# Webhook Studio (remote · webhook-studio.com)

Keyless webhook endpoints: capture, wait, replay, forward, and generate types from real traffic.

- Trust score: 65/100 (medium)
- Change this week: +1
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `webhook-studio.com`: 65/100 (this document), [markdown](https://verifymcp.io/servers/com-webhook-studio-webhooks/webhook-studio.md), [page](https://verifymcp.io/servers/com-webhook-studio-webhooks/webhook-studio)

## Channel facts

- Endpoint: `https://webhook-studio.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.1.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 17 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 76/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2163 tokens (~127/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http com-webhook-studio-webhooks https://webhook-studio.com/mcp
```

### Codex

```toml
[mcp_servers.com-webhook-studio-webhooks]
url = "https://webhook-studio.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-webhook-studio-webhooks": {
      "type": "remote",
      "url": "https://webhook-studio.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-webhook-studio-webhooks --url https://webhook-studio.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-webhook-studio-webhooks:
    url: "https://webhook-studio.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "com-webhook-studio-webhooks": {
      "type": "http",
      "url": "https://webhook-studio.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 64, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 64, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 64, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 63)

First indexed and scored.

## MCP tools (17)

### `create_bucket` (~136 tokens)

Provision a new webhook endpoint (a "bucket") that captures incoming HTTP requests. Returns its id, public ingest url to point a provider at, inbox_url (the live human view to hand back), and signing secret. Pass external_ref — your own stable name like "acme-api:stripe" — so you can re-find this exact bucket later with list_buckets after losing context.

Input parameters:

- `environment` (string): Deployment environment.
- `external_ref` (string): Your own stable identifier (unique per account) for idempotent re-provisioning and re-finding.
- `name` (string): Human label for the bucket.

### `list_buckets` (~68 tokens)

List your webhook endpoints. Pass external_ref to fetch the specific bucket you created earlier under that name — this is how you re-anchor after losing the conversation, since you never need to have stored the bucket id.

Input parameters:

- `external_ref` (string): Return only the bucket with this exact external_ref.

### `get_bucket` (~33 tokens)

Fetch one webhook endpoint by id, including its url and inbox_url.

Input parameters:

- `bucket_id` (string, required): The endpoint id.

### `delete_bucket` (~30 tokens)

Permanently delete a webhook endpoint and its captured events.

Input parameters:

- `bucket_id` (string, required): The endpoint id.

### `latest_event` (~124 tokens)

Get the single most recent event captured by a bucket, optionally filtered by provider and event type. Returns one event with its headers, body and delivery results — the one-shot answer to "what did Stripe last send me". 404 if nothing matches, so you never index into an empty list.

Input parameters:

- `bucket_id` (string, required): The endpoint id.
- `provider` (string): Filter to a provider attributed at ingest (e.g. stripe, github).
- `type` (string): The provider's own event name, matched exactly (e.g. payment_intent.succeeded).

### `list_events` (~237 tokens)

List events captured by a bucket, newest first, with composable filters: since/until (ISO 8601 or YYYY-MM-DD), provider, type, method, signature_valid, and q (case-insensitive substring over body, content type, method, type and labels). Use cursor for the next page.

Input parameters:

- `bucket_id` (string, required): The endpoint id.
- `cursor` (string): Pagination cursor from a previous response.
- `limit` (number): Max events to return (1–100, default 20).
- `method` (string): HTTP method (GET, POST, ...).
- `provider` (string): Filter to a provider (e.g. stripe, github).
- `q` (string): Case-insensitive substring search over body/content-type/method/type/labels.
- `signature_valid` (boolean): Only events whose signature verification passed/failed.
- `since` (string): Only events at or after this time (ISO 8601 or YYYY-MM-DD).
- `type` (string): The provider's own event name, matched exactly.
- `until` (string): Only events at or before this time.

### `get_event` (~64 tokens)

Fetch one captured event by id with its full headers, body, signature verification result (and failure reason), and every outbound delivery attempt. This is how you find out whether your forward actually reached its target and what came back.

Input parameters:

- `event_id` (string, required): The event id.

### `wait_for_event` (~145 tokens)

Block until the next matching event arrives on a bucket, or until the timeout. Use this to turn "go click Send test webhook in Stripe" into a synchronous step: call it, tell the human to trigger the event, and it returns as soon as one arrives. Filters (provider, type) mean unrelated traffic does not wake it. Returns the event, or nothing if it times out.

Input parameters:

- `bucket_id` (string, required): The endpoint id.
- `provider` (string): Only resolve on an event from this provider.
- `timeout` (number): Seconds to wait (1–55, default 30).
- `type` (string): Only resolve on this event type.

### `replay_event` (~211 tokens)

Re-send a captured event to any URL — the test runner for a handler you just wrote. preserve_headers defaults to true so the original signature header (e.g. Stripe-Signature) arrives intact. If you changed the body or the receiver verifies with a different secret, pass resign_with (the dev's own signing secret) so the payload is re-signed and their verification code passes unmodified. Returns the response status, latency and body.

Input parameters:

- `body` (string): Replacement request body (defaults to the captured body).
- `event_id` (string, required): The event id to replay.
- `headers` (object): Header overrides layered on top of the preserved set.
- `preserve_headers` (boolean): Replay the captured headers verbatim (default true).
- `resign_with` (string): Signing secret to re-sign the payload with (≥16 chars).
- `signature_header` (string): Header name for resign_with (default x-signature).
- `url` (string, required): Destination URL to send it to.

### `forward_bucket` (~155 tokens)

Set up standing forwarding from a bucket to a URL. Pass forward_all:true to forward every event, or condition_tree to forward only matching events (same AND/OR condition grammar the routing engine uses). Creates the destination and routing rule in one call.

Input parameters:

- `bucket_id` (string, required): The endpoint id.
- `condition_tree` (object): A condition tree (AND/OR of field comparisons) to forward only matching events. Mutually exclusive with forward_all.
- `forward_all` (boolean): Forward every event unconditionally.
- `name` (string): Optional label for the destination.
- `rule_name` (string): Optional name for the routing rule when using condition_tree.
- `url` (string, required): Destination URL to forward to.

### `list_deliveries` (~123 tokens)

List outbound delivery attempts for a bucket, newest first, with the full request and response of each. Pass success:false to see only failures — the direct answer to "which of my forwards are broken and why".

Input parameters:

- `bucket_id` (string, required): The endpoint id.
- `cursor` (string): Pagination cursor from a previous response.
- `limit` (number): Max deliveries to return (1–100, default 20).
- `source` (string): Delivery source.
- `success` (boolean): Filter to succeeded (true) or failed (false) deliveries.

### `configure_verification` (~164 tokens)

Turn on HMAC signature verification for a bucket using the provider's own signing secret (e.g. Stripe's whsec_). This is how you finish a "verified webhook" integration end to end. Set secret to the provider secret and hmac_enabled:true in the same call; the signature scheme is auto-detected from the header shape.

Input parameters:

- `bucket_id` (string, required): The endpoint id.
- `header_name` (string): Signature header to read (auto-detected if omitted).
- `hmac_enabled` (boolean): Enable verification.
- `on_failure` (string): What to do with a failed signature.
- `secret` (string): The provider's signing secret (≥16 chars).
- `tolerance_seconds` (number): Max timestamp skew allowed, in seconds.

### `list_schemas` (~101 tokens)

List the payload schemas Webhook Studio has learned from this account's real traffic, optionally filtered by provider and event_type. These outlive the payloads they were learned from, so this answers "what shapes do I know about" even after old events are gone. Start here to discover what you can generate types or diffs for.

Input parameters:

- `event_type` (string): The provider's own event name.
- `provider` (string): Filter to a provider.

### `get_schema` (~79 tokens)

Fetch one learned schema with every field, its type, whether it is optional, and how often it actually appears — the real shape of the payload, derived from what this account received rather than guessed from training data.

Input parameters:

- `schema_id` (string, required): The schema id.
- `version` (string): Version number, or "current" (the default).

### `diff_schema` (~107 tokens)

Compare two versions of a learned schema and get exactly which fields were added, removed or changed type, each flagged as breaking or not. This is the "why did my handler start failing" answer, produced without reading a single payload. from defaults to the version before to.

Input parameters:

- `from` (string): Baseline version number (defaults to the one before "to").
- `schema_id` (string, required): The schema id.
- `to` (string): Target version number, or "current".

### `generate_types` (~175 tokens)

Generate types, a runtime validator, or a full handler from a learned schema — the payoff of the knowledge layer. Everything is derived from the payloads this account ACTUALLY received, with genuinely-optional fields marked optional, instead of a plausible-but-wrong guess from a model's memory of the provider docs. Pass lang for a bare type (typescript / json-schema / zod), or framework (next / express) for a ready-to-paste handler that validates and hands back a fully-typed event.

Input parameters:

- `framework` (string): Return a ready-to-paste handler scaffold instead of a bare type. Overrides lang.
- `lang` (string): Output format for a bare type.
- `schema_id` (string, required): The schema id.
- `version` (string): Version number, or "current" (the default).

### `find_correlation_keys` (~115 tokens)

List the correlation-key candidates for a learned schema — the fields that look like identifiers (e.g. data.object.id), ranked by how consistently they appear. These are the fields to group events by when reconstructing a lifecycle (a Stripe payment_intent across created -> succeeded, a GitHub PR across its events). Derived from real traffic, so it reflects what THIS account actually receives.

Input parameters:

- `schema_id` (string, required): The schema id.
- `version` (string): Version number, or "current" (the default).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-webhook-studio-webhooks/webhook-studio#diagnostics

## Score history

- 2026-08-03: 65
- 2026-08-02: 64
- 2026-08-01: 64
- 2026-07-31: 64
- 2026-07-30: 64
- 2026-07-29: 65
- 2026-07-28: 65
- 2026-07-27: 64
- 2026-07-26: 63

## Links

- Remote endpoint: https://webhook-studio.com/mcp
- Website: https://webhook-studio.com/mcp/setup
- Changelog RSS feed: https://verifymcp.io/servers/com-webhook-studio-webhooks/webhook-studio/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-webhook-studio-webhooks/webhook-studio/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-webhook-studio-webhooks/webhook-studio