Mockpost MCP server

Read from the package source without running it. The installed server may list more.

• clear_allwrite action

  Delete all captured messages (or only those of a test_id/app).

• clear_channelwrite action

  Delete all captured messages of a channel (cleanup between test runs). With app, only that app's messages.

• create_push_subscriptionwrite action

  Create a Web Push subscription and return it shaped exactly like the browser's PushSubscription (endpoint + keys.p256dh + keys.auth). Hand it to the app under test: MockPost keeps the private key, so when the backend sends the encrypted push with pywebpush or web-push it verifies the VAPID signature, decrypts the payload and captures the cleartext.

• delete_appwrite action

  Delete a registered app. Its webhooks become global.

• expire_push_subscription

  Mark a Web Push subscription as gone: the next push answers 410, which is how a backend learns it must delete a dead subscription.

• generate_totp_secret

  Generate and store a TOTP secret (Google Authenticator). Returns base32 secret and otpauth:// URL.

• get_channel_config

  Return host/port/base URL/fake tokens the app must use for that channel.

• get_latest_otp

  Return the latest OTP code (SMS or email) sent to an identifier.

• get_message_detail

  Return a message's full payload, including raw_payload (MIME/JSON).

• get_oauth_session

  Inspect a simulated OAuth session: code, tokens, returned profile and expiry.

• get_timeline_markdown

  FULL TIMELINE as Markdown: messages + webhook_events + stripe_events in chronological order. Call this first when verifying a test result; use get_message_detail only for a single event's detail. With app, only that app's events.

• get_totp_code

  Compute the current TOTP code (6 digits) for a previously generated secret. Window ±1.

• list_apps

  List registered apps with their fake credentials (MockPost identity).

• list_push_subscriptions

  List Web Push subscriptions with their endpoint and status (active|gone).

• list_sent_messages

  List captured messages for a channel (or all), newest first. channel: mail|telegram|whatsapp|webpush|sms|fcm|apns|slack|discord|stripe app: registered app name to filter only its messages.

• list_webhook_deliveries

  Webhook delivery history: what each app returned (code + body), even if it was down (response_code 0). Filterable by channel and app.

• list_webhooks

  List registered webhooks, optionally filtered by channel and app.

• register_app

  Register or update an app: bind its FAKE credentials (Telegram bot token, Twilio SID, Stripe sk_test_, WhatsApp phone_id, FCM project_id) to a name. The app talks to MockPost using those credentials as if it were the real service; MockPost identifies it by them. Use the same name to update creds.

• register_webhook

  Register an app webhook (Telegram setWebhook, WhatsApp, Stripe...). If you pass an app (registered name), the webhook only receives events from that app.

• set_app

  Set the active app (a name registered in MockPost): incoming event simulations and queries are filtered/delivered only to that app. Pass null/None for no app. Register apps with register_app.

• set_oauth_fake_profile

  Set the profile the fake OAuth provider (google|github|facebook|x) returns on the next login.

• set_test_id

  Set the active test_id: all subsequent calls are filtered/persisted with it. Pass null/None to go back to the global queue.

• simulate_delivery_webhook

  Fire a delivery status webhook (delivered|read|failed) back to the app. Uses POST /whatsapp/simulate/status.

• simulate_facebook_event

  Fire a Facebook Graph API webhook event signed with X-Hub-Signature-256 to the app's registered Facebook webhook. app: registered app name to target; overrides set_app for this call.

• simulate_github_event

  Fire a GitHub webhook event (push, issues, pull_request) signed with X-Hub-Signature-256 to the app's registered GitHub webhook. app: registered app name to target; overrides set_app for this call.

• simulate_incoming_message

  Simulate an external user sending an inbound message to the app. channel: telegram (via /telegram/client/sendMessage) or whatsapp. app: registered app name to target; overrides set_app for this call.

• simulate_push_token_unregistered

  Make a native push token look uninstalled: FCM answers 404 UNREGISTERED and APNs answers 410 Unregistered on the next send. channel: fcm | apns

• simulate_stripe_event

  Build and send a simulated Stripe event, signed (Stripe-Signature), to the registered webhook. app: registered app name to target; overrides set_app for this call.

• simulate_x_event

  Fire an X (Twitter) Account Activity webhook event signed with X-Twitter-Webhooks-Signature to the app's registered X webhook. payload is a list of event objects, as the real API delivers. app: registered app name to target; overrides set_app for this call.

• trigger_webhook

  Fire a test event to a registered webhook and return the app's response.

• verify_facebook_webhook

  Verify a Facebook webhook subscription (hub.mode/hub.verify_token/ hub.challenge) as Meta does on registration. Returns the challenge URL.

• Code scan38 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 68 days ago12/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

88/100

higher than 80% of 4,460 AI and agents servers

Tools

31

the typical AI and agents server has 6

Tools that change things

13%

typical: 0%. Fewer write tools means less an agent can break

GitHub stars

2

more than 65% of 2,711 AI and agents servers

Downloads a week

19

more than 5% of 1,538 AI and agents servers with a package

Mockpost: common questions

Is Mockpost MCP server safe?

Yes, by our scan: it is graded A (88/100). Read the Mockpost safety report

How do I install Mockpost?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Mockpost need an API key?

No secret keys are declared. It reads 1 setting from the environment.

Is Mockpost maintained?

The last commit was 72 days ago (2026-08-24). The latest release is v0.3.0.

What can I use instead of Mockpost?

Servers from other publishers that do the same job: PaperBanana MCP server, three.ws Brain MCP server and Claude Prompts MCP server.

How does Mockpost compare with other AI and agents MCP servers?

safety score 88/100 (higher than 80% of 4,460 AI and agents servers); tools 31 (the typical AI and agents server has 6); tools that change things 13% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.