XposedOrNot Breach Intelligence

What XposedOrNot Breach Intelligence does

XposedOrNot Breach Intelligence gives MCP-compatible AI clients access to breach intelligence from XposedOrNot. Its tools can check whether an email appears in known breaches, retrieve detailed exposure history, browse the breach catalog, summarize domain exposure, inspect overall breach metrics, and identify recently added breaches.

The service is designed for read-only investigation. The exposed tools do not return passwords, and the MCP connection does not require an API key or other authentication.

How it works

Connect an MCP client to https://api.xposedornot.com/mcp. The endpoint uses Streamable HTTP and accepts JSON-RPC 2.0 requests over HTTP POST. Clients can discover the available functions with the MCP tools/list method, then invoke individual tools as needed.

The MCP layer provides access to selected XposedOrNot API data, including email lookups, breach analytics, breach listings, domain summaries, aggregate metrics, and recent breach activity. It is intended for interactive agent workflows rather than making changes to breach records or account settings.

Setup and configuration

A compatible client can register the remote endpoint directly. For Claude Code, the connection command is:

claude mcp add --transport http xposedornot https://api.xposedornot.com/mcp

The MCP service itself needs no API key. The underlying XposedOrNot API uses API keys for certain domain-monitoring operations, but the built-in MCP connection is described as unauthenticated. A machine-readable server card is available at https://api.xposedornot.com/.well-known/mcp/server-card.json.

To inspect the advertised tools manually, send a JSON-RPC request with Content-Type: application/json to the MCP endpoint and call tools/list.

Tools and capabilities

• check_email_breaches checks whether an email address appears in known breaches.
• get_breach_analytics returns detailed breach history, a risk score, and paste-exposure information for an email.
• list_breaches browses the breach catalog and supports filtering by domain or breach ID.
• domain_breach_summary provides aggregated breach counts for a domain.
• get_breach_metrics returns system-wide breach statistics.
• get_recent_breaches lists recently added breaches with the newest entries first.

These capabilities fit workflows such as triaging an email address, reviewing an organization’s known exposure, answering questions about breach activity, or adding breach context to a security investigation.

Limitations and notes

The service is read-only through MCP and does not provide password data. The underlying free API applies per-IP, per-endpoint rate limits. The documented limits include 25 requests per hour and 100 per day for email checks and analytics, and 50 per hour and 100 per day for the breach catalog. Requests that exceed a limit receive HTTP 429 responses with retry information.

Domain breach monitoring in the underlying API requires verified domain ownership and an API key obtained through the XposedOrNot web console. Commercial or higher-volume API access is offered separately through xonAPI+; those terms do not change the unauthenticated MCP connection described above.