Atlas / MCP servers / kroqdotdev / webhooks-cc

webhooks-ccBLOCK

Name: webhooks-cc
Author: kroqdotdev

mcp/kroqdotdev/webhooks-cc

MCP server by kroqdotdev · claude code · cursor · developer tools · Audited 2026-10-11

⚑ Report / re-scan Source ↗

Webhook inspection and testing service

Verdict

BLOCK

Grade

Trust score

37 /100

Exposed tools

42 28r · 11w · 3d

Transport

stdio

License

AGPL-3.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Inspect and debug webhooks without deploying to production.

Get a unique URL, point your webhook there, and see every request in real-time. No signup required.

[Try it now →](https://webhooks.cc)

Getting Started

Visit webhooks.cc
Copy your unique webhook URL
Send a test request: curl -X POST https://go.webhooks.cc/w/ -d '{"test": true}'
Watch it appear in the dashboard

Features

Capture requests — Store incoming webhooks with headers, body, query params, and metadata
Inspect in real-time — See requests the moment they arrive via WebSocket
Configure responses — Return custom status codes, headers, and body for testing error paths
Forward to localhost — Tunnel webhooks to your local server during development
CLI with interactive TUI — Manage endpoints, tunnel, and stream requests from your terminal
TypeScript SDK — Access webhook data programmatically for automation and testing
MCP server — Connect AI coding agents (Claude Code, Cursor, VS Code, Codex) to your webhooks

Use Cases

Testing payment integrations — Point Stripe's test webhooks at your endpoint. Inspect the payload structure before writing handlers.

Debugging CI/CD hooks — See exactly what GitHub sends when a push, PR, or deployment occurs.

Developing locally — Forward production-like webhooks to localhost without exposing your machine to the internet.

Mocking failure scenarios — Configure your endpoint to return 500 errors and test your retry logic.

Pricing

Free — 50 requests/day, 7-day data retention. Enough for development and testing.

Pro ($8/month) — 100,000 requests/month, 30-day retention. For production monitoring and high-volume testing.

See webhooks.cc for details.

Install

CLI

curl -fsSL https://webhooks.cc/install.sh | sh

Then launch interactive terminal:

whk

SDK

npm install

Read from source at commit 085f6835cbfaOBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add sdk --env AGENT_ASSERTION_SIGNING_KEY=${AGENT_ASSERTION_SIGNING_KEY} --env AGENT_IDJAG_MAX_AUTH_AGE_SECONDS=${AGENT_IDJAG_MAX_AUTH_AGE_SECONDS} --env AGENT_POW_SECRET=${AGENT_POW_SECRET} --env AGENT_POW_SECRET_PREVIOUS=${AGENT_POW_SECRET_PREVIOUS} -- npx -y @webhooks-cc/[email protected]

claude-desktop

{
  "mcpServers": {
    "sdk": {
      "command": "npx",
      "args": [
        "-y",
        "@webhooks-cc/[email protected]"
      ],
      "env": {
        "AGENT_ASSERTION_SIGNING_KEY": "${AGENT_ASSERTION_SIGNING_KEY}",
        "AGENT_IDJAG_MAX_AUTH_AGE_SECONDS": "${AGENT_IDJAG_MAX_AUTH_AGE_SECONDS}",
        "AGENT_POW_SECRET": "${AGENT_POW_SECRET}",
        "AGENT_POW_SECRET_PREVIOUS": "${AGENT_POW_SECRET_PREVIOUS}"
      }
    }
  }
}

Exposed tools (42)

28 read · 11 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Order`	write	webhooks.cc test charge
`about_sandbox`	read	Explain what this agent can do without a webhooks.cc account, the sandbox limits, and how to connect an account. No network call.
`clear_requests`	destructive	Delete captured requests for an endpoint without deleting the endpoint itself.
`compare_requests`	read	Compare two captured requests and show the structured differences.
`configure_forwarding`	write	Set the URL captured emails are forwarded to (as signed JSON) and turn forwarding on or off. Owner only. Saving the first URL creates the signing secret.
`connect_account`	read	Connect this agent to a human
`count_requests`	read	Count captured webhook requests that match the given filters.
`create_endpoint`	write	Create a temporary webhook capture endpoint in the agent sandbox (no account needed): ${limits}. The first call registers the sandbox, which takes a few seconds of proof of work. Mock responses, notifications and signature verification need an account: see connect_account.
`create_endpoints`	write	Create multiple webhook endpoints in one call.
`delete_endpoint`	destructive	Delete one of this agent
`delete_endpoints`	destructive	Delete multiple webhook endpoints in one call.
`describe`	read	Describe all available SDK operations, parameters, and types.
`extract_from_request`	read	Extract specific JSON fields from a captured request body.
`get_email`	read	Get one captured email: by requestId, or the newest at an endpoint (optionally with a tag). Returns the parsed message with its one-time code and main link.
`get_endpoint`	read	Get one of this agent
`get_forwarding_secret`	read	Read (or with rotate: true, replace) the whsec_ secret forwarded emails are signed with. Owner only. Treat the value as a credential: put it in the handler
`get_request`	read	Get full details for a request captured by a sandbox endpoint.
`get_usage`	read	Check current request usage, remaining quota, plan, and period end, plus the pooled quota of every subscribed team you belong to.
`list_deliveries`	read	List forwarding deliveries: an endpoint
`list_emails`	read	List the emails an endpoint received at its mailhooks.cc address, newest first: subject, sender, tag, and the one-time code and main link found in each.
`list_endpoints`	read	List this agent
`list_provider_templates`	read	List supported webhook providers, templates, and signing metadata.
`list_requests`	read	List recent requests captured by a sandbox endpoint, newest first.
`list_team_members`	read	List a team
`list_teams`	read	List the teams you own or belong to, with role, seats, pooled request usage (requestsUsed/requestLimit), period end, and whether the team is suspended for lack of a subscription.
`preview_webhook`	read	Preview a webhook request without sending it. Returns the exact URL, method, headers, and body.
`redeliver_email`	read	Forward a captured email again with the endpoint
`replay_request`	read	Replay a previously captured request to a target URL.
`search_requests`	read	Search captured webhook requests across endpoints using retained full-text search.
`send_test_email`	write	Deliver a sample email (with a 6-digit code and a link) to an endpoint, optionally to a +tag address. It counts as one request and skips SMTP, so sender checks do not run on it.
`send_to`	write	Send a webhook directly to any URL with optional provider signing.
`send_webhook`	write	Send a test webhook to a hosted endpoint. Supports provider templates and signing.
`share_endpoint`	read	Share an endpoint you own with a team so its members can inspect, stream, and edit it. The team needs an active subscription; the endpoint
`test_forwarding`	write	Post the endpoint
`test_webhook_flow`	write	Run a full webhook test flow: create endpoint, optionally mock, send, wait, verify, replay, and clean up.
`unshare_endpoint`	write	Stop sharing an endpoint you own with a team. Works even when the team is suspended.
`update_endpoint`	write	Update an endpoint name, mock response, conditional response rules, signing configuration, or whether codes and links are picked out of its emails.
`verify_signature`	read	Verify the webhook signature on a captured request. When called without provider/secret, returns the server-side pre-computed result (if signing is configured on the endpoint). When called with provider+secret, performs client-side verification.
`wait_for_connection`	read	Wait for the human to enter the code from connect_account. On success the full webhooks.cc tools for their account replace these sandbox tools. Returns after timeoutSeconds (default ${DEFAULT_WAIT_SECONDS}) if they have not finished yet; call it again to keep waiting.
`wait_for_email`	read	Wait for an email to arrive at an endpoint (for example after triggering a signup), then return it with its one-time code and main link. Use a tag per run to find your own email.
`wait_for_request`	read	Wait for a request to arrive at a sandbox endpoint.
`wait_for_requests`	read	Wait for multiple requests to arrive at an endpoint.

Trust audit

BLOCKgrade F · trust 37/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (9 observation(s))
Network: declared (17 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

apps/receiver-rs/src/handlers/webhook.rs:330

|| v4.is_link_local()                      // 169.254.0.0/16 (includes metadata 169.254.169.254)

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

apps/receiver-rs/src/handlers/webhook.rs:1686

assert!(is_blocked_ip("169.254.169.254".parse::<IpAddr>().unwrap()));

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

apps/receiver-rs/src/handlers/webhook.rs:1711

"::ffff:169.254.169.254".parse::<IpAddr>().unwrap()

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

apps/receiver-rs/src/handlers/webhook.rs:1734

resolve_notification_target("http://169.254.169.254/meta")

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.env.example:6

SUPABASE_DB_URL=postgresql://postgres:password@your-supabase-host:5433/postgres

HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.env.example:9

DATABASE_URL=postgresql://postgres:password@your-supabase-host:5432/postgres

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

.env.example:79

# MAIL_INGEST_URL=http://127.0.0.1:3002

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

apps/cli-rs/src/api/stream.rs:717

(format!("http://127.0.0.1:{}", addr.port()), shared)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

apps/mx-rs/src/ingest.rs:479

ingest("http://127.0.0.1:1").check("[email protected]").await,

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

apps/mx-rs/src/ingest.rs:533

ingest("http://127.0.0.1:1").deliver(delivery()).await,