Github Webhook MCP server
io.github.Liplus-Project/github-webhook-mcp·v0.8.2MCP server bridging GitHub webhooks via Cloudflare Worker for real-time event streaming
0 stars66 downloads/wk
Reviews
Write oneNobody has reviewed Github Webhook yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Github Webhook tools (5)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
get_eventGet the full payload for a single webhook event by ID.
get_pending_statusGet a lightweight snapshot of pending GitHub webhook events. Use this for periodic polling before requesting details.
get_webhook_eventsGet pending (unprocessed) GitHub webhook events with full payloads. Prefer get_pending_status or list_pending_events for polling.
list_pending_eventsList lightweight summaries for pending GitHub webhook events. Returns metadata only, without full payloads.
mark_processedMark a webhook event as processed so it won't appear again.
Public scan report
scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it
- Code scan4 source files scanned13/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 52 days ago12/15
- Maintainer identityregistry namespace matches repository owner7/10
Findings (1)
- highShell command built from a string (injection risk)
exec.shell-concatserver/index.js: …=== "darwin" ? "open" : "xdg-open"; exec(`${openCmd} "${url}"`); } } async function startOAut…
How Github Webhook compares
Against every graded Developer tools MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 68/100
- higher than 27% of 1,119 Developer tools servers
- Tools
- 5
- the typical Developer tools server has 7
- Tools that change things
- 0%
- typical: 5%. Fewer write tools means less an agent can break
- Downloads a week
- 66
- more than 47% of 436 Developer tools servers with a package
What its tools let an agent do: 4 read · 1 change
Install Github Webhook in Claude Code, Cursor or VS Code
Runs npx -y github-webhook-mcp on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add github-webhook-mcp -- npx -y github-webhook-mcp
What the publisher says
From the Github Webhook repository's README, as published. We do not edit it. Read it on GitHub
github-webhook-mcp
Real-time GitHub webhook notifications for Claude via Cloudflare Worker + Durable Object.
Architecture
GitHub ──POST──▶ Cloudflare Worker ──▶ Durable Object (SQLite)
│
├── MCP tools (Streamable HTTP)
├── WebSocket real-time stream
│
┌────────────────┘
│
Desktop / Codex: .mcpb local bridge ──▶ polling via MCP tools
Claude Code CLI: .mcpb local bridge ──▶ WebSocket → channel notifications- Cloudflare Worker receives GitHub webhooks, verifies signatures, stores events in a Durable Object with SQLite.
- Local MCP bridge (.mcpb) proxies tool calls to the Worker and optionally connects via WebSocket for real-time channel notifications.
- No local webhook receiver or tunnel required.
Breaking change: MCP protocol revision 2026-07-28
From this release the Worker serves MCP protocol revision 2026-07-28 only. It keeps no compatibility lane for the previous revision.
- Bridge versions older than this release stop working. They open a session with initialize, which the Worker no longer answers. The failure is quiet: the bridge does not crash, it returns the protocol error as tool output text.
- Real-time channel notifications keep arriving, which hides the breakage. The /events stream is not MCP and is unaffected, so a stale bridge still pushes event summaries while every tool call — including mark_processed — fails. The pending queue stops being cleared even though notifications look healthy.
- Restart the MCP client to pick up the new bridge. The bridge is launched with npx, and @latest is resolved at process start — an already-running Claude Desktop, Claude Code, or Codex keeps the copy it started with, however new the published version is. Quit it fully and reopen.
- Pinning the bridge version leaves you stuck. If your MCP client config pins a version older than this release, restarting does not help; remove the pin (or move it forward) first.
The Worker and the bridge ship together, so a bridge from this release or later needs no configuration change.
Prerequisites
Getting Started
1. Install the GitHub App
Install the GitHub Webhook MCP app on your GitHub organization or account:
- Visit the GitHub App installation page
- Select the organization or account to install on
- Choose which repositories to grant access to (or all repositories)
- Approve the requested permissions
Note: When the app requests new permissions after an update, you must approve them in your GitHub notification or the app's installation settings. Webhooks will not be delivered until permissions are accepted.
Important: Do not create a separate repository webhook for the same endpoint. The GitHub App handles all webhook delivery — a repository webhook would cause duplicate or malformed requests.
2. Set up the MCP client
Continue to the Installation guide to connect your AI assistant to the webhook service.
Installation
See the Installation wiki page for the full setup guide, including:
- Quick Start with the preview instance
- MCP Client Setup for Claude Desktop, Claude Code CLI, and Codex
- Self-Hosting Guide for Cloudflare Workers deployment
Updating
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Github Webhook: common questions
- Is Github Webhook MCP server safe?
- With care: it is graded C, so read the findings first (68/100). Read the Github Webhook safety report
- How do I install Github Webhook?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Github Webhook need an API key?
- No secret keys are declared. It reads 2 settings from the environment.
- Is Github Webhook maintained?
- The last commit was 90 days ago (2026-08-06). The latest release is v0.8.2.
- What can I use instead of Github Webhook?
- Servers from other publishers that do the same job: Scrapling MCP Server, GitDiagram MCP server and GitHub MCP server.
- How does Github Webhook compare with other Developer tools MCP servers?
- safety score 68/100 (higher than 27% of 1,119 Developer tools servers); tools 5 (the typical Developer tools server has 7); tools that change things 0% (typical: 5%. Fewer write tools means less an agent can break). Full comparison.
Alternatives to Github Webhook
Same job from other publishers: the closest match first, then the best rated.
Scrapling MCP ServerWeb scraping with stealth HTTP, real browsers, and Cloudflare bypass. CSS selectors supported.not reviewedWidely usedA- GitDiagramArchitecture diagrams, explanations and Mermaid source for public GitHub repositories.not reviewedEstablishedA
- GitHubConnect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.not reviewedEstablishedA
Gk CLIThe GitKraken MCP Server for managing repos, PRs, issues across GitHub, GitLab, Bitbucket and more.not reviewedEstablishedB- Agent HarnessesAgent-harness picks, decision guides, setup templates, and skills; live GitHub/HN discovery.not reviewedEstablishedA