Atlas / MCP servers / pipehero / pipehero

pipeheroSAFE

mcp/pipehero/pipehero-mcp

Debug webhooks from your AI agent: inspect and replay captured webhooks on localhost.

Verdict
SAFE
Grade
B
Trust score
86 /100
Exposed tools
—
Transport
streamable-http
License
—
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

**Pipehero** tunnels your localhost to a public URL and captures every webhook, so you can inspect, replay, and debug them — including from your AI agent via MCP.

This repo is auto-published from Pipehero's source. It holds the public MCP manifest and the agent skill. Issues/PRs welcome.
  • 🌐 Website: https://pipehero.app
  • 📚 Docs: https://pipehero.app/docs

Connect the MCP server

Let an agent (Claude Code, Cursor, Copilot, Windsurf, Zed, ...) list your tunnels, read captured webhooks, and replay them to localhost.

Remote — recommended (no install, OAuth)

claude mcp add --transport http pipehero https://mcp.pipehero.app/mcp

Your client opens the browser to sign in and approve — no token to paste.

For CI/headless, pass a token from https://pipehero.app/dashboard/settings:

claude mcp add --transport http pipehero https://mcp.pipehero.app/mcp \
--header "Authorization: Bearer "

Local — via the CLI

curl -fsSL https://pipehero.app/install | sh
pipehero login
claude mcp add pipehero -- pipehero mcp

Any MCP client works — add it to .cursor/mcp.json, claude_desktop_config.json, etc.:

{ "mcpServers": { "pipehero": { "command": "pipehero", "args": ["mcp"] } } }

Tools

Read from source at commit 0f33b9a0bf88OBSERVED · 2026-10-13
02

Trust audit

SAFEgrade B · trust 86/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeNA
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (7)

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · inv.no_license · CWE-1104
Why it matters. no LICENSE file and no repo licence
Fix. add a licence
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
README.md:36
curl -fsSL https://pipehero.app/install | sh
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
SKILL.md:14
- Install: `curl -fsSL https://pipehero.app/install | sh`
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
SKILL.md:31
curl -fsSL https://pipehero.app/install | sh
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
SKILL.md:108
If it isn't installed, install it first: `curl -fsSL https://pipehero.app/install | sh`

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-13 · audit v0.4.1 · source sha 0f33b9a0bf88full audit observations/trust-audit/mcp-server/pipehero__pipehero-mcp.json · Report an issue / request a re-scan
03

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-130f33b9a0bf88SAFEB86first audit
04

Questions

What is the pipehero MCP server?

Debug webhooks from your AI agent: inspect and replay captured webhooks on localhost.

Is pipehero safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (86/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does pipehero need?

No credential environment variables were found in its source, so it appears to need none.

How does pipehero run?

It speaks streamable-http, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (0f33b9a0bf88), read on 2026-10-13. The repository is watched and re-audited when it changes.

Advertisement