XposedOrNot MCP server

Endpoint: https://api.xposedornot.com/mcp · Authentication: No auth

Look up data breach exposure and related analytics for email addresses and domains.

Test it live Run the release-readiness report

How do I authenticate?

Add the endpoint directly in your client. The catalog records no authentication requirement; no OAuth sign-in or API key is configured in this setup. The live server may change.

Authentication and connection guide

Connection specification

Remote endpoint: https://api.xposedornot.com/mcp
Browser access: Not yet measured
Declared MCP transport: Streamable HTTP
Live-validated MCP transport: Streamable HTTP — Observed by the latest catalog validation
Declared authentication: No authentication
Detected authentication: No authentication detected or retained from publisher evidence
Protocol lifecycle: Stateful MCP · 2025-06-18
Category: Security

Product documentation · Source repository · Official listing documentation · Official MCP Registry record

More Security MCP servers · Browse all MCP servers · Test this endpoint in the MCP Playground

Authorization setup

No app registration needed

This catalog entry does not require authorization or provider app registration.

Connect it

Live-validated endpoint: https://api.xposedornot.com/mcp · Streamable HTTP. No authentication is required by the catalog listing.

Agent prompt for Claude Code or Codex

Add the XposedOrNot MCP server to my MCP client configuration and verify that it works.

What it is: Look up data breach exposure and related analytics for email addresses and domains.
Server URL: https://api.xposedornot.com/mcp
Transport: Streamable HTTP (remote MCP server, no local install).
Authentication: none. The server accepts connections without credentials.
Tools (6, as last observed by mcptest): check_email_breaches, domain_breach_summary, get_breach_analytics, get_breach_metrics, get_recent_breaches, list_breaches.
Reference: https://mcptest.io/servers/xposedornot/

Steps:
1. Work out which MCP client I use (Claude Code, Codex, Cursor, VS Code or another) and add the server under the name "xposedornot" in that client's MCP configuration, user scope unless I ask otherwise.
   Claude Code: claude mcp add --transport http --scope user 'xposedornot' 'https://api.xposedornot.com/mcp'
   Codex: codex mcp add 'xposedornot' --url 'https://api.xposedornot.com/mcp'
   Other clients: use the setup for that client on the reference page.
2. Never write a credential value into a file that could be committed; reference an environment variable or the client's secret store, and ask me for any value you need.
3. Verify: connect to the server and call tools/list. Confirm the tools above are listed, and report any sign-in step I still have to complete.

Claude Code setup

Run in a terminal. This user-scoped entry is available across projects.

claude mcp add --transport http --scope user 'xposedornot' 'https://api.xposedornot.com/mcp'

Codex CLI setup

Run in a terminal; Codex stores the entry in ~/.codex/config.toml.

codex mcp add 'xposedornot' --url 'https://api.xposedornot.com/mcp'

Cursor setup

Add to .cursor/mcp.json for this project, or ~/.cursor/mcp.json for all projects.

{
  "mcpServers": {
    "xposedornot": {
      "url": "https://api.xposedornot.com/mcp"
    }
  }
}

VS Code setup

Add to .vscode/mcp.json, or run “MCP: Open User Configuration” for a private user-level entry.

{
  "servers": {
    "xposedornot": {
      "type": "http",
      "url": "https://api.xposedornot.com/mcp"
    }
  }
}

Claude setup

Add the endpoint above in Claude:

Customize > Connectors > Add custom connector
Team/Enterprise: Organization settings > Connectors > Add > Custom > Web

Claude Desktop setup

Add the endpoint above in Claude Desktop:

Remote: Customize > Connectors (same as claude.ai)
Local: Settings > Developer > Edit Config, or Settings > Extensions for .mcpb files
~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), local servers only

ChatGPT setup

Add the endpoint above in ChatGPT:

ChatGPT web: Plugins > Add custom MCP server, then configure authentication and accept the risk warning

Windsurf setup

Add the endpoint above in Windsurf:

~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows), serverUrl or url
Cascade panel > ... > MCPs > Open MCP config file

Gemini CLI setup

Add the endpoint above in Gemini CLI:

gemini mcp add --transport http <name> <url>
~/.gemini/settings.json (user) or .gemini/settings.json (project), mcpServers

MCP SDK setup

Add the endpoint above in MCP SDK:

Programmatic: new Client(...).connect(new StreamableHTTPClientTransport(url))

Client compatibility

Client	Status	Why
Claude Code	Supported	Claude Code supports Streamable HTTP servers and servers without authentication.
Codex	Partial	Codex's documentation does not state support for servers without authentication.
Cursor	Supported	Cursor supports Streamable HTTP servers and servers without authentication.
VS Code	Supported	VS Code supports Streamable HTTP servers and servers without authentication.
Claude	Supported	Claude supports Streamable HTTP servers and servers without authentication.
Claude Desktop	Supported	Claude Desktop supports Streamable HTTP servers and servers without authentication.
ChatGPT	Partial	Stateful routing needs operational care: ChatGPT can preserve MCP sessions, but the deployment must route a session consistently and retain its state.
Windsurf	Partial	Windsurf's documentation does not state support for servers without authentication.
Gemini CLI	Supported	Gemini CLI supports Streamable HTTP servers and servers without authentication.
MCP SDK	Supported	MCP SDK supports Streamable HTTP servers and servers without authentication.

Computed from this server's validated transport, protocol and authentication against documented client support. Checks the catalog has not observed are not counted.

Similar servers

Semgrep — A fast, open-source, static analysis tool for finding bugs and enforcing code standards. OAuth 2.1
Cloudflare Audit Logs — Queries Cloudflare account audit logs and summarizes configuration changes for review. Requires Cloudflare OAuth. OAuth 2.1
WorkOS — Manages WorkOS environment resources such as organizations, users, SSO connections, and directories, limited to the signed-in dashboard role. Requires OAuth through WorkOS Connect. OAuth 2.1
Stytch — Manages Stytch project configuration such as redirect URLs, email templates, and other workspace settings. Requires Stytch sign-in through OAuth. OAuth 2.1
Vanta — Lists failing Vanta compliance tests and reads controls, frameworks, evidence, vendors, risks, and vulnerable assets. Requires Vanta sign-in through OAuth. OAuth 2.1
SonarQube Cloud — Reads SonarQube Cloud issues, quality gates, measures, coverage, security hotspots, and dependency risks. Requires a SonarQube Cloud user token as a bearer token and an organization key header. Bearer token

Guides for this server

Watch this server for breaking changes

Share and embed

Maintain XposedOrNot? Embed this badge in your README. It follows the latest catalog validation result and links to this server profile.

Markdown

[![Tested on mcptest.io](https://mcptest.io/badge/server/xposedornot.svg)](https://mcptest.io/servers/xposedornot/)

HTML

<a href="https://mcptest.io/servers/xposedornot/"><img src="https://mcptest.io/badge/server/xposedornot.svg" alt="Tested on mcptest.io"></a>

reStructuredText

.. image:: https://mcptest.io/badge/server/xposedornot.svg
   :alt: Tested on mcptest.io
   :target: https://mcptest.io/servers/xposedornot/

Latest validation evidence

Validation status: Online when last tested
Validation checked at: Oct 26, 2026 at 11:07 AM
Validation detail: Negotiated stateful MCP 2025-06-18 at https://api.xposedornot.com/mcp; detected transport streamable-http; authentication none

Tool inventory

What the catalog validator observed on Oct 26, 2026 at https://api.xposedornot.com/mcp without credentials. The live server may have changed since; connect in the Playground for the current list.

Tools provided by XposedOrNot 6

check_email_breachesNo outputSchema
Check whether an email address appears in the XposedOrNot index of known public data breaches. Returns the list of breach names only. Never returns passwords.
Input email: string
- email: stringrequired
  Email address to check for breaches
domain_breach_summaryNo outputSchema
Get an aggregate breach summary for a domain, including the number of breaches, affected email accounts, pastes, and the most recent breach date. Returns only counts, not individual email addresses.
Input domain: string
- domain: stringrequired
  Domain to summarize breaches for
get_breach_analyticsNo outputSchema
Get a detailed breach history for one email address: the breaches it appeared in with dates and descriptions, exposure broken down by industry and by year, risk scoring, and any paste exposure. Never returns passwords.
Input email: string
- email: stringrequired
  Email address to get analytics for
get_breach_metricsNo outputSchema
Get system-wide breach statistics: total breaches and records indexed, breaches per year and industry, the largest and most recent breaches, and when the latest breach was added.
Input No parameters
get_recent_breachesNo outputSchema
Get the breaches most recently added to XposedOrNot, newest first. Returns title, date, a short summary and a URL for each.
Input limit?: integer
- limit?: integeroptional
  Maximum breaches to return, default 10
list_breachesNo outputSchema
List breaches in the XposedOrNot catalog, optionally filtered by the breached company domain or by a specific breach ID. Returns breach name, date, industry, record count, categories of data exposed and a reference URL.
Input breach_id?: string, domain?: string, limit?: integer
- breach_id?: stringoptional
  Optional specific breach identifier, for example Adobe
- domain?: stringoptional
  Optional domain of the breached company, for example adobe.com
- limit?: integeroptional
  Maximum breaches to return, default 25