# AnyHook (remote · anyhook.net)

A webhook inbox for agents: one call returns a live URL. Mock, verify, inspect and replay.

- Trust score: 67/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `anyhook.net`: 67/100 (this document), [markdown](https://verifymcp.io/servers/net-anyhook-anyhook/anyhook.md), [page](https://verifymcp.io/servers/net-anyhook-anyhook/anyhook)

## Channel facts

- Endpoint: `https://anyhook.net/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.2.2`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 12 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1216 tokens (~101/item across 12 items; 12 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 17/100
  - Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 91% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http net-anyhook-anyhook https://anyhook.net/mcp
```

### Codex

```toml
[mcp_servers.net-anyhook-anyhook]
url = "https://anyhook.net/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "net-anyhook-anyhook": {
      "type": "remote",
      "url": "https://anyhook.net/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add net-anyhook-anyhook --url https://anyhook.net/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  net-anyhook-anyhook:
    url: "https://anyhook.net/mcp"
```

### Other

```json
{
  "mcpServers": {
    "net-anyhook-anyhook": {
      "type": "http",
      "url": "https://anyhook.net/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-01 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 65, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 64, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 63)

First indexed and scored.

## MCP tools (12)

### `anyhook_mock` (~134 tokens)

Mock a webhook

Generate a webhook request with a valid signature for Stripe, GitHub, or Slack. If targetUrl is provided, the request is POSTed there and the response is returned.

Input parameters:

- `data` (object): Optional fields to deep-merge into the fixture.
- `event` (string, required): Event name (e.g. 'payment_intent.succeeded' for Stripe).
- `provider` (string, required): Webhook provider to simulate.
- `secret` (string): Signing secret. Falls back to a deterministic default per provider.
- `targetUrl` (string): If set, POST the generated request to this URL and return the response.

### `anyhook_verify` (~130 tokens)

Verify a webhook signature

Verify a webhook signature against a secret. Supports 19 providers including stripe, github, shopify, slack, discord, linear, vercel, paddle, hubspot, and paypal.

Input parameters:

- `body` (string, required): Raw request body.
- `headers` (object, required): Request headers as a flat object.
- `provider` (string, required): Provider name (e.g. 'stripe', 'github', 'slack', 'generic').
- `requestUrl` (string): Original request URL (required for Twilio/HubSpot). Defaults to a placeholder.
- `secret` (string, required): Signing secret to verify against.

### `anyhook_providers` (~27 tokens)

List supported providers and event types

List webhook providers AnyHook can mock, along with the event types available for each.

### `anyhook_quickstart` (~105 tokens)

Create a free AnyHook endpoint (no account needed)

Zero-config bootstrap: creates a free ephemeral relay endpoint + API key with no signup. Returns inbound_url (receives webhooks immediately), api_key, and claim_url. This MCP session auto-connects to the new account; remote tools work right after. Endpoint expires in 7 days unless claimed.

Input parameters:

- `destination_url` (string): Optional forwarding destination for the new endpoint.
- `source` (string): Optional provider hint (stripe, github, shopify, ...).

### `anyhook_apps_list` (~65 tokens)

List your AnyHook apps

List apps in your AnyHook account with inbound URLs, sources, and destination URLs.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.

### `anyhook_inbox` (~134 tokens)

Get this app's email inbox address

Every AnyHook app is also an email inbox: mail sent to {user}.{app}@anyhook.net becomes an event (type email.received) you can read with anyhook_events. Returns the address and webhook URL for one of your apps. No account yet? anyhook_quickstart returns an inbox_address directly.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `app` (string): App slug (from anyhook_apps_list). Defaults to your first app.

### `anyhook_apps_create` (~121 tokens)

Create a new AnyHook app

Create a new app with a name, provider source, and (optionally) destinations. Returns the inbound URL.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `destinations` (array): Destination URLs that should receive forwarded events.
- `name` (string, required): Human-readable app name.
- `source` (string, required): Provider name (stripe, github, shopify, ...). Used for signature auto-detection.

### `anyhook_replay` (~90 tokens)

Replay an event

Re-send a stored event to its destinations. Replay does NOT consume monthly event quota — safe to call repeatedly while debugging.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `id` (string, required): Event ID to replay. Replay does not consume event quota.

### `anyhook_undelivered` (~85 tokens)

List undelivered events for an app

Show events for the given app that have not successfully reached any destination (failed or still retrying).

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `appSlug` (string, required)
- `limit` (integer)

### `anyhook_replay_failed` (~88 tokens)

Bulk-replay all failed events for an app

Re-send every failed event for the given app slug. Useful after fixing a downstream bug to recover queued work.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `appSlug` (string, required): Bulk-replay every failed event for this app.

### `anyhook_events` (~155 tokens)

List recent webhook events

List webhook events (most recent first). Uses your AnyHook account when connected (via ANYHOOK_API_KEY or anyhook_quickstart), otherwise the local in-memory store.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `appSlug` (string): Filter to a specific app slug (account mode).
- `limit` (integer)
- `source` (string): Filter by provider source (local mode).
- `status` (string): Filter by status. Account mode: queued|success|retrying|failed. Local mode: received|forwarded|failed|retrying.

### `anyhook_inspect` (~82 tokens)

Inspect a specific event

Full detail for one event: source, type, status, delivery summary. Account or local store.

Input parameters:

- `api_key` (string): API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
- `id` (string, required): Event ID returned by anyhook_events.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/net-anyhook-anyhook/anyhook#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 66
- 2026-08-01: 66
- 2026-07-31: 65
- 2026-07-30: 64
- 2026-07-29: 63

## Links

- Remote endpoint: https://anyhook.net/mcp
- Repository: https://github.com/gba3124/anyhook-mcp
- Website: https://anyhook.net/
- Changelog RSS feed: https://verifymcp.io/servers/net-anyhook-anyhook/anyhook/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/net-anyhook-anyhook/anyhook/changelog.json
- HTML version of this page: https://verifymcp.io/servers/net-anyhook-anyhook/anyhook