OTInstaller
Sign in

hibp-breaches

v0.1.0Verified publisher
Report a problem

Lists the data breaches an email address appears in, from Have I Been Pwned: site, date, size, kinds of data

Run

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/hibp-breaches","target":"test@example.com","input_type":"email"}

Or just say: "Run osintverse-community/hibp-breaches on test@example.com with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/hibp-breaches e:test@example.com --format table
ot install osintverse-community/hibp-breaches

Docker image in a read-only container · talks to haveibeenpwned.com · needs HIBP_API_KEY · up to 1 min. The first ot run installs the tool after asking once. The example value is the registry's own test input, so this command has run. Drop --format table for JSON.

Don't have ot? Install it in one line
curl -fsSL https://get.otinstaller.com/ot | sh
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.
irm https://get.otinstaller.com/ot.ps1 | iex
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →
  • Pinnedimage sha256:ab2ff543…6ecc8c. The same bytes on every install; ot pulls by digest, never by tag.
  • Signedby https://github.com/osintverse-community/hibp-breaches/.github/workflows/otinstaller-release.yml@refs/heads/main via token.actions.githubusercontent.com, verified by the registry on 24 Oct 2026. ot checks the same identity before every install and refuses another signer.
  • Scanned24 Oct 2026: 0 critical, 44 high, 63 medium, 62 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 95 packages.
  • Workssmoke test passed on 24 Oct 2026 (exit 3 in 6.1 s, offline sandbox); the nightly health check has not run yet.
  • Backed upa copy of this image is on the registry's mirror. If the original registry refuses it, ot pulls the same digest from the mirror and checks the same signature.
  • Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

From the community

Issues →

Not health-checked yet; 0.1.0 came out today; nobody has said yet whether it works.

0.1.0 is in its first week. Nobody has said whether it works yet.

Used 0.1.0?It's broken for me

What you get back

Result envelope →
{
  "envelope": 1,
  "tool": "osintverse-community/hibp-breaches@0.1.0",
  "runtime": "docker",
  "input": {
    "email": "test@example.com"
  },
  "started_at": "2026-10-21T09:00:00Z",
  "duration_ms": 4100,
  "exit_code": 0,
  "entities": [
    {
      "type": "breach",
      "value": "ExampleBreach2021",
      "attrs": {
        "records": 12000
      }
    }
  ],
  "warnings": []
}

Every tool returns this shape, shaped here from what this tool declares it finds. --format table to read it; ot extract and ot auto to continue.

hibp-breaches

Lists the data breaches an email address appears in, from Have I Been Pwned. Each breach comes with its name, the site it came from, when it happened and when HIBP added it, how many accounts it held, the kinds of data it exposed (such as email addresses or passwords), whether HIBP verified it, and a short description. Uses the pyhibp client for HIBP's API. Only breach metadata comes back, never breached data such as passwords, and the address's owner is not contacted.

ot run osintverse-community/hibp-breaches --email test@example.com

Inputs

Input Required
email yes

Keys

HIBP_API_KEY, set with ot keys set HIBP_API_KEY. Searching by email address needs a paid HIBP subscription: https://haveibeenpwned.com/API/Key. Without the key the tool exits with code 3.

Notes

Unverified breaches are included, with medium confidence; HIBP leaves sensitive breaches out of these searches. An address in no breach gives no entities and a note on stderr. The results say something about a person, so ot and agents treat a run as collecting personal data and ask before running it.

Next steps

See which services the address is registered with using osintverse-community/holehe.

Development

pip install pyhibp==4.2.0
python -m unittest
ot validate

Releases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).

License

MIT

Other email tools

All email tools →

Alternatives to hibp-breaches that also take an email; ot auto runs every installed one on the same value.

osintverse-community/holehe

Checks whether an email address is registered on 120+ sites, without alerting its owner

Takes email → finds account
No key · Docker
Worked todayVerified publisher

osintverse-community/user-scanner

Checks whether a username or email is registered on 2,700+ sites and services

Takes email, username → finds account, url
No key · Python wheel
Worked todayVerified publisher
Esc

Try

↑ ↓ to move↵ to open