{
  "markdown": "# Webhook.site MCP Server\n\n[![PyPI](https://img.shields.io/pypi/v/webhook-mcp-server.svg)](https://pypi.org/project/webhook-mcp-server/)\n[![Python](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/)\n[![MCP](https://img.shields.io/badge/MCP-31%20tools-brightgreen.svg)](https://modelcontextprotocol.io/)\n\nA Model Context Protocol (MCP) server for [webhook.site](https://webhook.site) - instantly capture HTTP requests, emails, and DNS lookups. Perfect for testing webhooks, debugging API callbacks, security testing, and bug bounty hunting.\n\n<!-- mcp-name: io.github.zebbern/webhook-mcp-server -->\n\nSecurity helper tools (SSRF, XSS, canary tokens) are for **authorized testing only** — systems you own or have explicit permission to test.\n\n---\n\n## Table of Contents\n\n- [Quick Start](#quick-start)\n- [What Can You Do?](#what-can-you-do)\n- [Tools Reference](#tools-reference)\n- [Examples](#examples)\n- [Each Webhook Token Provides](#each-webhook-token-provides)\n- [Documentation](#documentation)\n- [Development](#development)\n- [Requirements](#requirements)\n- [Contributing](#contributing)\n- [Credits](#credits)\n- [Links](#links)\n\n---\n\n## Quick Start\n\n### Installation\n\n```bash\n# Using uvx (recommended - no install needed)\nuvx webhook-mcp-server==3.0.0\n\n# Or install via pip\npip install webhook-mcp-server==3.0.0\n```\n\nUse `3.0.0` or newer. `2.1.3` does not start on MCP 2.0; 3.0 renames a few tools (see [Upgrading from 2.x](#upgrading-from-2x)).\n\n### VS Code / GitHub Copilot\n\nAdd to `.vscode/mcp.json`:\n\n```json\n{\n  \"servers\": {\n    \"webhook-mcp-server\": {\n      \"type\": \"stdio\",\n      \"command\": \"uvx\",\n      \"args\": [\"webhook-mcp-server==3.0.0\"]\n    }\n  }\n}\n```\n\n### Cursor\n\nAdd to `.cursor/mcp.json` (project) or your user MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"webhook-mcp-server\": {\n      \"command\": \"uvx\",\n      \"args\": [\"webhook-mcp-server==3.0.0\"]\n    }\n  }\n}\n```\n\n### Claude Desktop\n\nAdd to `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"webhook-mcp-server\": {\n      \"command\": \"uvx\",\n      \"args\": [\"webhook-mcp-server==3.0.0\"]\n    }\n  }\n}\n```\n\n### Configuration\n\nAll settings are environment variables on the server process. Put them in the `env` block of your MCP client config.\n\n| Variable | Purpose |\n| -------- | ------- |\n| `WEBHOOK_SITE_API_KEY` | Your webhook.site API key. Makes new URLs permanent (your plan's quota) and unlocks `list_webhooks`, Custom Actions, Schedules, Global Variables, Groups, Queue Profiles, Templates, Databases, Users and CSV export |\n| `WEBHOOK_SITE_DEFAULT_EXPIRY` | Seconds until new URLs expire when the call does not pass `expiry`. Unset means permanent on a paid account (7 days for anonymous URLs) |\n| `WEBHOOK_MCP_RATE_LIMIT_MAX_WAIT` | When webhook.site answers 429 with a `Retry-After` up to this many seconds (default 15), the call waits and retries once; longer waits are reported as an error naming the wait |\n| `FOLLOW_EMAIL_LINK_ALLOW_HOSTS` | `follow_email_link` only opens links to public internet hosts, and connects to the address it checked (no DNS rebinding). To test a sign-up flow on your own machine or intranet, list what to allow: `localhost,127.0.0.1,*.corp.example,10.0.0.0/8` |\n| `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY` | Honoured by `follow_email_link`. The proxy makes the connection, so the target is checked before the request instead of being pinned |\n| `SSL_CERT_FILE` / `SSL_CERT_DIR` | Custom CA bundle for `follow_email_link`, for corporate TLS interception |\n\nIf the request to a verification link completes and then redirects somewhere that is not allowed (a local dev server, an intranet dashboard), the tool reports that hop's status with the refused target in `blocked_redirect` instead of failing: the request that consumed the token already went through, whether or not the site counted it as verified.\n\n---\n\n## What Can You Do?\n\n### Capture Webhooks\n\n```\n\"Create a webhook and show me the URL\"\n\"What requests have been sent to my webhook?\"\n\"Wait for a request to come in\"\n```\n\n<img width=\"555\" height=\"555\" alt=\"Webhooks\" src=\"https://github.com/user-attachments/assets/75558234-9d93-4b79-817e-373a5ce75382\" />\n\n### Security/Bug Bounty:\n\n```\n\"Generate an SSRF payload to test for blind vulnerabilities\"\n\"Create XSS callback payloads to detect blind XSS attacks\"\n\"Make me a canary token to detect if someone accesses a URL\"\n```\n\n<img width=\"555\" height=\"555\" alt=\"Security\" src=\"https://github.com/user-attachments/assets/12150308-932a-4872-acd9-5473c7dde6ff\" />\n\n### Email Automation:\n\n```\n\"Create a temp email and wait for a password reset link\"\n\"Monitor this webhook for emails and extract all links from them\"\n\"Give me 3 temporary emails at once\" (batch creation)\n```\n\n<img width=\"555\" height=\"555\" alt=\"Email\" src=\"https://github.com/user-attachments/assets/04af7d6e-e8aa-4e35-a817-2204cde8f5e7\" />\n\n### API Testing:\n\n```\n\"Create a webhook that returns a 404 error with a custom message\"\n\"Make a webhook with CORS enabled that waits 5 seconds before responding\"\n\"Send 10 different test requests to a webhook and show me all the captured data\"\n\"Hold the next request and answer it with a 402 and this JSON body\"\n```\n\n<img width=\"555\" height=\"555\" alt=\"API\" src=\"https://github.com/user-attachments/assets/d8f2c46b-fb40-4e57-8957-0edef8e94db6\" />\n\n### Real-time Monitoring:\n\n```\n\"Create a webhook and wait for any HTTP request to arrive\"\n\"Monitor for DNS lookups to detect if a server is making DNS queries\"\n\"Search all requests for ones containing 'password' in the body\"\n```\n\n<img width=\"555\" height=\"555\" alt=\"Monitoring\" src=\"https://github.com/user-attachments/assets/12c9d270-f9df-489a-8be1-9afb4726404b\" />\n\n### Data Analysis:\n\n```\n\"Export all captured webhook requests to JSON format\"\n\"Show me statistics on requests received in the last hour\"\n\"Filter and show only POST requests with specific headers\"\n```\n\n<img width=\"555\" height=\"555\" alt=\"Data\" src=\"https://github.com/user-attachments/assets/51cd0032-d92b-46e7-9f0c-6cee96b6e4f3\" />\n\n### Automate with your account:\n\n```\n\"Add a Custom Action that forwards every request to my staging API\"\n\"Schedule a health check of https://example.com every 5 minutes and alert on a bad status\"\n\"Write a WebhookScript that answers with the request's JSON field 'id'\"\n```\n\n<img width=\"555\" height=\"555\" alt=\"Practical\" src=\"https://github.com/user-attachments/assets/a15bcbc4-087a-40bb-a1e5-a42475bd1301\" />\n\n### Canary Tokens\n\n```\n\"Create a canary URL to track document access\"\n\"Generate a DNS canary for the config file\"\n\"Set up an email tracker pixel\"\n```\n\n<img width=\"555\" height=\"555\" alt=\"CanaryTokens\" src=\"https://github.com/user-attachments/assets/2e6af1f5-55d6-4670-b899-6809f3031439\" />\n\n---\n\n## Tools Reference\n\nEverything works without an account on anonymous 7-day URLs. With `WEBHOOK_SITE_API_KEY` set, URLs are permanent and the account tools unlock the features of your plan. Every `webhook_token` accepts the UUID, an alias, a pasted `https://webhook.site/...` URL or the inbox address. Full parameters for each tool: [docs/TOOLS.md](docs/TOOLS.md).\n\n<!-- tools:start -->\n\n31 tools, generated from the server by `scripts/gen_tool_docs.py`.\n\n#### Diagnostics\n\n| Tool | What it does |\n| --- | --- |\n| `server_status` | Check this server's setup: API key, account reachability, plan, real-time socket, env config. |\n\n#### Webhooks\n\n| Tool | What it does |\n| --- | --- |\n| `create_webhook` | Create a disposable inbox to sign up on a website: HTTP URL, temp email, DNS. |\n| `configure_webhook` | Create a webhook with custom settings, or update one (pass webhook_token). |\n| `get_webhook_info` | Show a webhook's settings, expiry, request count and every address. |\n| `get_webhook_email` | Return the temp inbox to sign up, verify, magic-link, or reset a password. |\n| `list_webhooks` | List the webhooks (URLs / inboxes) in the account. Needs WEBHOOK_SITE_API_KEY. |\n| `delete_webhook` | Permanently delete a webhook and every captured request/email. |\n\n#### Requests\n\n| Tool | What it does |\n| --- | --- |\n| `send_requests` | Send one JSON body (data) or several (payloads) to the webhook URL to test capture. |\n| `get_webhook_requests` | List captured HTTP, email, or DNS events for a webhook, one page at a time. |\n| `search_requests` | Search captured events by method, body text, headers, type, or date. |\n| `get_request` | Return one captured event: the newest by default, or request_id. |\n| `update_request` | Attach a note to a captured request, or set its dynamic response. |\n| `download_request_file` | Download an uploaded file or email attachment (base64) by its file_id. |\n| `delete_request` | Delete one captured HTTP, email, or DNS event by request id. |\n| `delete_all_requests` | Clear captured events on a webhook, optionally by date or search query. |\n| `export_webhook_data` | Full dump of captured events with HTML and untruncated bodies, as JSON or CSV. |\n\n#### Real-time\n\n| Tool | What it does |\n| --- | --- |\n| `wait_for_request` | Wait until a new HTTP (or DNS) callback hits the webhook (1-120s). |\n| `wait_for_email` | Wait for a sign-up, verify, magic-link, or password-reset email (1-120s). |\n| `respond_to_next_request` | Hold the next request that hits the webhook and answer it with your own status, headers and body. |\n| `follow_email_link` | Open the verify / magic-link / reset URL from a captured sign-up email. |\n\n#### Account features (API key)\n\n| Tool | What it does |\n| --- | --- |\n| `manage_custom_actions` | Manage the Custom Actions webhook.site runs on every request or email a token receives. |\n| `manage_schedules` | Manage Schedules: webhook.site calls request_url on an interval (needs API key). |\n| `manage_global_variables` | Manage Global Variables shared by all URLs, usable as $name$ in Custom Actions and Schedules. |\n| `manage_groups` | Manage Groups that organise the account's webhooks (needs API key). |\n| `manage_queues` | Manage Queue Profiles that throttle queued Custom Actions (needs API key). |\n| `manage_templates` | Manage Templates: reusable sets of Custom Actions plus predefined variables (needs API key). |\n| `manage_databases` | Manage webhook.site Databases and run SQL against them (needs API key). |\n| `manage_users` | Manage team users on an Enterprise account (needs an administrator API key). |\n\n#### Security testing\n\n| Tool | What it does |\n| --- | --- |\n| `generate_oob_payloads` | Build authorized out-of-band payloads that ping this webhook: SSRF URLs, XSS callbacks, or canary tokens. |\n| `check_for_callbacks` | See if SSRF, XSS, or canary callbacks arrived in the last N minutes. |\n| `extract_links_from_request` | Pull confirm, reset, magic-link, and other URLs from a captured email or HTTP body. |\n\n<!-- tools:end -->\n\n### Upgrading from 2.x\n\n| 2.x tool | 3.0 replacement |\n| -------- | --------------- |\n| `create_webhook_with_config`, `update_webhook` | `configure_webhook` (pass `webhook_token` to update) |\n| `get_webhook_url`, `get_webhook_dns` | fields of `get_webhook_info` |\n| `get_latest_request` | `get_request` |\n| `send_to_webhook`, `send_multiple_requests` | `send_requests` (`data` or `payloads`) |\n| `generate_ssrf_payload`, `generate_xss_callback`, `generate_canary_token` | `generate_oob_payloads` (`kind=ssrf\\|xss\\|canary`, `canary_type`) |\n\n---\n\n## Examples\n\n### Sign up on a website\n\n1. `create_webhook` — get `email` (`{token}@emailhook.site`)\n2. Use that address on the site (sign-up, verify, magic link, or password reset)\n3. `wait_for_email` — receive the message, confirm / login / reset URLs, and any OTP\n4. `follow_email_link` to open a verify link, or type `verification_codes` on the site\n\nIf you already have a token, `get_webhook_email` returns the same inbox.\n\n### Create a Webhook\n\n```json\n// Response from create_webhook\n{\n  \"token\": \"abc123-def456-...\",\n  \"url\": \"https://webhook.site/abc123-def456-...\",\n  \"email\": \"abc123-def456-...@emailhook.site\",\n  \"dns\": \"abc123-def456-....dnshook.site\"\n}\n```\n\n### Wait for Password Reset Email\n\n```json\n// Response from wait_for_email\n{\n  \"email_received\": true,\n  \"subject\": \"Password Reset Request\",\n  \"from\": \"noreply@example.com\",\n  \"auth_links\": [\"https://example.com/reset?token=xyz789\"],\n  \"verification_codes\": [\"847291\"]\n}\n```\n\n### Poll for new events without paging\n\n```json\n// get_webhook_requests(webhook_token, since=<next_since from the previous call>)\n{\n  \"requests\": [ ... only what arrived after the cursor ... ],\n  \"next_since\": 1788472548944304\n}\n```\n\n### SSRF Testing Payload\n\n```json\n// Response from generate_oob_payloads(kind=\"ssrf\")\n{\n  \"payloads\": {\n    \"http\": \"https://webhook.site/token?id=ssrf-test\",\n    \"dns\": \"ssrf-test.token.dnshook.site\",\n    \"ip_decimal\": \"http://2130706433/token\",\n    \"ip_hex\": \"http://0x7f000001/token\"\n  }\n}\n```\n\n---\n\n## Each Webhook Token Provides\n\n| Endpoint          | Format                                  | Use Case                                        |\n| ----------------- | --------------------------------------- | ----------------------------------------------- |\n| **HTTP URL**      | `https://webhook.site/{token}`          | Capture HTTP/HTTPS requests (any sub-path too)  |\n| **Subdomain**     | `https://{token}.webhook.site`          | Alternative URL format                          |\n| **Forced status** | `https://webhook.site/{token}/{status}` | Answer with that status, for retry-logic tests  |\n| **Email**         | `{token}@emailhook.site`                | Capture incoming emails                         |\n| **DNS**           | `{token}.dnshook.site`                  | Capture DNS lookups (every subdomain)           |\n\n---\n\n## Documentation\n\n| Page | Contents |\n| ---- | -------- |\n| [docs/TOOLS.md](docs/TOOLS.md) | Every tool with parameters and hints, generated from the server |\n| [docs/webhook-site-notes.md](docs/webhook-site-notes.md) | What webhook.site actually does, verified live, including where the official docs are wrong |\n| [docs/testing.md](docs/testing.md) | The four test layers, recordings, verification scripts, model evals, account safety |\n| [docs/releasing.md](docs/releasing.md) | Version bumps, tagging, the publish workflow |\n| [CHANGELOG.md](CHANGELOG.md) | Version history |\n\n---\n\n## Development\n\n```bash\ngit clone https://github.com/zebbern/webhook-mcp-server.git\ncd webhook-mcp-server\npip install -e \".[dev]\"\npytest -m \"not live and not live_auth\"     # offline suite incl. replay of recorded live exchanges\npython server.py                            # run the server on stdio\n```\n\nThe offline suite replays real recorded webhook.site exchanges; the live tool check and the `live` / `live_auth` tiers hit the real API. Details in [docs/testing.md](docs/testing.md).\n\nLayout: `server.py` (entry point and lifespan), `handlers/tools.py` (tool registrations), `services/` (one module per API area), `utils/` (HTTP client, real-time socket, URL safety, references), `scripts/` (live check, generators, verifiers), `evals/` (model-in-the-loop prompts).\n\n---\n\n## Requirements\n\n- Python 3.10+\n- `mcp >= 2.0.0`\n- `httpx >= 0.26.0`, `httpcore >= 1.0.0`, `anyio >= 4.0.0`\n- `python-socketio[asyncio_client] >= 5.11.0` (real-time waiting; the tools fall back to polling without it)\n\n---\n\n## Contributing\n\nBug reports and PRs are welcome. Keep a PR to one change, add a test whose expectation was checked against the real API (see [docs/testing.md](docs/testing.md)), and run `python scripts/gen_tool_docs.py` after touching a tool.\n\n---\n\n## Credits\n\n- [Simon Fredsted (Founder of webhook.site)](https://github.com/fredsted)\n- [Official webhook.site open source repo](https://github.com/webhooksite/webhook.site)\n\nThis project is not affiliated with or endorsed by webhook.site\n\n## Links\n\n- 📦 [PyPI Package](https://pypi.org/project/webhook-mcp-server/)\n- 🐙 [GitHub Repository](https://github.com/zebbern/webhook-mcp-server)\n- 🌐 [webhook.site](https://webhook.site) - The service this MCP wraps\n- 📖 [Model Context Protocol](https://modelcontextprotocol.io/) - MCP specification\n\n---\n\n**Made with ❤️ for the MCP community**\n",
  "bytes": 16004,
  "sha": "14537c96b3e8660dcb8e84e5114e7b26df19469d2d5b1ebdb2639fa74c142d40",
  "repo_slug": "zebbern/webhook-mcp-server",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_zebbern_webhook_mcp_server_5a3f865b/readme"
}