MCP.Market

Hooksense MCP server

by ozers·io.github.ozers/hooksense·v0.2.1·2 stars
No reviews yet

Webhook & callback layer for AI agents: create a URL, wait_for_callback, and verify over MCP.

B78/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B78/100

full report

Adoption
Growing

2 stars29 downloads/wk

Reviews

Write one

Nobody has reviewed Hooksense yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Hooksense tools (8, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • create_callback_endpointwrite action

    Create a callback endpoint and return its URL. Hand this URL to a long-running/async job (or another agent) as its webhook/callback target, then await the result with wait_for_callback. Also works as a plain webhook capture URL for any provider (Stripe, GitHub, …).

  • get_callback_payload

    Fetch a single received callback with full headers, decrypted body, and metadata. Use this to read the result of an async job after wait_for_callback or list_callbacks gives you a callback id.

  • get_endpoint

    Get details about a specific endpoint — its full URL, signature provider config, and custom response settings.

  • list_callbacks

    List callbacks received by an endpoint, newest first. Returns a summary (method, status, provider, received_at). Use `get_callback_payload` for the full body. Tip: read the newest `received_at` and pass it as `after` to wait_for_callback to wait only for what comes next.

  • list_endpoints

    List all webhook endpoints owned by the authenticated user. Returns slug, created_at, and request counts.

  • replay_callback

    Replay a received callback to a target URL. The original headers and body are re-sent unchanged — useful to re-drive your handler against a known payload without re-triggering the upstream event.

  • verify_signature

    Verify the HMAC signature of a received callback against the endpoint's configured secret (Stripe, GitHub, Shopify, or custom), using a timing-safe comparison. Returns whether the callback is authentic and untampered — call this before your agent acts on a payload. Requires the endpoint to have a webhook secret configured and a paid plan.

  • wait_for_callback

    Block until the next webhook (callback) arrives at an endpoint, then return it — instead of polling. Use this for async/long-running work: kick off the job with the endpoint URL as its callback, then call wait_for_callback to receive the result the moment it lands (signature-verified, decrypted). Returns { status: 'received', request } on delivery, or { status: 'pending' } if `timeoutMs` elapses f

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings
  • Code scan2 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 82 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 78/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Hooksense compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
78/100
higher than 57% of 48,255 servers
Tools
8
the typical server has 7
Tools that change things
13%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
2
more than 75% of 28,688 servers
Downloads a week
29
more than 16% of 12,191 servers with a package

What its tools let an agent do: 7 read · 1 create

Install Hooksense in Claude Code, Cursor or VS Code

Runs npx -y @hooksense/mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add hooksense -- npx -y @hooksense/mcp
Add to Cursor

What the publisher says

From the Hooksense repository's README, as published. We do not edit it. Read it on GitHub

@hooksense/mcp

Model Context Protocol server for HookSense — the webhook & callback layer for AI agents. Lets Claude Desktop, Cursor, Claude Code, Continue, and any MCP client create a callback URL, wait for the result instead of polling, and verify its signature — all from the agent session.

Why

Agents that kick off async work — a deploy, a render, a human-in-the-loop approval, a long tool call, another agent — need the result back without burning context on polling loops. With this server the agent creates a callback endpoint, hands the URL to the job, then calls waitforcallback and is woken the instant the webhook lands — signature-verified and decrypted. Stop polling for async results; await them.

Setup

  1. Get an API token at
  2. Configure your MCP client (examples below)

Claude Desktop / Claude Code

Add to ~/Library/Application Support/Claude/claudedesktopconfig.json (macOS) or %APPDATA%\Claude\claudedesktopconfig.json (Windows):

{
  "mcpServers": {
    "hooksense": {
      "command": "npx",
      "args": ["-y", "@hooksense/mcp"],
      "env": {
        "HOOKSENSE_TOKEN": "hsk_your_token_here"
      }
    }
  }
}

Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "hooksense": {
      "command": "npx",
      "args": ["-y", "@hooksense/mcp"],
      "env": {
        "HOOKSENSE_TOKEN": "hsk_your_token_here"
      }
    }
  }
}

Hello callback (60 seconds)

Once configured, ask your agent:

  1. Create — "Create a callback endpoint." → the agent calls createcallbackendpoint and gets back a callbackUrl like https://hooksense.com/w/ab12cd.
  2. Fire — point any job at that URL (or just curl -X POST -d '{"status":"done"}' from another terminal).
  3. Await — "Wait for the callback." → the agent calls waitforcallback and blocks until the webhook lands, then receives { status: "received", request: { body, headers, … } }.
  4. Verify (optional) — set a webhook secret on the endpoint, then "Verify the signature." → verify_signature confirms the payload is authentic before the agent acts on it.

No polling, no dashboards, no copy-paste.

Tools

Environment

Example agent prompts

"Create a callback endpoint, use it as the webhook for my Replicate prediction, and wait for the result — then summarize the output."

"Open a callback URL, give it to the approval step, and block until a human approves before continuing."

"Wait for the next Stripe callback on payments-prod, verify its signature, and tell me the amount."

License

MIT

Nothing above is checked by us. What we check is on the safety report.

Hooksense: common questions

Is Hooksense MCP server safe?
Mostly: it is graded B (78/100). Read the Hooksense safety report
How do I install Hooksense?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Hooksense need an API key?
Yes. The registry entry asks for HOOKSENSE_TOKEN.
Is Hooksense maintained?
The last commit was 121 days ago (2026-07-06). The latest release is v0.2.1.
What can I use instead of Hooksense?
Servers from other publishers that do the same job: Reticle MCP server.
How does Hooksense compare with other MCP servers?
safety score 78/100 (higher than 57% of 48,255 servers); tools 8 (the typical server has 7); tools that change things 13% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Hooksense

Same job from other publishers: the closest match first, then the best rated.

  • Reticle
    Verify a running web app from the inside over MCP: look, act, observe, assert. No screenshots.
    B