Skip to content

Hookden

by hookden.pages.dev · remote · no sign-in to list tools · v1.3.0 · published by dev.pages.hookden

Webhook capture bins for agents: get a URL, wait for webhooks, set replies, verify signatures.

Final · 1Changes · 3
CompareRegistry entry

7 tools: 1 do something that can't be undone, 3 change things and 3 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http hookden https://hookden.pages.dev/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

7 tools

Can't be undone 1Claude Code: ask
  • send_test_webhookSimulate a webhook delivery into a bin — no external sender or HTTP client needed.No findings

    Why it is in this group

    • The name "send_test_webhook" says "send": a word for sending, and what is sent cannot be taken back.
    Description, as the server wrote it
    Simulate a webhook delivery into a bin — no external sender or HTTP client needed. Seeds one realistic, clearly-labeled sample capture (default: a GitHub push event) and returns it in full, so you can exercise the whole loop (create_bin → send_test_webhook → list_captures / get_capture) entirely from MCP. Pass `example` to pick a provider payload from the /examples library (e.g. "stripe-payment-intent-succeeded", "slack-event-callback", "shopify-order-created"). Sample captures are marked as simulated and never count as real webhook traffic.
Changes things 3Claude Code: ask
  • create_binCreate a new webhook capture bin.No findings

    Why it is in this group

    • The name "create_bin" says "create": a word for a change.
    Description, as the server wrote it
    Create a new webhook capture bin. Returns a public capture_url — point any webhook (Stripe, GitHub, Slack, your own service…) at it and every request sent there (any method, any subpath, headers + raw body) is stored. Then read what arrived with list_captures, get_capture, or wait_for_capture. Anonymous bins keep requests ~24h. No auth needed.
  • set_responseConfigure what a bin replies to webhook senders: HTTP status, content-type, body, custom response headers, optional delay.No findings

    Why it is in this group

    • The name "set_response" says "set": a word for a change.
    Description, as the server wrote it
    Configure what a bin replies to webhook senders: HTTP status, content-type, body, custom response headers, optional delay. Body and header values support {{…}} templates rendered per-request from the INCOMING delivery — {{body.challenge}}, {{query.hub.challenge}}, {{header.x-hook-secret}}, {{hmac_sha256 body.plainToken YOUR_SECRET}} — so a bin can pass provider verification handshakes with zero code: Slack URL verification (body {{body.challenge}}), Zoom CRC (JSON with the hmac_sha256 helper), Meta/WhatsApp GET echo (text/plain {{query.hub.challenge}}), Strava (JSON {"hub.challenge":"{{query.hub.challenge}}"}), Asana (response header X-Hook-Secret: {{header.x-hook-secret}}). Only the fields you pass change; everything else keeps its current value. Works on bins created via create_bin by this same client; the incoming request is still captured in full either way.
  • verify_signatureVerify a webhook signature against a secret — 25 provider-exact schemes plus a generic HMAC mode, the same engine that computes ✓/✗ badges on captures.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Verify a webhook signature against a secret — 25 provider-exact schemes plus a generic HMAC mode, the same engine that computes ✓/✗ badges on captures. Covers HMAC-SHA256 (GitHub, Stripe, Svix/Standard Webhooks, Shopify-style base64, URL-signing Square/HubSpot/Trello…), ECDSA (SendGrid), RSA (Kick) and HMAC-MD5 (Patreon). Pass the scheme, the secret, the delivery's headers, and the BYTE-EXACT raw body (body_base64 for binary). The secret is used only for this one in-memory computation — never stored or logged. No bin needed. If verification fails, the #1 cause is a re-serialized body: point the real webhook at a capture bin (create_bin) to get the true raw bytes first.
Only reads 3Claude Code: allow
  • get_captureGet one captured request in full: method, path, query, every header, and the body.No findings

    Why it is in this group

    • The name "get_capture" says "get": a word for reading.
    Description, as the server wrote it
    Get one captured request in full: method, path, query, every header, and the body. Binary bodies are returned base64-encoded (up to 8KB, with a URL for the raw bytes).
  • list_capturesList requests captured by a bin, oldest first.No findings

    Why it is in this group

    • The name "list_captures" says "list": a word for reading.
    Description, as the server wrote it
    List requests captured by a bin, oldest first. Compact summaries (id, method, path, time, content-type, body size, signature status). Use get_capture for full headers/body. Pass `after` (a capture id) to only see newer captures.
  • wait_for_captureBlock until the next request arrives at a bin (or a timeout passes), then return it in full.No findings

    Why it is in this group

    • The name "wait_for_capture" says "wait": a word for reading.
    Description, as the server wrote it
    Block until the next request arrives at a bin (or a timeout passes), then return it in full. Ideal flow: create_bin → configure the webhook sender → trigger it → wait_for_capture. If `after_id` is omitted, waits for the next capture after "now". Returns timed_out:true instead of erroring when nothing arrives.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.3.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http hookden https://hookden.pages.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__hookden__list_captures",
      "mcp__hookden__get_capture",
      "mcp__hookden__wait_for_capture"
    ],
    "ask": [
      "mcp__hookden__create_bin",
      "mcp__hookden__send_test_webhook",
      "mcp__hookden__set_response",
      "mcp__hookden__verify_signature"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as hookden. Review it before you use it.