Webhook MCP server
Send, validate, debug webhooks for AI agents
0 stars39 downloads/wk
Reviews
Write oneNobody has reviewed Webhook yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Webhook tools (5, 1 write)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
webhook_debugAnalyze a webhook request: parse headers, validate signature, decode body, check content-type, verify timestamp freshness, and detect the provider.
webhook_generate_payloadGenerate a realistic webhook payload for common services. Supports Stripe (payment_intent.succeeded), GitHub (push, pull_request), and Slack (message).
webhook_retry_scheduleCalculate a retry schedule with exponential backoff and optional jitter. Shows the delay, cumulative time, and scheduled timestamp for each retry attempt.
webhook_sendwrite actionSend a webhook payload to a URL with custom headers, body, and content-type. Supports retry with exponential backoff.
webhook_validateValidate a webhook signature. Supports HMAC-SHA256 and HMAC-SHA1 with built-in patterns for Stripe, GitHub, and Slack.
Public scan report
scanner v0.1.10 · 2026-09-27 · same rubric, same numbers if you re-run it
- Code scan20 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 190 days ago4/15
- Maintainer identityregistry namespace matches repository owner6/10
Install Webhook in Claude Code, Cursor or VS Code
Runs npx -y @rog0x/mcp-webhook-tools on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add webhook -- npx -y @rog0x/mcp-webhook-tools
What the publisher says
From the Webhook repository's README, as published. We do not edit it. Read it on GitHub
mcp-webhook-tools
Webhook management and testing tools for AI agents, built on the Model Context Protocol.
Tools
webhook_send
Send a webhook payload to any URL with custom headers, body, and content-type. Supports automatic retry with exponential backoff and jitter. Returns detailed attempt records including status codes, timing, and errors.
webhook_validate
Validate webhook signatures using HMAC-SHA256 or HMAC-SHA1. Includes built-in patterns for:
- Stripe — t=TIMESTAMP,v1=SIGNATURE format with timestamp tolerance
- GitHub — sha256=SIGNATURE or sha1=SIGNATURE format
- Slack — v0=SIGNATURE with v0:timestamp:body signing scheme
Uses timing-safe comparison to prevent timing attacks.
webhookgeneratepayload
Generate realistic webhook payloads for testing. Supported events:
Each payload includes randomized IDs, current timestamps, and suggested headers. Use the overrides parameter to customize specific fields.
webhook_debug
Analyze a webhook request end-to-end:
- Parse and categorize headers (content-type, signature, timestamp, delivery ID, custom)
- Validate the request body (size, JSON validity, encoding)
- Auto-detect the provider (Stripe, GitHub, Slack)
- Verify the signature if a secret is provided
- Check timestamp freshness (default 300s threshold)
- Report all issues found
webhookretryschedule
Calculate a retry schedule with exponential backoff. Shows each attempt's delay, cumulative elapsed time, and scheduled ISO timestamp. Configurable base delay, max delay cap, multiplier, and jitter.
Setup
npm install
npm run buildMCP Configuration
Add to your MCP client config:
{
"mcpServers": {
"webhook-tools": {
"command": "node",
"args": ["path/to/mcp-webhook-tools/dist/index.js"]
}
}
}License
MIT
Nothing above is checked by us. What we check is on the safety report.
Webhook: common questions
- Is Webhook MCP server safe?
- Mostly: it is graded B (72/100). Read the Webhook safety report
- How do I install Webhook?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Webhook need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Webhook maintained?
- The last commit was 206 days ago (2026-03-21). The latest release is v1.0.2.