pipeheroSAFE
Debug webhooks from your AI agent: inspect and replay captured webhooks on localhost.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
**Pipehero** tunnels your localhost to a public URL and captures every webhook, so you can inspect, replay, and debug them — including from your AI agent via MCP.
This repo is auto-published from Pipehero's source. It holds the public MCP manifest and the agent skill. Issues/PRs welcome.
- 🌐 Website: https://pipehero.app
- 📚 Docs: https://pipehero.app/docs
Connect the MCP server
Let an agent (Claude Code, Cursor, Copilot, Windsurf, Zed, ...) list your tunnels, read captured webhooks, and replay them to localhost.
Remote — recommended (no install, OAuth)
claude mcp add --transport http pipehero https://mcp.pipehero.app/mcp
Your client opens the browser to sign in and approve — no token to paste.
For CI/headless, pass a token from https://pipehero.app/dashboard/settings:
claude mcp add --transport http pipehero https://mcp.pipehero.app/mcp \ --header "Authorization: Bearer "
Local — via the CLI
curl -fsSL https://pipehero.app/install | sh pipehero login claude mcp add pipehero -- pipehero mcp
Any MCP client works — add it to .cursor/mcp.json, claude_desktop_config.json, etc.:
{ "mcpServers": { "pipehero": { "command": "pipehero", "args": ["mcp"] } } }Tools
0f33b9a0bf88OBSERVED · 2026-10-13Trust audit
SAFEgrade B · trust 86/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (7)
streamable-http
curl -fsSL https://pipehero.app/install | sh
- Install: `curl -fsSL https://pipehero.app/install | sh`
curl -fsSL https://pipehero.app/install | sh
If it isn't installed, install it first: `curl -fsSL https://pipehero.app/install | sh`
Gates applied: no_behavioural_pass, no_license.
0f33b9a0bf88full audit observations/trust-audit/mcp-server/pipehero__pipehero-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | 0f33b9a0bf88 | SAFE | B | 86 | first audit |
Questions
What is the pipehero MCP server?
Debug webhooks from your AI agent: inspect and replay captured webhooks on localhost.
Is pipehero safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (86/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does pipehero need?
No credential environment variables were found in its source, so it appears to need none.
How does pipehero run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (0f33b9a0bf88), read on 2026-10-13. The repository is watched and re-audited when it changes.