MCP server for webhooks.cc. It gives coding agents direct access to webhook testing workflows: create endpoints, send signed test webhooks, inspect captures, compare attempts, verify signatures, and read recent webhook context through MCP resources.

It works with Claude Code, Cursor, VS Code, Codex, Windsurf, and Claude Desktop.

Install

The server reads WHK_API_KEY from the environment. It also supports:

WHK_BASE_URL for a custom API base URL
WHK_WEBHOOK_URL for a custom receiver base URL

One-click

Cursor: Add to Cursor
VS Code: Add to VS Code

CLI

# Claude Code
claude mcp add -s user --transport stdio webhooks-cc -e WHK_API_KEY=whcc_... -- npx -y @webhooks-cc/mcp

# OpenAI Codex
codex mcp add webhooks-cc -e WHK_API_KEY=whcc_... -- npx -y @webhooks-cc/mcp

# Cursor
npx @webhooks-cc/mcp setup cursor --api-key whcc_...

# VS Code
npx @webhooks-cc/mcp setup vscode --api-key whcc_...

# Windsurf
npx @webhooks-cc/mcp setup windsurf --api-key whcc_...

# Claude Desktop
npx @webhooks-cc/mcp setup claude-desktop --api-key whcc_...

Manual config

{
  "mcpServers": {
    "webhooks-cc": {
      "command": "npx",
      "args": ["-y", "@webhooks-cc/mcp"],
      "env": {
        "WHK_API_KEY": "whcc_..."
      }
    }
  }
}

Get your API key at webhooks.cc/account.

What it exposes

The server exposes 38 tools, 3 prompts, and 3 resource surfaces with an API key, and 10 sandbox tools without one.

Endpoint tools

create_endpoint
list_endpoints
get_endpoint
update_endpoint
delete_endpoint
create_endpoints
delete_endpoints

Request tools

list_requests
search_requests
count_requests
get_request
wait_for_request
wait_for_requests
replay_request
compare_requests
extract_from_request
verify_signature
clear_requests

Email tools

Every endpoint on an account receives email at {slug}@mailhooks.cc (and {slug}+{tag}@mailhooks.cc). These tools read it, with the one-time code and main link already picked out, unless the endpoint's owner turned that off:

list_emails
get_email
wait_for_email
send_test_email

The request tools and resources return emails too (filter with kind), without the raw message or the HTML part and with the text cut at 8,000 characters; get_email returns the HTML.

Forwarding tools

Forward every captured HTTP request and email to a URL or a Slack or Discord channel, as received, as signed JSON or as a chat message, retried and logged (owner only):

configure_forwarding (URL, on/off, kinds, format, your headers, path, retries, order, sent time field)
get_forwarding_secret (returns the whsec_ secret; with rotate: true, replaces it)
test_forwarding
list_deliveries (the delivery log with its counts, or every try of one request)
redeliver (one request, or every failed delivery of an endpoint)

Send and test tools

send_webhook
send_to
preview_webhook
test_webhook_flow

Team tools

list_teams
list_team_members
share_endpoint
unshare_endpoint

Endpoints shared with you already appear in list_endpoints (with fromTeam) and work with every request tool except clear_requests, which stays with the owner. Invites are not exposed: accepting one claims a paid seat.

Discovery and account tools

list_provider_templates
get_usage (personal plan plus each subscribed team's pool)
describe

Without an API key: the agent sandbox

Started without WHK_API_KEY, the server registers sandbox tools instead (auth.md):

create_endpoint, list_endpoints, get_endpoint, delete_endpoint, list_requests, get_request, wait_for_request: the same names and arguments as the full tools, in a sandbox of up to 3 endpoints, 25 captured requests each and 100 in all, for 24 hours. The first create_endpoint registers it (a few seconds of proof of work).
connect_account: returns a link and a 6-digit code for a human to connect the agent to their account.
wait_for_connection: waits for the human, then replaces the sandbox tools with the full tools for that account (notifications/tools/list_changed).
about_sandbox: the limits and how to connect, without a network call.

Prompts

The server exposes MCP prompts for common workflows:

debug_webhook_delivery
setup_provider_testing
compare_webhook_attempts

These prompts do not execute anything on their own. They give the client a structured starting point for multi-step agent work.

Resources

The server exposes MCP resources for recent webhook context:

webhooks://endpoints
webhooks://endpoint/{slug}/recent
webhooks://request/{id}

These are useful when the client supports resource browsing or prompt/resource attachment.

Provider support

Provider template and signing support includes:

stripe
github
shopify
twilio
slack
paddle
linear
sendgrid
clerk
discord
vercel
gitlab
typeform
standard-webhooks
meta
lemonsqueezy
coinbase-commerce
razorpay
cal
intercom
telegram
square
hubspot
mailgun
calendly
mux
sentry
bitbucket
docusign
adyen
paypal
plaid
resend
workos

Signature verification also supports:

all template providers except sendgrid (IP allowlisting) and plaid (JWT/JWK verification requires Plaid API credentials)

Use list_provider_templates to inspect templates, default events, signature headers, and signing requirements from the agent.

Example workflows

Typical agent flows:

Create an ephemeral endpoint, send a provider-signed webhook, and wait for capture
Search retained requests across endpoints with full-text filters
Compare two webhook attempts and extract only the JSON fields you care about
Verify a captured signature against a known secret
Run test_webhook_flow to create, send, capture, verify, replay, and clean up in one tool call

Programmatic use

The package also exports createServer(), registerTools(), registerPrompts(), and registerResources() if you want to embed the server yourself.

import { createServer } from "@webhooks-cc/mcp";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

const server = createServer({
  apiKey: process.env.WHK_API_KEY!,
  baseUrl: process.env.WHK_BASE_URL,
  webhookUrl: process.env.WHK_WEBHOOK_URL,
});

await server.connect(new StdioServerTransport());

Example conversation

You: Create an ephemeral endpoint for GitHub webhook testing.

Agent: Created endpoint https://go.webhooks.cc/w/abc123 and marked it ephemeral.

You: Preview the signed request for a push event before sending it.

Agent: Here is the exact method, headers, and JSON body that would be sent.

You: Send it, wait for two requests, and compare them.

Agent: Sent the webhook, captured two requests, and here are the header and body differences.