{"name":"co.kymac.inbox/webhook-inbox","slug":"inbox-webhook-inbox","title":"webhook-inbox","description":"Ephemeral HTTPS inbox for bots: mint URL, capture POSTs, list JSON. TEST. https://inbox.kymac.co","url":"https://mcp.market/server/inbox-webhook-inbox","rating":null,"grade":"C","score":63,"certified":false,"status":"active","category":"email","tags":["email"],"presence":{"score":0,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":null},"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":null,"website":"https://inbox.kymac.co/llms.txt","version":"0.4.1","remotes":[{"type":"streamable-http","url":"https://inbox.kymac.co/mcp","headers":[{"description":"Bearer whi_… from POST /keys. Env WEBHOOK_INBOX_API_KEY.","isSecret":true,"name":"Authorization"},{"description":"Alternate to Authorization. Mint via POST /keys.","isSecret":true,"name":"X-API-Key"}]}],"packages":[],"tools":[{"name":"capture_inbox","description":"Public capture (POST /c/{id}). No API key. No debit. Not an install entry. Stores raw body + headers for list_inbox_events. Rejects revoked (410 inbox_revoked) or expired (410 inbox_expired) inboxes. Body limit 1MB.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"type":"string","description":"Inbox id from mint_inbox (inb_…)."},"body":{"description":"Raw capture payload. Objects are JSON-encoded. Strings are sent as-is."},"content_type":{"type":"string","description":"Content-Type for the capture. Defaults to application/json for objects."}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"checkout_credits","description":"Stripe TEST PaymentIntent for a pack (POST /credits/checkout). Intent only — returns credits_pending; credits are not granted or spendable until confirm_credits succeeds. Requires a caller key.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"pack_id":{"type":"string","description":"Pack id from list_credit_packs (e.g. pack_10)."}},"required":["pack_id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"confirm_credits","description":"Confirm a TEST PaymentIntent with Stripe test card pm_card_visa (POST /credits/confirm). This is when credits become granted/spendable (appends credit.purchase with credits_added). TEST only.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"stripe_payment_intent_id":{"type":"string","description":"PaymentIntent id (pi_…) from checkout_credits."}},"required":["stripe_payment_intent_id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"credit_balance","description":"Derived prepaid balance for this caller_id (GET /credits/balance).","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"credit_events","description":"Append-only Ledger events for this caller_id (GET /credits/events): credit.grant (first_key), credit.purchase, credit.debit reason=inbox_mint, optional credit.balance_snapshot.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"health","description":"Public readiness (GET /health): billing (test|live|gated) and runner_ready. No key.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"issue_key","description":"Mint a caller key (POST /keys). Bot install starts at GET https://inbox.kymac.co/llms.txt (sole advertised entry). Secret whi_… is returned once. Prefer Authorization: Bearer; X-API-Key is an alias. First issue grants 1 free credit (credit.grant reason=first_key). Quote cost with quote_credits before mint_inbox.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"list_credit_packs","description":"Prepaid TEST packs (GET /credits/packs). checkout_credits is intent only; credits grant after confirm_credits.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"list_inbox_events","description":"Owner list (GET /inbox/{id}/events). Returns captured POSTs as JSON (headers + body). Does not debit. Other callers see 404.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"type":"string","description":"Inbox id from mint_inbox (inb_…)."}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"mint_inbox","description":"Mint a capture URL (POST /inbox). Install via GET https://inbox.kymac.co/llms.txt only. Prefer Authorization: Bearer; X-API-Key is an alias. First key includes 1 free credit. Quote first with quote_credits (no debit). Debits 1 credit on success (credit.debit reason=inbox_mint, request_id=inbox id). 201 body includes id, capture_url, expires_at, credits_remaining. HTTP fails use code/message/retryable/next (error aliases message). 401 next=refresh key. 402: code=insufficient_credits, retryable=false, next=buy credits.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"quote_credits","description":"Dry-run cost for an op without debit (GET /credits/quote?op=inbox). Returns cost, balance, and would_succeed.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"op":{"description":"Operation to quote. Defaults to inbox.","type":"string"}},"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"revoke_inbox","description":"Stop further captures (DELETE /inbox/{id}). Does not refund the mint debit. Owner only.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"id":{"type":"string","description":"Inbox id from mint_inbox (inb_…)."}},"required":["id"],"$schema":"https://json-schema.org/draft/2020-12/schema"}},{"name":"revoke_key","description":"Invalidate the presented secret (POST /keys/revoke). Same id is revoked; old secret then fails 401 invalid_api_key. Prefer Authorization: Bearer; X-API-Key is an alias only. No ops file-edit.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"rotate_key","description":"Replace the presented secret (POST /keys/rotate). Same id/caller_id and credits. New whi_… is returned once. Old secret then fails 401 invalid_api_key. Prefer Authorization: Bearer; X-API-Key is an alias only. No ops file-edit.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{}}},{"name":"verify_key","description":"Confirm WEBHOOK_INBOX_API_KEY or Authorization: Bearer (GET /keys/verify). X-API-Key is an alias only. Does not echo the secret.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{}}}],"scan":{"score":63,"grade":"C","scanned_at":"2026-09-18T04:51:10.848Z","report":{"scannerVersion":"0.1.2","scannedAt":"2026-09-18T04:51:10.780Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":17,"max":20,"notes":["remote reachable in 2006ms"]},"poisoning":{"score":15,"max":15,"notes":["15 tool descriptions checked"]},"auth":{"score":8,"max":15,"notes":["API key sent as a header"]},"maintenance":{"score":3,"max":15,"notes":["no repository listed"]},"identity":{"score":4,"max":10,"notes":["verified namespace with website, no repo"]}},"findings":[{"id":"maint.no-repo","severity":"low","component":"maintenance","title":"No source repository listed"}],"inputs":{"probes":[{"url":"https://inbox.kymac.co/mcp","reachable":true,"authRequired":false,"latencyMs":2006,"serverInfo":{"name":"co.kymac.inbox/webhook-inbox","version":"0.4.1"}}],"packages":[],"repo":{"found":false}}}},"grade_history":[],"reviews":[]}