check_breach

MCP tool from MCP Threatintel by pete-builds

Check LeakCheck for breached credentials by email, domain, username, or hash

How to use it

Project documentation lists check_breach for the MCP Threatintel MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install MCP Threatintel

$claude mcp add threatintel --transport http --scope user --url http://localhost:3707/mcp
FULL MCP THREATINTEL LISTING

Other tools in MCP Threatintel (11)

check_domain_breaches

Check all known breaches for a domain

check_email_breaches

Check if an email is in any known breach via HIBP

check_password_breach

Check if a password has been exposed (HIBP k-anonymity, free, password never leaves machine)

get_feed_status

Show sync status and record counts for all feeds

get_latest_breach

Get the most recently added breach from HIBP

get_recent_threats

What's been added in the last N hours

lookup_cve

Check if a CVE is in the CISA Known Exploited Vulnerabilities catalog

lookup_ioc

Check an IP, domain, hash, or URL against all threat feeds

search_darkweb

Search Ahmia.fi's index of Tor hidden services

search_pulses

Search AlienVault OTX community threat pulses

search_threats

Full-text search across IOCs, OTX pulses, and CVEs