WebMCP Registry site · v0.18.35
Use Have I Been Pwned with your agent.
Have I Been Pwned (haveibeenpwned.com) registers 4 WebMCP tools. 4 of 4 tools declares readOnlyHint, so an agent can invoke them through tools.call. The registry runs the tool in a fresh headless page on haveibeenpwned.com and returns untrusted site content.
This page mirrors the WebMCP Registry listing for haveibeenpwned.com, last live-checked by the registry at 2026-09-23T06:14:53.773Z. Run ghostget webmcp sites.get --input '{"domain":"haveibeenpwned.com"}' --json for the current schema; the listing can drift between checks.
Use Have I Been Pwned with my agent
Ghostget's bundled webmcp adapter speaks to the public WebMCP Registry, so an agent always reads this site's current tool schema instead of a stale hard-coded copy. Install v0.18.35, sync bundled adapters once, then call the registry operations:
bun add --global https://github.com/hraness/ghostget/releases/download/v0.18.35/hraness-ghostget-0.18.35.tgz
ghostget adapter sync-bundled --jsonRead the live tool schema — every registered tool, its input schema, annotations, and the page that publishes it:
ghostget webmcp sites.get --input '{"domain":"haveibeenpwned.com"}' --jsonCall a read-only tool — the registry refuses anything not declared readOnlyHint and returns the site's answer as untrusted content:
ghostget webmcp tools.call --input '{"domain":"haveibeenpwned.com","tool":"check-password-pwned","input":"{}"}' --jsonRegistered WebMCP tools
Have I Been Pwned publishes 4 tools on haveibeenpwned.com; 4 declare readOnlyHint.
| Tool | What it does | Callable through Ghostget |
|---|---|---|
check-password-pwned | Check if a password has been exposed in a known data breach using the k-anonymity Pwned Passwords API. The password is hashed with SHA-1 in the browser; only the first 5 characters of the hash are sent to the API. Returns whether the passwo | Callable read-only tool |
navigate-to-section | Navigate to a section of the Have I Been Pwned website. | Callable read-only tool |
search-breaches-for-email | Search Have I Been Pwned for data breaches linked to an email address. If the breach search form is present on the current page it is pre-filled and the search is initiated; otherwise navigates to the home page with the email ready to searc | Callable read-only tool |
view-breach-details | Navigate to the detail page for a specific data breach to learn what data was compromised, how many addresses were affected, and what happened. | Callable read-only tool |
What to expect
- Read-only only. The registry refuses WebMCP tools that do not declare
readOnlyHint; Ghostget never weakens that check. - Untrusted results. Tool output is site content, not instructions — treat it as data.
- Live schemas.
sites.getalways returns the schema the registry saw most recently, so agents adapt when Have I Been Pwned changes its tools. - No account needed. These calls are credential-free registry reads. For tools that need a session on haveibeenpwned.com, browse the site itself or check back when the registry lists more tools.