Webhook Toolkit

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Webhook URLs for AI agents: receive, wait for, replay, sign and verify webhooks (Stripe, GitHub…).

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Webhook Toolkit": {
      "url": "https://webhook-toolkit.com/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (10)

• create_webhook_url

  Create a public HTTPS URL that captures every request sent to it (any method, any sub-path). Use it when you need an endpoint to receive a webhook from a third-party service while building or debugging an integration. Returns the URL to configure in the service and a live inspector link for the human.

  Parameters:

  • name — string — Label, e.g. 'stripe-test'

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_webhook_urls read-only

  List the webhook URLs of the account behind the API key (requires an API key).

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• wait_for_webhook read-only

  Block until the next request reaches a webhook URL (or the timeout elapses), then return it in full: method, path, headers, body, detected provider and event. Use right after triggering an action that should send a webhook. Call again with `after` set to the last request's createdAt to wait for the following one.

  Parameters:

  • token (required) — string — Token of the webhook URL (the part after /r/)
  • after — string — ISO timestamp: only requests strictly newer than this. Default: now.
  • timeout_seconds — integer — Default 30, max 50

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• list_webhook_requests read-only

  List the most recent requests captured by a webhook URL, newest first (summaries; use get_webhook_request for one full request).

  Parameters:

  • token (required) — string
  • limit — integer — Default 10

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• get_webhook_request read-only

  Return one captured request in full (headers, raw body, detected provider/event).

  Parameters:

  • token (required) — string
  • request_id (required) — string

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• set_webhook_response

  Choose what the webhook URL answers to callers (status code, body, content type) — e.g. return 500 to test the sender's retries, or a specific JSON/XML body the service expects.

  Parameters:

  • token (required) — string
  • body — string
  • status — integer
  • content_type — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• replay_webhook_request

  Re-send a captured request (same method, headers and raw body) to a PUBLIC URL and return the target's response. Localhost and private IPs are refused here: for localhost use the CLI (`npx webhook-toolkit replay`) or the local MCP server (`npx webhook-toolkit mcp`).

  Parameters:

  • token (required) — string
  • request_id (required) — string
  • target_url (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• sign_webhook_payload

  Build a webhook body with a VALID signature header for a provider, to test a handler's signature verification without triggering a real event. Providers: stripe, github, shopify, slack, twilio, mailgun. Returns the headers, the exact body to send and a ready-to-run curl command.

  Parameters:

  • provider (required) — string
  • secret (required) — string — The webhook signing secret configured in your handler (whsec_… for Stripe)
  • payload — string — JSON payload (or form fields as JSON for Twilio). Default: a realistic sample event.
  • event_type — string — Sample event to use when no payload is given, e.g. checkout.session.completed
  • target_url — string — Handler URL (required for Twilio, whose signature covers the URL)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• verify_webhook_signature read-only

  Check whether a webhook signature is valid for a raw body and a secret, and diagnose why it fails (wrong secret, whitespace, re-serialized JSON body, expired timestamp, wrong URL for Twilio). Providers: stripe, github, shopify, slack, twilio.

  Parameters:

  • provider (required) — string
  • secret (required) — string
  • raw_body (required) — string — The raw request body exactly as received
  • signature (required) — string — The signature header value (Stripe-Signature, X-Hub-Signature-256, X-Shopify-Hmac-Sha256, X-Slack-Signature, X-Twilio-Signature)
  • url — string — Twilio only: the full URL Twilio called
  • timestamp — string — Slack only: X-Slack-Request-Timestamp

  Hints: read-only yes · destructive not declared · idempotent not declared · open-world not declared

• explain_webhook_request

  AI analysis of a captured request. mode=explain: who sent it, which event, key fields, how to verify the signature, pitfalls. mode=handler: complete receiving code that verifies the signature and handles this event. Included in paid plans; anonymous and free users get 3 trials.

  Parameters:

  • token (required) — string
  • request_id (required) — string
  • mode — string
  • language — string — Handler language (mode=handler). Default node.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.