XposedOrNot MCP Server Live
Give your AI assistant live access to data breach intelligence. Query the XposedOrNot breach database directly from Claude, Cursor, or any MCP-compatible client. Free, open source, no API key required.
New to MCP? The Model Context Protocol is an open standard that lets AI assistants call external tools. Connect this server once, and your assistant can answer breach questions with live data instead of guesses.
Quick start
Claude Code
One command in your terminal:
Claude Desktop
Go to Settings, then Connectors, then Add custom connector and enter:
Cursor
Add the server to ~/.cursor/mcp.json (or via Settings, then MCP, then Add new server):
Any MCP client
- Server endpoint:
https://api.xposedornot.com/mcp - Transport: streamable HTTP (JSON-RPC 2.0 over HTTPS POST)
- Protocol version:
2024-11-05 - Authentication: none required
To confirm the connection, ask your assistant: "What XposedOrNot tools do you have available?" It should list the six tools below.
Available tools
The server exposes six tools covering emails, domains, the breach catalog, and live statistics.
check_email_breaches
Check whether an email address appears in any known data breach. Returns breach names, dates, and exposed data types.
"Has john@example.com appeared in any data breaches?"
get_breach_analytics
Detailed exposure analytics for an email: risk score, breach timeline, exposed data categories, and password risk.
"Give me a full breach risk analysis for john@example.com."
list_breaches
Browse or filter the full breach catalog by domain or breach ID, with records, data classes, and verification status.
"List the breaches XposedOrNot has indexed for example.com."
domain_breach_summary
Aggregate breach summary for a domain: breach count, affected accounts, pastes, and the most recent breach date. Returns counts only, never individual addresses.
"How exposed is example.com across known breaches?"
get_breach_metrics
System-wide statistics: total breaches and records indexed, breaches per year and industry, and the largest and most recent breaches.
"How many breaches were indexed per industry this year?"
get_recent_breaches
The latest data breach news and the breaches most recently added to the XposedOrNot database.
"What are the newest data breaches tracked by XposedOrNot?"
See it in action
Ask your assistant:
Your AI assistant calls check_email_breaches, receives live results from the XposedOrNot
database, and answers with the actual breaches, dates, and exposed data types, not guesses from
training data. An answer typically looks like this (illustrative):
Follow-up questions like "which of those exposed passwords?" reuse the same live data.
Rate limits and access
The MCP server is free for personal and development use and shares the community API's per-IP limits. When a limit is reached, the server returns a clear message rather than failing silently.
| Tools | Burst | Per hour | Per day |
|---|---|---|---|
check_email_breaches, get_breach_analytics |
2 per second | 25 | 100 |
list_breaches, get_recent_breaches |
2 per second | 50 | 100 |
domain_breach_summary |
2 per second | 25 | 50 |
get_breach_metrics |
5 per minute | 50 | 100 |
Need higher volume? xonAPI+ offers paid plans with rate limits up to 25,000 requests per minute, API-key access, and commercial support. Full details in the API documentation.
Privacy
domain_breach_summary returns only counts, never individual addresses. The server is open
source: verify how queries are handled in the
source code
or read the privacy policy.
Discovery for agents
Agents and registries can discover the server and its tools automatically through two published machine-readable descriptors:
- MCP server card: /.well-known/mcp/server-card.json
- Agent skills index: /.well-known/agent-skills/index.json
Frequently asked questions
Is it really free?
Yes. The MCP server uses the free, keyless XposedOrNot community API. If you need higher throughput for a product or a busy team, xonAPI+ offers paid plans with much higher limits, and that is what keeps the free tier free.
Do I need an API key?
No. Point your MCP client at https://api.xposedornot.com/mcp and it works. No account, no key, no registration.
Which clients work?
Any MCP client that supports streamable HTTP transport, including Claude Desktop, Claude Code, and
Cursor. The server speaks standard JSON-RPC over HTTPS with protocol version
2024-11-05 and requires no authentication.
Are the email addresses I query stored?
Only the queried email address or domain is sent over TLS, and it is used to answer the lookup. XposedOrNot does not store user passwords or personally identifiable information from searches. See the privacy policy for details.
How is this different from the REST API?
Same data, different consumer. The REST API is for code you write; the MCP server wraps the same breach database in tools an AI assistant can call directly, so your assistant answers breach questions with live data.
How current is the data?
The MCP server queries the live XposedOrNot database: 776 breaches and more than 11.5 billion exposed records as of August 2026, updated as new breaches are verified and indexed. See live repository statistics.
Go deeper
- Full API documentation
- GitHub repository (MIT licensed)
- Official SDKs for Python, JavaScript/TypeScript, Go, Ruby, PHP, Rust, .NET, and Java
- All integrations: MISP, TheHive/Cortex, OpenCTI, Maltego, Wazuh, Splunk, Microsoft Sentinel