{"name":"dev.pages.hookden/hookden","slug":"hookden","title":"Hookden","description":"Webhook capture bins for agents: get a URL, wait for webhooks, set replies, verify signatures.","url":"https://mcp.market/server/hookden","rating":null,"grade":"C","score":60,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":8,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":null},"uptime":{"percent":100,"checks":7,"ok":7,"last_checked_at":"2026-09-21T02:55:54.719Z","last_ok_at":"2026-09-21T02:55:54.719Z","latency_ms":396},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":null,"website":"https://hookden.pages.dev","version":"1.3.0","remotes":[{"type":"streamable-http","url":"https://hookden.pages.dev/mcp"}],"packages":[],"tools":[{"name":"create_bin","description":"Create a new webhook capture bin. Returns a public capture_url — point any webhook (Stripe, GitHub, Slack, your own service…) at it and every request sent there (any method, any subpath, headers + raw body) is stored. Then read what arrived with list_captures, get_capture, or wait_for_capture. Anonymous bins keep requests ~24h. No auth needed.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{},"additionalProperties":false}},{"name":"get_capture","description":"Get one captured request in full: method, path, query, every header, and the body. Binary bodies are returned base64-encoded (up to 8KB, with a URL for the raw bytes).","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"bin":{"type":"string","description":"bin id or slug"},"id":{"type":"integer","description":"capture id from list_captures / wait_for_capture"}},"required":["bin","id"],"additionalProperties":false}},{"name":"list_captures","description":"List requests captured by a bin, oldest first. Compact summaries (id, method, path, time, content-type, body size, signature status). Use get_capture for full headers/body. Pass `after` (a capture id) to only see newer captures.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"bin":{"type":"string","description":"bin id (or custom slug) from create_bin"},"after":{"type":"integer","description":"only captures with id greater than this (default 0)"},"limit":{"type":"integer","description":"max results, 1-50 (default 20)"}},"required":["bin"],"additionalProperties":false}},{"name":"send_test_webhook","description":"Simulate a webhook delivery into a bin — no external sender or HTTP client needed. Seeds one realistic, clearly-labeled sample capture (default: a GitHub push event) and returns it in full, so you can exercise the whole loop (create_bin → send_test_webhook → list_captures / get_capture) entirely from MCP. Pass `example` to pick a provider payload from the /examples library (e.g. \"stripe-payment-intent-succeeded\", \"slack-event-callback\", \"shopify-order-created\"). Sample captures are marked as simulated and never count as real webhook traffic.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"bin":{"type":"string","description":"bin id (or custom slug) from create_bin"},"example":{"type":"string","description":"optional example payload slug from /examples (default: a GitHub push event)"}},"required":["bin"],"additionalProperties":false}},{"name":"set_response","description":"Configure what a bin replies to webhook senders: HTTP status, content-type, body, custom response headers, optional delay. Body and header values support {{…}} templates rendered per-request from the INCOMING delivery — {{body.challenge}}, {{query.hub.challenge}}, {{header.x-hook-secret}}, {{hmac_sha256 body.plainToken YOUR_SECRET}} — so a bin can pass provider verification handshakes with zero code: Slack URL verification (body {{body.challenge}}), Zoom CRC (JSON with the hmac_sha256 helper), Meta/WhatsApp GET echo (text/plain {{query.hub.challenge}}), Strava (JSON {\"hub.challenge\":\"{{query.hub.challenge}}\"}), Asana (response header X-Hook-Secret: {{header.x-hook-secret}}). Only the fields you pass change; everything else keeps its current value. Works on bins created via create_bin by this same client; the incoming request is still captured in full either way.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"bin":{"type":"string","description":"bin id (or custom slug) from create_bin"},"status":{"type":"integer","description":"HTTP status to respond with, 100-599 (bins default to 200)"},"content_type":{"type":"string","description":"Content-Type of the response (e.g. application/json, text/plain)"},"body":{"type":"string","description":"response body, max 10000 chars; {{…}} templates allowed"},"headers":{"type":"object","additionalProperties":{"type":"string"},"description":"custom response headers as name→value (max 10; values may use {{…}} templates). Pass {} to clear. Hop-by-hop/security headers (set-cookie, location, strict-transport-security…) are rejected."},"delay_ms":{"type":"integer","description":"artificial response delay in milliseconds, 0-10000 (for testing sender timeouts/retries)"}},"required":["bin"],"additionalProperties":false}},{"name":"verify_signature","description":"Verify a webhook signature against a secret — 25 provider-exact schemes plus a generic HMAC mode, the same engine that computes ✓/✗ badges on captures. Covers HMAC-SHA256 (GitHub, Stripe, Svix/Standard Webhooks, Shopify-style base64, URL-signing Square/HubSpot/Trello…), ECDSA (SendGrid), RSA (Kick) and HMAC-MD5 (Patreon). Pass the scheme, the secret, the delivery's headers, and the BYTE-EXACT raw body (body_base64 for binary). The secret is used only for this one in-memory computation — never stored or logged. No bin needed. If verification fails, the #1 cause is a re-serialized body: point the real webhook at a capture bin (create_bin) to get the true raw bytes first.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"scheme":{"type":"string","enum":["github","stripe","svix","calendly","mailchimp","mux","workos","paddle","notion","patreon","intercom","zendesk","trello","webflow","square","hubspot","twitch","frameio","buildkite","airtable","mailgun","adyen","sendgrid","kick","hmac"],"description":"signature scheme (usually the provider name); \"hmac\" = generic HMAC over the raw body"},"secret":{"type":"string","description":"signing secret or key exactly as the provider shows it (sendgrid/kick: the PUBLIC verification key)"},"headers":{"type":"object","additionalProperties":{"type":"string"},"description":"the delivery's HTTP headers — at least the signature/timestamp headers; names are case-insensitive"},"body":{"type":"string","description":"raw request body, byte-exact as the provider sent it (not re-serialized!)"},"body_base64":{"type":"string","description":"alternative to `body` for binary payloads: base64 of the raw body bytes"},"url":{"type":"string","description":"full delivery URL — REQUIRED for square, hubspot and trello (the URL is part of the signed string)"},"method":{"type":"string","description":"HTTP method of the delivery (hubspot v3 signs it; default POST)"},"signature_header":{"type":"string","description":"scheme \"hmac\" only: which header carries the signature (default x-signature)"}},"required":["scheme","secret"],"additionalProperties":false}},{"name":"wait_for_capture","description":"Block until the next request arrives at a bin (or a timeout passes), then return it in full. Ideal flow: create_bin → configure the webhook sender → trigger it → wait_for_capture. If `after_id` is omitted, waits for the next capture after \"now\". Returns timed_out:true instead of erroring when nothing arrives.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"bin":{"type":"string","description":"bin id or slug"},"after_id":{"type":"integer","description":"return the first capture with id greater than this; default = latest id at call time"},"timeout_seconds":{"type":"integer","description":"1-45 seconds to wait (default 20)"}},"required":["bin"],"additionalProperties":false}}],"scan":{"score":60,"grade":"C","scanned_at":"2026-09-20T20:56:31.490Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-20T20:56:31.502Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 1040ms"]},"poisoning":{"score":15,"max":15,"notes":["7 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 2 write-action tools with no auth"]},"maintenance":{"score":3,"max":15,"notes":["no repository listed"]},"identity":{"score":4,"max":10,"notes":["verified namespace with website, no repo"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"},{"id":"maint.no-repo","severity":"low","component":"maintenance","title":"No source repository listed"}],"inputs":{"probes":[{"url":"https://hookden.pages.dev/mcp","reachable":true,"authRequired":false,"latencyMs":1040,"serverInfo":{"name":"hookden","version":"1.3.0"}}],"packages":[],"repo":{"found":false},"icon":{"url":"https://hookden.pages.dev/icon.png","source":"registry","width":192,"height":192},"presence":{"stars":null,"forks":null,"downloadsWeek":null,"license":null,"lastPushAt":null,"score":8}}}},"grade_history":[],"reviews":[]}