Webhook Studio MCP server

• configure_verificationFree

  Turn on HMAC signature verification for a bucket using the provider's own signing secret (e.g. Stripe's whsec_). This is how you finish a "verified webhook" integration end to end. Set secret to the provider secret and hmac_enabled:true in the same call; the signature scheme is auto-detected from the header shape.

• create_bucketwrite actionFree

  Provision a new webhook endpoint (a "bucket") that captures incoming HTTP requests. Returns its id, public ingest url to point a provider at, inbox_url (the live human view to hand back), and signing secret. Pass external_ref — your own stable name like "acme-api:stripe" — so you can re-find this exact bucket later with list_buckets after losing context.

• delete_bucketwrite actionFree

  Permanently delete a webhook endpoint and its captured events.

• diff_schemaFree

  Compare two versions of a learned schema and get exactly which fields were added, removed or changed type, each flagged as breaking or not. This is the "why did my handler start failing" answer, produced without reading a single payload. from defaults to the version before to.

• find_correlation_keysFree

  List the correlation-key candidates for a learned schema — the fields that look like identifiers (e.g. data.object.id), ranked by how consistently they appear. These are the fields to group events by when reconstructing a lifecycle (a Stripe payment_intent across created -> succeeded, a GitHub PR across its events). Derived from real traffic, so it reflects what THIS account actually receives.

• forward_bucketFree

  Set up standing forwarding from a bucket to a URL. Pass forward_all:true to forward every event, or condition_tree to forward only matching events (same AND/OR condition grammar the routing engine uses). Creates the destination and routing rule in one call.

• generate_typesFree

  Generate types, a runtime validator, or a full handler from a learned schema — the payoff of the knowledge layer. Everything is derived from the payloads this account ACTUALLY received, with genuinely-optional fields marked optional, instead of a plausible-but-wrong guess from a model's memory of the provider docs. Pass lang for a bare type (typescript / json-schema / zod), or framework (next / express) for a ready-to-paste handler that validates and hands back a fully-typed event.

• get_bucketFree

  Fetch one webhook endpoint by id, including its url and inbox_url.

• get_eventFree

  Fetch one captured event by id with its full headers, body, signature verification result (and failure reason), and every outbound delivery attempt. This is how you find out whether your forward actually reached its target and what came back.

• get_schemaFree

  Fetch one learned schema with every field, its type, whether it is optional, and how often it actually appears — the real shape of the payload, derived from what this account received rather than guessed from training data.

• latest_eventFree

  Get the single most recent event captured by a bucket, optionally filtered by provider and event type. Returns one event with its headers, body and delivery results — the one-shot answer to "what did Stripe last send me". 404 if nothing matches, so you never index into an empty list.

• list_bucketsFree

  List your webhook endpoints. Pass external_ref to fetch the specific bucket you created earlier under that name — this is how you re-anchor after losing the conversation, since you never need to have stored the bucket id.

• list_deliveriesFree

  List outbound delivery attempts for a bucket, newest first, with the full request and response of each. Pass success:false to see only failures — the direct answer to "which of my forwards are broken and why".

• list_eventsFree

  List events captured by a bucket, newest first, with composable filters: since/until (ISO 8601 or YYYY-MM-DD), provider, type, method, signature_valid, and q (case-insensitive search over body, content type, method, type and labels; space-separated terms must ALL match, double quotes for an exact phrase, and key:value filters by a label this bucket defines). Use cursor for the next page.

• list_schemasFree

  List the payload schemas Webhook Studio has learned from this account's real traffic, optionally filtered by provider and event_type. These outlive the payloads they were learned from, so this answers "what shapes do I know about" even after old events are gone. Start here to discover what you can generate types or diffs for.

• replay_eventFree

  Re-send a captured event to any URL — the test runner for a handler you just wrote. preserve_headers defaults to true so the original signature header (e.g. Stripe-Signature) arrives intact. If you changed the body or the receiver verifies with a different secret, pass resign_with (the dev's own signing secret) so the payload is re-signed and their verification code passes unmodified. Returns the response status, latency and body.

• wait_for_eventFree

  Block until the next matching event arrives on a bucket, or until the timeout. Use this to turn "go click Send test webhook in Stripe" into a synchronous step: call it, tell the human to trigger the event, and it returns as soon as one arrives. Filters (provider, type) mean unrelated traffic does not wake it. Returns the event, or nothing if it times out.

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 168ms20/20
• Tool poisoning17 tool descriptions checked15/15
• Auth qualityAPI key sent as a header8/15
• Maintenancelast push 72 days ago12/15
• Maintainer identityendpoint served from the registry-verified namespace domain8/10

Safety score

84/100

higher than 68% of 48,255 servers

Tools

17

the typical server has 7

Tools that change things

12%

typical: 0%. Fewer write tools means less an agent can break

Uptime

100%

of our recent checks; the typical remote server answers 100%

Response time

143 ms

faster than 74% of 30,031 servers

Webhook Studio: common questions

Is Webhook Studio MCP server safe?

Mostly: it is graded B (84/100). Read the Webhook Studio safety report

How do I install Webhook Studio?

It runs remotely at webhook-studio.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does Webhook Studio need an API key?

Yes. The registry entry asks for Authorization.

Is Webhook Studio maintained?

The last commit was 75 days ago (2026-08-21). The latest release is v0.1.1.

Is Webhook Studio up?

100% of our last 28 checks got an answer. We check remote servers about four times a day.

What can I use instead of Webhook Studio?

Servers from other publishers that do the same job: Keploy MCP server.

How does Webhook Studio compare with other MCP servers?

safety score 84/100 (higher than 68% of 48,255 servers); tools 17 (the typical server has 7); tools that change things 12% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.