenpwned.com/API/Key 获取 API 密钥。

API 密钥应作为名为 HIBP_API_KEY 的环境变量在您的 MCP 设置配置中提供。

许可证

MIT