# AnyHook (moved) (npm · anyhook-mcp)

Moved to net.anyhook/anyhook. Webhook relay for agents: keyless quickstart, replay, mock.

- Trust score: 66/100 (medium)
- Change this week: +21
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `anyhook-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/gba3124-mcp/anyhook-mcp.md), [page](https://verifymcp.io/servers/gba3124-mcp/anyhook-mcp)

## Channel facts

- Registry: `npm`
- Package: `anyhook-mcp`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 13 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1163 tokens (~96/item across 12 items; 12 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 93/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 80% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add gba3124-mcp -- npx -y anyhook-mcp
```

### Codex

```bash
codex mcp add gba3124-mcp -- npx -y anyhook-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "gba3124-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "anyhook-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add gba3124-mcp --command npx --arg -y --arg anyhook-mcp
```

### Hermes

```yaml
mcp_servers:
  gba3124-mcp:
    command: "npx"
    args: ["-y", "anyhook-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "gba3124-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "anyhook-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 66, +46)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → good
- [functional] First check of Schema quality: unverified
- [functional] Licence: Apache-2.0

### 2026-08-01 (score 20, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 27, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (12)

### `anyhook_mock` (~134 tokens)

Mock a webhook

Generate a webhook request with a valid signature for Stripe, GitHub, or Slack. If targetUrl is provided, the request is POSTed there and the response is returned.

Input parameters:

- `data` (object): Optional fields to deep-merge into the fixture.
- `event` (string, required): Event name (e.g. 'payment_intent.succeeded' for Stripe).
- `provider` (string, required): Webhook provider to simulate.
- `secret` (string): Signing secret. Falls back to a deterministic default per provider.
- `targetUrl` (string): If set, POST the generated request to this URL and return the response.

### `anyhook_verify` (~130 tokens)

Verify a webhook signature

Verify a webhook signature against a secret. Supports 19 providers including stripe, github, shopify, slack, discord, linear, vercel, paddle, hubspot, and paypal.

Input parameters:

- `body` (string, required): Raw request body.
- `headers` (object, required): Request headers as a flat object.
- `provider` (string, required): Provider name (e.g. 'stripe', 'github', 'slack', 'generic').
- `requestUrl` (string): Original request URL (required for Twilio/HubSpot). Defaults to a placeholder.
- `secret` (string, required): Signing secret to verify against.

### `anyhook_providers` (~27 tokens)

List supported providers and event types

List webhook providers AnyHook can mock, along with the event types available for each.

### `anyhook_quickstart` (~105 tokens)

Create a free AnyHook endpoint (no account needed)

Zero-config bootstrap: creates a free ephemeral relay endpoint + API key with no signup. Returns inbound_url (receives webhooks immediately), api_key, and claim_url. This MCP session auto-connects to the new account; remote tools work right after. Endpoint expires in 7 days unless claimed.

Input parameters:

- `destination_url` (string): Optional forwarding destination for the new endpoint.
- `source` (string): Optional provider hint (stripe, github, shopify, ...).

### `anyhook_apps_list` (~65 tokens)

List your AnyHook apps

List apps in your AnyHook account with inbound URLs, sources, and destination URLs.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.

### `anyhook_apps_create` (~121 tokens)

Create a new AnyHook app

Create a new app with a name, provider source, and (optionally) destinations. Returns the inbound URL.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `destinations` (array): Destination URLs that should receive forwarded events.
- `name` (string, required): Human-readable app name.
- `source` (string, required): Provider name (stripe, github, shopify, ...). Used for signature auto-detection.

### `anyhook_replay` (~90 tokens)

Replay an event

Re-send a stored event to its destinations. Replay does NOT consume monthly event quota — safe to call repeatedly while debugging.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `id` (string, required): Event ID to replay. Replay does not consume event quota.

### `anyhook_undelivered` (~85 tokens)

List undelivered events for an app

Show events for the given app that have not successfully reached any destination (failed or still retrying).

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `appSlug` (string, required)
- `limit` (integer)

### `anyhook_replay_failed` (~88 tokens)

Bulk-replay all failed events for an app

Re-send every failed event for the given app slug. Useful after fixing a downstream bug to recover queued work.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `appSlug` (string, required): Bulk-replay every failed event for this app.

### `anyhook_events` (~155 tokens)

List recent webhook events

List webhook events (most recent first). Uses your AnyHook account when connected (via ANYHOOK_API_KEY or anyhook_quickstart), otherwise the local in-memory store.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `appSlug` (string): Filter to a specific app slug (account mode).
- `limit` (integer)
- `source` (string): Filter by provider source (local mode).
- `status` (string): Filter by status. Account mode: queued|success|retrying|failed. Local mode: received|forwarded|failed|retrying.

### `anyhook_inspect` (~82 tokens)

Inspect a specific event

Full detail for one event: source, type, status, delivery summary. Account or local store.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `id` (string, required): Event ID returned by anyhook_events.

### `anyhook_simulate` (~81 tokens)

Simulate an incoming webhook (local only)

Generate a mocked webhook AND insert it into the local memory store, so list/inspect flows can be exercised without a real provider. Not available in remote mode — use anyhook_mock + your real inbound URL there.

Input parameters:

- `data` (object)
- `event` (string, required)
- `provider` (string, required)
- `secret` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/gba3124-mcp/anyhook-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 20
- 2026-07-31: 27
- 2026-07-29: 45
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/anyhook-mcp
- Socket report: https://socket.dev/npm/package/anyhook-mcp
- Repository: https://github.com/gba3124/anyhook-mcp
- Website: https://anyhook.net/
- Changelog RSS feed: https://verifymcp.io/servers/gba3124-mcp/anyhook-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/gba3124-mcp/anyhook-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/gba3124-mcp/anyhook-mcp