MCP.Market

Github Webhook MCP server

by Liplus-Project·io.github.Liplus-Project/github-webhook-mcp·v0.8.2

MCP server bridging GitHub webhooks via Cloudflare Worker for real-time event streaming

C68/100grade C
What users say
No reviews yet
Be the first
Safety scan
C68/100

full report

Adoption
New

0 stars66 downloads/wk

Reviews

Write one

Nobody has reviewed Github Webhook yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Github Webhook tools (5)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • get_event

    Get the full payload for a single webhook event by ID.

  • get_pending_status

    Get a lightweight snapshot of pending GitHub webhook events. Use this for periodic polling before requesting details.

  • get_webhook_events

    Get pending (unprocessed) GitHub webhook events with full payloads. Prefer get_pending_status or list_pending_events for polling.

  • list_pending_events

    List lightweight summaries for pending GitHub webhook events. Returns metadata only, without full payloads.

  • mark_processed

    Mark a webhook event as processed so it won't appear again.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

1 high
  • Code scan4 source files scanned13/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 52 days ago12/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (1)

  • highShell command built from a string (injection risk)exec.shell-concat
    server/index.js: …=== "darwin" ? "open" : "xdg-open"; exec(`${openCmd} "${url}"`); } } async function startOAut…
Overall 68/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Github Webhook compares

Against every graded Developer tools MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
68/100
higher than 27% of 1,119 Developer tools servers
Tools
5
the typical Developer tools server has 7
Tools that change things
0%
typical: 5%. Fewer write tools means less an agent can break
Downloads a week
66
more than 47% of 436 Developer tools servers with a package

What its tools let an agent do: 4 read · 1 change

Install Github Webhook in Claude Code, Cursor or VS Code

Runs npx -y github-webhook-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add github-webhook-mcp -- npx -y github-webhook-mcp
Add to Cursor

What the publisher says

From the Github Webhook repository's README, as published. We do not edit it. Read it on GitHub

github-webhook-mcp

Real-time GitHub webhook notifications for Claude via Cloudflare Worker + Durable Object.

Architecture

GitHub ──POST──▶ Cloudflare Worker ──▶ Durable Object (SQLite)
                                           │
                                           ├── MCP tools (Streamable HTTP)
                                           ├── WebSocket real-time stream
                                           │
                          ┌────────────────┘
                          │
     Desktop / Codex: .mcpb local bridge ──▶ polling via MCP tools
     Claude Code CLI: .mcpb local bridge ──▶ WebSocket → channel notifications
  • Cloudflare Worker receives GitHub webhooks, verifies signatures, stores events in a Durable Object with SQLite.
  • Local MCP bridge (.mcpb) proxies tool calls to the Worker and optionally connects via WebSocket for real-time channel notifications.
  • No local webhook receiver or tunnel required.

Breaking change: MCP protocol revision 2026-07-28

From this release the Worker serves MCP protocol revision 2026-07-28 only. It keeps no compatibility lane for the previous revision.

  • Bridge versions older than this release stop working. They open a session with initialize, which the Worker no longer answers. The failure is quiet: the bridge does not crash, it returns the protocol error as tool output text.
  • Real-time channel notifications keep arriving, which hides the breakage. The /events stream is not MCP and is unaffected, so a stale bridge still pushes event summaries while every tool call — including mark_processed — fails. The pending queue stops being cleared even though notifications look healthy.
  • Restart the MCP client to pick up the new bridge. The bridge is launched with npx, and @latest is resolved at process start — an already-running Claude Desktop, Claude Code, or Codex keeps the copy it started with, however new the published version is. Quit it fully and reopen.
  • Pinning the bridge version leaves you stuck. If your MCP client config pins a version older than this release, restarting does not help; remove the pin (or move it forward) first.

The Worker and the bridge ship together, so a bridge from this release or later needs no configuration change.

Prerequisites

Getting Started

1. Install the GitHub App

Install the GitHub Webhook MCP app on your GitHub organization or account:

  1. Visit the GitHub App installation page
  2. Select the organization or account to install on
  3. Choose which repositories to grant access to (or all repositories)
  4. Approve the requested permissions

Note: When the app requests new permissions after an update, you must approve them in your GitHub notification or the app's installation settings. Webhooks will not be delivered until permissions are accepted.

Important: Do not create a separate repository webhook for the same endpoint. The GitHub App handles all webhook delivery — a repository webhook would cause duplicate or malformed requests.

2. Set up the MCP client

Continue to the Installation guide to connect your AI assistant to the webhook service.

Installation

See the Installation wiki page for the full setup guide, including:

  • Quick Start with the preview instance
  • MCP Client Setup for Claude Desktop, Claude Code CLI, and Codex
  • Self-Hosting Guide for Cloudflare Workers deployment

Updating

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Github Webhook: common questions

Is Github Webhook MCP server safe?
With care: it is graded C, so read the findings first (68/100). Read the Github Webhook safety report
How do I install Github Webhook?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Github Webhook need an API key?
No secret keys are declared. It reads 2 settings from the environment.
Is Github Webhook maintained?
The last commit was 90 days ago (2026-08-06). The latest release is v0.8.2.
What can I use instead of Github Webhook?
Servers from other publishers that do the same job: Scrapling MCP Server, GitDiagram MCP server and GitHub MCP server.
How does Github Webhook compare with other Developer tools MCP servers?
safety score 68/100 (higher than 27% of 1,119 Developer tools servers); tools 5 (the typical Developer tools server has 7); tools that change things 0% (typical: 5%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Github Webhook

Same job from other publishers: the closest match first, then the best rated.

  • Scrapling MCP Server
    Web scraping with stealth HTTP, real browsers, and Cloudflare bypass. CSS selectors supported.
    A
  • GitDiagram
    Architecture diagrams, explanations and Mermaid source for public GitHub repositories.
    A
  • GitHub
    Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
    A
  • Gk CLI
    The GitKraken MCP Server for managing repos, PRs, issues across GitHub, GitLab, Bitbucket and more.
    B
  • Agent Harnesses
    Agent-harness picks, decision guides, setup templates, and skills; live GitHub/HN discovery.
    A