# XposedOrNot Breach Intelligence [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/XposedOrNot/XposedOrNot-API  
**GitHub Stars:** 101  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/xposedornot-breach-intelligence

## Description
Real-time data-breach lookup and analytics for emails and domains from XposedOrNot.

## Claude Desktop Quick Installation
No confirmed install details yet, so no config is published. Follow the setup steps in the repository above.

## Documentation

## What XposedOrNot Breach Intelligence does

XposedOrNot Breach Intelligence gives MCP-compatible AI clients access to breach intelligence from XposedOrNot. Its tools can check whether an email appears in known breaches, retrieve detailed exposure history, browse the breach catalog, summarize domain exposure, inspect overall breach metrics, and identify recently added breaches.

The service is designed for read-only investigation. The exposed tools do not return passwords, and the MCP connection does not require an API key or other authentication.

## How it works

Connect an MCP client to `https://api.xposedornot.com/mcp`. The endpoint uses Streamable HTTP and accepts JSON-RPC 2.0 requests over HTTP POST. Clients can discover the available functions with the MCP `tools/list` method, then invoke individual tools as needed.

The MCP layer provides access to selected XposedOrNot API data, including email lookups, breach analytics, breach listings, domain summaries, aggregate metrics, and recent breach activity. It is intended for interactive agent workflows rather than making changes to breach records or account settings.

## Setup and configuration

A compatible client can register the remote endpoint directly. For Claude Code, the connection command is:

```bash
claude mcp add --transport http xposedornot https://api.xposedornot.com/mcp
```

The MCP service itself needs no API key. The underlying XposedOrNot API uses API keys for certain domain-monitoring operations, but the built-in MCP connection is described as unauthenticated. A machine-readable server card is available at `https://api.xposedornot.com/.well-known/mcp/server-card.json`.

To inspect the advertised tools manually, send a JSON-RPC request with `Content-Type: application/json` to the MCP endpoint and call `tools/list`.

## Tools and capabilities

- `check_email_breaches` checks whether an email address appears in known breaches.
- `get_breach_analytics` returns detailed breach history, a risk score, and paste-exposure information for an email.
- `list_breaches` browses the breach catalog and supports filtering by domain or breach ID.
- `domain_breach_summary` provides aggregated breach counts for a domain.
- `get_breach_metrics` returns system-wide breach statistics.
- `get_recent_breaches` lists recently added breaches with the newest entries first.

These capabilities fit workflows such as triaging an email address, reviewing an organization’s known exposure, answering questions about breach activity, or adding breach context to a security investigation.

## Limitations and notes

The service is read-only through MCP and does not provide password data. The underlying free API applies per-IP, per-endpoint rate limits. The documented limits include 25 requests per hour and 100 per day for email checks and analytics, and 50 per hour and 100 per day for the breach catalog. Requests that exceed a limit receive HTTP 429 responses with retry information.

Domain breach monitoring in the underlying API requires verified domain ownership and an API key obtained through the XposedOrNot web console. Commercial or higher-volume API access is offered separately through xonAPI+; those terms do not change the unauthenticated MCP connection described above.

_Full upstream README: https://allmcps.com/mcp/xposedornot-breach-intelligence/readme_