webhooks.cc

@webhooks-cc/mcp

MCP server for webhooks.cc. It gives coding agents direct access to webhook testing workflows: create endpoints, send signed test webhooks, inspect captures, compare attempts, verify signatures, and read recent webhook context through MCP resources.

It works with Claude Code, Cursor, VS Code, Codex, Windsurf, and Claude Desktop.

Install

The server reads WHK_API_KEY from the environment. It also supports:

• WHK_BASE_URL for a custom API base URL
• WHK_WEBHOOK_URL for a custom receiver base URL

Claude Code plugin

The plugin installs the server together with a webhook testing skill that tells Claude when to use it:

/plugin install webhooks-cc --marketplace kroqdotdev/webhooks-cc

For other agents, npx skills add kroqdotdev/webhooks-cc installs the same skill. See Agent skill.

One-click

• Cursor: Add to Cursor
• VS Code: Add to VS Code

CLI

# Claude Code
claude mcp add -s user --transport stdio webhooks-cc -e WHK_API_KEY=whcc_... -- npx -y @webhooks-cc/mcp

# OpenAI Codex
codex mcp add webhooks-cc -e WHK_API_KEY=whcc_... -- npx -y @webhooks-cc/mcp

# Cursor
npx @webhooks-cc/mcp setup cursor --api-key whcc_...

# VS Code
npx @webhooks-cc/mcp setup vscode --api-key whcc_...

# Windsurf
npx @webhooks-cc/mcp setup windsurf --api-key whcc_...

# Claude Desktop
npx @webhooks-cc/mcp setup claude-desktop --api-key whcc_...

Manual config

{
  "mcpServers": {
    "webhooks-cc": {
      "command": "npx",
      "args": ["-y", "@webhooks-cc/mcp"],
      "env": {
        "WHK_API_KEY": "whcc_..."
      }
    }
  }
}

Get your API key at webhooks.cc/account/api-keys.

What it exposes

The server exposes 39 tools, 3 prompts, and 3 resource surfaces with an API key, and 11 sandbox tools without one.

Endpoint tools

• create_endpoint
• list_endpoints
• get_endpoint
• update_endpoint
• delete_endpoint
• create_endpoints
• delete_endpoints

Request tools

• list_requests
• search_requests
• count_requests
• get_request
• wait_for_request
• wait_for_requests
• replay_request
• compare_requests
• generate_payload_schema (TypeScript, Zod, Pydantic, or JSON Schema from captured bodies)
• extract_from_request
• verify_signature
• clear_requests

Email tools

Every endpoint on an account receives email at {slug}@mailhooks.cc (and {slug}+{tag}@mailhooks.cc). These tools read it, with the one-time code and main link already picked out, unless the endpoint's owner turned that off:

• list_emails
• get_email
• wait_for_email
• send_test_email

The request tools and resources return emails too (filter with kind), without the raw message or the HTML part and with the text cut at 8,000 characters; get_email returns the HTML.

Forwarding tools

Forward every captured HTTP request and email to a URL or a Slack or Discord channel, as received, as signed JSON or as a chat message, retried and logged (owner only):

• configure_forwarding (URL, on/off, kinds, format, your headers, path, retries, order, sent time field)
• get_forwarding_secret (returns the whsec_ secret; with rotate: true, replaces it)
• test_forwarding
• list_deliveries (the delivery log with its counts, or every try of one request)
• redeliver (one request, or every failed delivery of an endpoint)

Send and test tools

• send_webhook
• send_to
• preview_webhook
• test_webhook_flow

Team tools

• list_teams
• list_team_members
• share_endpoint
• unshare_endpoint

Endpoints shared with you already appear in list_endpoints (with fromTeam) and work with every request tool except clear_requests, which stays with the owner. Invites are not exposed: accepting one claims a paid seat.

Discovery and account tools

• list_provider_templates
• get_usage (personal plan plus each subscribed team's pool)
• describe

Without an API key: the agent sandbox

Started without WHK_API_KEY, the server registers sandbox tools instead (auth.md):

• create_endpoint, list_endpoints, get_endpoint, delete_endpoint, list_requests, get_request, wait_for_request, generate_payload_schema: the same names and arguments as the full tools, in a sandbox of up to 3 endpoints, 25 captured requests each and 100 in all, for 24 hours. The first create_endpoint registers it (a few seconds of proof of work).
• connect_account: returns a link and a 6-digit code for a human to connect the agent to their account.
• wait_for_connection: waits for the human, then replaces the sandbox tools with the full tools for that account (notifications/tools/list_changed).
• about_sandbox: the limits and how to connect, without a network call.

Prompts

The server exposes MCP prompts for common workflows:

• debug_webhook_delivery
• setup_provider_testing
• compare_webhook_attempts

These prompts do not execute anything on their own. They give the client a structured starting point for multi-step agent work.

Resources

The server exposes MCP resources for recent webhook context:

• webhooks://endpoints
• webhooks://endpoint/{slug}/recent
• webhooks://request/{id}

These are useful when the client supports resource browsing or prompt/resource attachment.

Provider support

Provider template and signing support includes:

• stripe
• github
• shopify
• twilio
• slack
• paddle
• linear
• sendgrid
• clerk
• discord
• vercel
• gitlab
• typeform
• standard-webhooks
• meta
• lemonsqueezy
• coinbase-commerce
• razorpay
• cal
• intercom
• telegram
• square
• hubspot
• mailgun
• calendly
• mux
• sentry
• bitbucket
• docusign
• adyen
• paypal
• plaid
• resend
• workos

Signature verification also supports:

• all template providers except sendgrid (IP allowlisting) and plaid (JWT/JWK verification requires Plaid API credentials)

Use list_provider_templates to inspect templates, default events, signature headers, and signing requirements from the agent.

Example workflows

Typical agent flows:

• Create an ephemeral endpoint, send a provider-signed webhook, and wait for capture
• Search retained requests across endpoints with full-text filters
• Compare two webhook attempts and extract only the JSON fields you care about
• Verify a captured signature against a known secret
• Run test_webhook_flow to create, send, capture, verify, replay, and clean up in one tool call

Programmatic use

The package also exports createServer(), registerTools(), registerPrompts(), and registerResources() if you want to embed the server yourself.

import { createServer } from "@webhooks-cc/mcp";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

const server = createServer({
  apiKey: process.env.WHK_API_KEY!,
  baseUrl: process.env.WHK_BASE_URL,
  webhookUrl: process.env.WHK_WEBHOOK_URL,
});

await server.connect(new StdioServerTransport());

Example conversation

You: Create an ephemeral endpoint for GitHub webhook testing.

Agent: Created endpoint https://go.webhooks.cc/w/abc123 and marked it ephemeral.

You: Preview the signed request for a push event before sending it.

Agent: Here is the exact method, headers, and JSON body that would be sent.

You: Send it, wait for two requests, and compare them.

Agent: Sent the webhook, captured two requests, and here are the header and body differences.

Documentation

Full docs: webhooks.cc/docs/mcp

License

MIT