# Webhook.site MCP Server (pypi · webhook-mcp-server)

Capture HTTP, email, and DNS callbacks with webhook.site from MCP clients.

- Trust score: 68/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-19

## Components

- pypi · `webhook-mcp-server`: 68/100 (this document), [markdown](https://verifymcp.io/servers/zebbern-webhook-mcp-server/webhook-mcp-server.md), [page](https://verifymcp.io/servers/zebbern-webhook-mcp-server/webhook-mcp-server)

## Channel facts

- Registry: `pypi`
- Package: `webhook-mcp-server`
- Version: `2.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-19.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it.
  - 2 of 33 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 79/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 2094 tokens (~87/item across 24 items; 24 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 80/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 30% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add zebbern-webhook-mcp-server -- uvx webhook-mcp-server
```

### Codex

```bash
codex mcp add zebbern-webhook-mcp-server -- uvx webhook-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "zebbern-webhook-mcp-server": {
      "type": "local",
      "command": [
        "uvx",
        "webhook-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add zebbern-webhook-mcp-server --command uvx --arg webhook-mcp-server
```

### Hermes

```yaml
mcp_servers:
  zebbern-webhook-mcp-server:
    command: "uvx"
    args: ["webhook-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "zebbern-webhook-mcp-server": {
      "command": "uvx",
      "args": [
        "webhook-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-16 (score 68)

First indexed and scored.

## MCP tools (24)

### `create_webhook` (~105 tokens)

Create a disposable inbox to sign up on a website: HTTP URL, temp email, DNS.

Use this first when the user wants to sign up, receive a verification /
magic-link / password-reset email, catch a webhook callback, or get a
one-off URL. Returns token, url, email ({token}@email.webhook.site),
and dns. Next: give the email or URL to the site, then wait_for_email,
then follow_email_link or use the OTP.

### `create_webhook_with_config` (~110 tokens)

Create a webhook that returns a custom status, body, timeout, CORS, or alias.

Use when the user wants the endpoint to pretend to be an API (404, delay,
JSON body) instead of a default 200. For a normal sign-up inbox, use
create_webhook.

Input parameters:

- `alias`
- `cors`
- `default_content`
- `default_content_type`
- `default_status`
- `expiry`
- `timeout`

### `send_to_webhook` (~74 tokens)

POST JSON to the webhook URL to test that capture works.

Use when the user wants to send a sample payload, not when they are
waiting for a real site or email.

Input parameters:

- `data` (object, required)
- `headers`
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `get_webhook_requests` (~112 tokens)

List captured HTTP, email, or DNS events for a webhook.

Use to inspect what already arrived. Bodies are truncated and HTML is
omitted; use export_webhook_data for the full dump. For the newest item
use get_latest_request. To wait for something new use wait_for_request
or wait_for_email. Filter emails with request_type='email'.

Input parameters:

- `limit` (integer)
- `request_type`
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `search_requests` (~115 tokens)

Search captured events by method, body text, headers, type, or date.

Use when the user asks to find POSTs, a keyword, or only emails/DNS.
Examples: query='method:POST', query='content:verify', request_type='email'.

Input parameters:

- `date_from`
- `date_to`
- `limit` (integer)
- `query`
- `request_type`
- `sorting` (string)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `get_latest_request` (~64 tokens)

Return only the newest captured event (HTTP, email, or DNS).

Use for a quick peek. Prefer wait_for_email after a sign-up, or
get_webhook_requests to see history.

Input parameters:

- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `get_webhook_info` (~57 tokens)

Show webhook settings, expiry, and how many requests it has received.

Use when the user asks if a token is still valid or how it is configured.

Input parameters:

- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `update_webhook` (~84 tokens)

Change how an existing webhook responds (status, body, timeout, CORS).

Use after create_webhook when the user wants a different canned reply.

Input parameters:

- `cors`
- `default_content`
- `default_content_type`
- `default_status`
- `timeout`
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `delete_webhook` (~52 tokens)

Permanently delete a webhook and every captured request/email.

Use when the user is done with a temp inbox or wants to clean up.

Input parameters:

- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `delete_request` (~46 tokens)

Delete one captured HTTP, email, or DNS event by request id.

Input parameters:

- `request_id` (string, required)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `delete_all_requests` (~70 tokens)

Clear captured events on a webhook, optionally by date or search query.

Use to reset an inbox before a new sign-up or test run.

Input parameters:

- `date_from`
- `date_to`
- `query`
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `get_webhook_url` (~74 tokens)

Return https://webhook.site/{token} for an existing webhook.

Use when the user already has a token and needs the HTTP callback URL.
For a new inbox, create_webhook already returns url.

Input parameters:

- `validate` (boolean)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `get_webhook_email` (~99 tokens)

Return the temp inbox to sign up, verify, magic-link, or reset a password.

Address is {token}@email.webhook.site. Use when the user already has a
token. If they do not, call create_webhook first — it also returns
email. After the site sends mail, call wait_for_email.

Input parameters:

- `validate` (boolean)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `get_webhook_dns` (~65 tokens)

Return the DNSHook domain for an existing webhook.

Use for out-of-band DNS callbacks, not for sign-up email. create_webhook
already returns dns.

Input parameters:

- `validate` (boolean)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `wait_for_request` (~124 tokens)

Poll until a new HTTP (or DNS) callback hits the webhook (1-120s).

Use after giving a site the webhook URL. Bodies are truncated and HTML
is omitted; use export_webhook_data for the full dump. For verification
/ magic-link / password-reset mail, use wait_for_email instead. Set
return_existing=true if the request may already be there.

Input parameters:

- `request_type`
- `return_existing` (boolean)
- `timeout_seconds` (integer)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `wait_for_email` (~164 tokens)

Wait for a sign-up, verify, magic-link, or password-reset email (1-120s).

Call this after the user (or you) submitted {token}@email.webhook.site
on a website. Returns subject, a truncated text preview, extracted
confirm / reset / login URLs, and verification_codes (OTP). Next:
follow_email_link, or type the code. HTML is omitted; use
export_webhook_data for the full message. Set return_existing=true if
the email already arrived. If there is no token yet, create_webhook first.

Input parameters:

- `extract_links` (boolean)
- `return_existing` (boolean)
- `timeout_seconds` (integer)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `follow_email_link` (~97 tokens)

Open the verify / magic-link / reset URL from a captured sign-up email.

Use after wait_for_email. Only follows http(s) links already in that
inbox. Returns status, final URL, and a short page preview. For OTP
codes, read verification_codes from wait_for_email instead.

Input parameters:

- `request_id`
- `url`
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `generate_ssrf_payload` (~91 tokens)

Build authorized SSRF callback URLs that ping this webhook.

Use only on systems you are allowed to test — not for sign-up email.
Confirm hits with check_for_callbacks. local_bypass_examples cannot
be confirmed here.

Input parameters:

- `identifier`
- `include_dns` (boolean)
- `include_ip` (boolean)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `check_for_callbacks` (~85 tokens)

See if SSRF, XSS, or canary callbacks arrived in the last N minutes.

Use after generate_ssrf_payload / generate_xss_callback / generate_canary_token.
For a website verification email, use wait_for_email.

Input parameters:

- `identifier`
- `since_minutes` (integer)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `generate_xss_callback` (~78 tokens)

Build authorized XSS payloads that ping this webhook when they run.

Use only on systems you are allowed to test. Confirm with check_for_callbacks.

Input parameters:

- `identifier`
- `include_cookies` (boolean)
- `include_dom` (boolean)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `generate_canary_token` (~93 tokens)

Make a canary URL, DNS name, or email that alerts when someone opens it.

Use to mark your own files or systems. token_type='email' is a tripwire,
not a sign-up inbox — use create_webhook + wait_for_email for that.

Input parameters:

- `identifier`
- `token_type` (string)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `extract_links_from_request` (~99 tokens)

Pull confirm, reset, magic-link, and other URLs from a captured email or HTTP body.

Use after wait_for_email or get_webhook_requests when the user needs
the verification / login / password-reset link or OTP. Defaults to the
latest event. wait_for_email already extracts links and codes.

Input parameters:

- `filter_domain`
- `request_id`
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `send_multiple_requests` (~71 tokens)

POST several sample JSON payloads to the webhook, optionally spaced out.

Use to load-test capture, not to wait for a real site or email.

Input parameters:

- `delay_ms` (integer)
- `payloads` (array, required)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

### `export_webhook_data` (~65 tokens)

Full dump of captured HTTP/email/DNS events, including HTML and untruncated bodies.

Use this when list/wait tools omitted HTML or truncated a body.

Input parameters:

- `limit` (integer)
- `webhook_token` (string, required): Webhook UUID returned by create_webhook

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/zebbern-webhook-mcp-server/webhook-mcp-server#diagnostics

## Score history

- 2026-08-19: 68
- 2026-08-18: 68
- 2026-08-17: 68
- 2026-08-16: 68

## Links

- PyPI project: https://pypi.org/project/webhook-mcp-server/
- Socket report: https://socket.dev/pypi/package/webhook-mcp-server
- Repository: https://github.com/zebbern/webhook-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/zebbern-webhook-mcp-server/webhook-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/zebbern-webhook-mcp-server/webhook-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/zebbern-webhook-mcp-server/webhook-mcp-server