MCP.Market

Otterkit MCP server

by useotterkit·io.github.useotterkit/otterkit·v0.12.2
No reviews yet

Tunnels and webhooks for AI agents: capture, await, verify, replay, and send signed test events.

A86/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A86/100

full report

Adoption
Growing

0 stars72 downloads/wk

Reviews

Write one

Nobody has reviewed Otterkit yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Otterkit tools (11, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • account_status

    Show the logged-in OtterKit account and prepaid credit balance (1 credit = $0.01 = 1 tunnel hour).

  • event_sendwrite action

    Fire a correctly-signed synthetic webhook event (Stripe, GitHub, Shopify, Slack) at a local handler — develop and test a webhook handler with NO provider account, dashboard, or real event needed. Pass the signing secret and the handler will pass its signature verification. Omit event/target and pass list=true to see available events. Fully local, no credits.

  • request_await

    Block until a request matching the filters arrives on a capture log, then return it. The perfect assertion step: trigger an event, await its arrival, inspect the payload. Only matches NEW requests from the moment of the call. The session keeps running afterwards.

  • request_replay

    Re-send a captured request to a local target (no tunnel round-trip, no credits). Optionally override method/path/headers/body or edit individual JSON body fields via set (e.g. ["data.amount=999"]). The exchange is appended to the capture log.

  • request_verify

    Check whether captured requests carry a valid provider signature for the given secret — answers "is my signature-verification code wrong, or is the payload wrong?". Returns per-request valid/invalid with the reason. Fully local; the secret never leaves the machine.

  • requests_list

    Read requests captured on a webhook or tunnel(capture=true) session, newest last. Bodies are decoded when printable. Filters combine.

  • session_stop

    Stop a running tunnel/webhook daemon. The capture log is kept on disk so requests_list and request_replay still work afterwards.

  • sessions_list

    List running OtterKit tunnel/webhook daemons on this machine.

  • try_claim

    Continue a session started on the otterkit.com/try page: same public URL, converted to a normal metered webhook session on this account. Captures from the page are imported into the local log. The claim code comes from the /try page ("subdomain:secret"). Note: this registers the session for capture but a live connection requires `otterkit webhook --claim` in a terminal; prefer webhook_create unles

  • tunnel_createwrite action

    Expose a local port on a public URL (https://<subdomain>.otterkit.app). Runs as a background daemon. Costs 1 credit per connected hour (max 10/day). Set capture=true to also log every request for requests_list/request_await/request_replay.

  • webhook_createwrite action

    Provision a public webhook capture endpoint (https://<subdomain>.otterkit.app). Runs as a background daemon; every request is captured to a local log readable with requests_list/request_await. Costs 1 credit per connected hour (max 10/day). Returns the public URL.

Public scan report

scanner v0.1.9 · 2026-09-25 · same rubric, same numbers if you re-run it

no findings
  • Code scan39 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 43 days ago12/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 86/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Otterkit compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
86/100
higher than 72% of 48,255 servers
Tools
11
the typical server has 7
Tools that change things
27%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
72
more than 55% of 12,191 servers with a package

What its tools let an agent do: 8 read · 3 change

Install Otterkit in Claude Code, Cursor or VS Code

Runs npx -y otterkit on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add otterkit -- npx -y otterkit
Add to Cursor

What the publisher says

From the Otterkit repository's README, as published. We do not edit it. Read it on GitHub

OtterKit Agent Skills

Skills that teach AI coding agents (Claude Code, Cursor, Copilot — anything that reads the Agent Skills format) to drive OtterKit: tunnels and serverless webhook endpoints with capture, signature verification, and replay.

Install (Claude Code)

Copy any skill directory into .claude/skills/ in your project (or ~/.claude/skills/ for all projects):

git clone https://github.com/useotterkit/skill && cp -r skill/stripe-webhooks .claude/skills/

Or add the OtterKit MCP server, which exposes the same capabilities as tools:

claude mcp add otterkit -- npx otterkit mcp

What's different from a plain tunnel

Every skill leans on three things ngrok-class tools don't do:

(stripe:paymentintent.succeeded, github:pullrequest.opened, …) against a local handler, free, no provider account interaction.

  • otterkit send — synthetic provider events signed with real signature headers

request, with the failure reason.

  • otterkit verify — check captured deliveries against a signing secret, per

with a current timestamp so timestamp-tolerant handlers (Stripe, Slack) still accept it.

  • otterkit replay --resign — re-deliver a captured event to local code, re-signed

Skills are generated from the CLI's actual implementation and updated alongside it.

Nothing above is checked by us. What we check is on the safety report.

Otterkit: common questions

Is Otterkit MCP server safe?
Yes, by our scan: it is graded A (86/100). Read the Otterkit safety report
How do I install Otterkit?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Otterkit need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Otterkit maintained?
The last commit was 83 days ago (2026-08-13). The latest release is v0.12.2.
How does Otterkit compare with other MCP servers?
safety score 86/100 (higher than 72% of 48,255 servers); tools 11 (the typical server has 7); tools that change things 27% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.