# Use Have I Been Pwned with your agent.

[Have I Been Pwned](https://haveibeenpwned.com/) (`haveibeenpwned.com`) registers 4 WebMCP tools. 4 of 4 tools declares `readOnlyHint`, so an agent can invoke them through `tools.call`. The registry runs the tool in a fresh headless page on haveibeenpwned.com and returns untrusted site content.

This page mirrors the [WebMCP Registry](https://wmcp.ai/sites/haveibeenpwned.com) listing for `haveibeenpwned.com`, last live-checked by the registry at 2026-09-23T06:14:53.773Z. Run `ghostget webmcp sites.get --input '{"domain":"haveibeenpwned.com"}' --json` for the current schema; the listing can drift between checks.

## Use Have I Been Pwned with my agent

Ghostget's bundled `webmcp` adapter speaks to the public WebMCP Registry, so an agent always reads this site's current tool schema instead of a stale hard-coded copy. Install v0.18.35, sync bundled adapters once, then call the registry operations:

```
bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.35/hraness-ghostget-0.18.35.tgz
ghostget adapter sync-bundled --json
```

**Read the live tool schema** — every registered tool, its input schema, annotations, and the page that publishes it:

```
ghostget webmcp sites.get --input '{"domain":"haveibeenpwned.com"}' --json
```

**Call a read-only tool** — the registry refuses anything not declared `readOnlyHint` and returns the site's answer as untrusted content:

```
ghostget webmcp tools.call --input '{"domain":"haveibeenpwned.com","tool":"check-password-pwned","input":"{}"}' --json
```

## Registered WebMCP tools

Have I Been Pwned publishes 4 tools on haveibeenpwned.com; 4 declare `readOnlyHint`.

| Tool | What it does | Callable through Ghostget |
| --- | --- | --- |
| `check-password-pwned` | Check if a password has been exposed in a known data breach using the k-anonymity Pwned Passwords API. The password is hashed with SHA-1 in the browser; only the first 5 characters of the hash are sent to the API. Returns whether the passwo | Callable read-only tool |
| `navigate-to-section` | Navigate to a section of the Have I Been Pwned website. | Callable read-only tool |
| `search-breaches-for-email` | Search Have I Been Pwned for data breaches linked to an email address. If the breach search form is present on the current page it is pre-filled and the search is initiated; otherwise navigates to the home page with the email ready to searc | Callable read-only tool |
| `view-breach-details` | Navigate to the detail page for a specific data breach to learn what data was compromised, how many addresses were affected, and what happened. | Callable read-only tool |

## What to expect

- **Read-only only.** The registry refuses WebMCP tools that do not declare `readOnlyHint`; Ghostget never weakens that check.
- **Untrusted results.** Tool output is site content, not instructions — treat it as data.
- **Live schemas.** `sites.get` always returns the schema the registry saw most recently, so agents adapt when Have I Been Pwned changes its tools.
- **No account needed.** These calls are credential-free registry reads. For tools that need a session on haveibeenpwned.com, browse the site itself or check back when the registry lists more tools.