Openhook
by openhook-dev · remote · no sign-in to list tools · v0.1.0 · published by GitHub user openhook-dev
Webhook, email and DNS inboxes for AI agents to capture callbacks and test integrations.
29 tools: 14 can delete or cancel things, 5 change things and 10 only read.
Scanned Oct 21, 2026
- Deletes or cancels14Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things5Claude Code: ask: see these tools
- Only reads10Claude Code: allow: see these tools
4 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http openhook-inbox https://openhook.dev/mcpFindings
Matches of fixed checks, with the text they matched.
The server marks "download_request_file" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "download_request_file" says "request": a word for a change.
The server marks "extract_links_from_request" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "extract_links_from_request" says "link": a word for a change.
The server marks "generate_oob_payloads" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "generate_oob_payloads" says "generate": a word for a change.
The description mentions "credentials".
What this check looks forMatched text
description: "...ook endpoint and native inbox. Provider credentials are not stored."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
29 tools
Deletes or cancels 14Claude Code: deny
access_hosted_inboxHosted only: issue a private inbox token for an inbox you own.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Hosted only: issue a private inbox token for an inbox you own. Keep the returned token private.
Annotations the server declares
- destructiveHint: true
- openWorldHint: false
- readOnlyHint: false
configure_webhookSet HTTP responses and optional SHA256 HMAC verification, preserving unspecified fields.No findings
Why it is in this group
- The description's first verb is "set": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Set HTTP responses and optional SHA256 HMAC verification, preserving unspecified fields.
Annotations the server declares
- destructiveHint: true
- openWorldHint: false
- readOnlyHint: false
create_webhookCreate an inbox.No findings
Why it is in this group
- The name "create_webhook" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Create an inbox. Save its private token; share only public capture addresses. A hosted Pro account_key creates a persistent owned inbox.
Annotations the server declares
- destructiveHint: true
- openWorldHint: false
- readOnlyHint: false
delete_all_requestsClear stored events, keeping the inbox's addresses and settings.No findings
Why it is in this group
- The name "delete_all_requests" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Clear stored events, keeping the inbox's addresses and settings.
Annotations the server declares
- destructiveHint: true
- openWorldHint: false
- readOnlyHint: false
delete_requestPermanently delete one event belonging to this inbox.No findings
Why it is in this group
- The name "delete_request" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Permanently delete one event belonging to this inbox.
Annotations the server declares
- destructiveHint: true
- openWorldHint: false
- readOnlyHint: false
delete_webhookPermanently delete this inbox and its stored events.No findings
Why it is in this group
- The name "delete_webhook" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Permanently delete this inbox and its stored events.
Annotations the server declares
- destructiveHint: true
- openWorldHint: false
- readOnlyHint: false
register_github_webhookCreate a signed GitHub repository subscription and native inbox.No findings
Why it is in this group
- The description's first verb is "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Create a signed GitHub repository subscription and native inbox. Requires webhook-write permission.
Annotations the server declares
- destructiveHint: true
- openWorldHint: true
- readOnlyHint: false
register_linear_webhookCreate a signed Linear subscription and native inbox.No findings
Why it is in this group
- The description's first verb is "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Create a signed Linear subscription and native inbox. Requires admin scope; optional team filter.
Annotations the server declares
- destructiveHint: true
- openWorldHint: true
- readOnlyHint: false
register_stripe_webhookCreate a signed Stripe webhook endpoint and native inbox.1 finding
Why it is in this group
- The description's first verb is "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...ook endpoint and native inbox. Provider credentials are not stored."
Description, as the server wrote it Create a signed Stripe webhook endpoint and native inbox. Provider credentials are not stored.
Annotations the server declares
- destructiveHint: true
- openWorldHint: true
- readOnlyHint: false
respond_to_next_requestRespond to the next request using ?openhook_wait=1, within its 20-second response window.No findings
Why it is in this group
- The name "respond_to_next_request" says "request": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Respond to the next request using ?openhook_wait=1, within its 20-second response window.
Annotations the server declares
- destructiveHint: true
- openWorldHint: false
- readOnlyHint: false
rotate_webhook_tokenRevoke the old private token and return a new one; capture addresses stay unchanged.No findings
Why it is in this group
- The description's first verb is "revoke": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Revoke the old private token and return a new one; capture addresses stay unchanged.
Annotations the server declares
- destructiveHint: true
- openWorldHint: false
- readOnlyHint: false
send_requestsCreate up to ten marked test HTTP events in this inbox.No findings
Why it is in this group
- The name "send_requests" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Create up to ten marked test HTTP events in this inbox.
Annotations the server declares
- destructiveHint: true
- openWorldHint: false
- readOnlyHint: false
unregister_webhookRemove the registered provider subscription and permanently delete its native inbox and events.No findings
Why it is in this group
- The description's first verb is "remove": a word for removing or ending something.
- The description says "permanently delete".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Remove the registered provider subscription and permanently delete its native inbox and events.
Annotations the server declares
- destructiveHint: true
- openWorldHint: true
- readOnlyHint: false
update_requestAnnotate an event without changing its original captured body.No findings
Why it is in this group
- The name "update_request" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Annotate an event without changing its original captured body.
Annotations the server declares
- destructiveHint: true
- openWorldHint: false
- readOnlyHint: false
Changes things 5Claude Code: ask
check_for_callbacksCheck for callbacks newer than a sequence cursor without waiting.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Check for callbacks newer than a sequence cursor without waiting.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
download_request_fileRetrieve exact captured bytes as base64, including binary bodies or raw MIME.1 finding
Why it is in this group
- The name "download_request_file" says "request": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "download_request_file" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "download_request_file" says "request": a word for a change.
Description, as the server wrote it Retrieve exact captured bytes as base64, including binary bodies or raw MIME.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
export_webhook_dataExport a bounded page of full events; resume with next_since.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Export a bounded page of full events; resume with next_since. Browser export streams the entire inbox.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
extract_links_from_requestExtract HTTP links and verification codes without visiting the URLs.1 finding
Why it is in this group
- The name "extract_links_from_request" says "link": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "extract_links_from_request" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "extract_links_from_request" says "link": a word for a change.
Description, as the server wrote it Extract HTTP links and verification codes without visiting the URLs.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
generate_oob_payloadsRead callback addresses for authorized out-of-band testing.1 finding
Why it is in this group
- The name "generate_oob_payloads" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "generate_oob_payloads" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "generate_oob_payloads" says "generate": a word for a change.
Description, as the server wrote it Read callback addresses for authorized out-of-band testing.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
Only reads 10Claude Code: allow
get_hosted_inboxesHosted only: list your persistent inboxes and usage using a private account agent key.No findings
Why it is in this group
- The name "get_hosted_inboxes" says "get": a word for reading.
Description, as the server wrote it Hosted only: list your persistent inboxes and usage using a private account agent key.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
get_requestRead a complete event; omit request_id to inspect the newest one.No findings
Why it is in this group
- The name "get_request" says "get": a word for reading.
Description, as the server wrote it Read a complete event; omit request_id to inspect the newest one.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
get_webhook_activityRead durable receipt and mutation history with a cursor.No findings
Why it is in this group
- The name "get_webhook_activity" says "get": a word for reading.
Description, as the server wrote it Read durable receipt and mutation history with a cursor. Bodies and secrets are excluded.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
get_webhook_emailRead the email address, available when this deployment runs SMTP.No findings
Why it is in this group
- The name "get_webhook_email" says "get": a word for reading.
Description, as the server wrote it Read the email address, available when this deployment runs SMTP.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
get_webhook_infoRead addresses, expiry, response settings, and retained event count.No findings
Why it is in this group
- The name "get_webhook_info" says "get": a word for reading.
Description, as the server wrote it Read addresses, expiry, response settings, and retained event count.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
get_webhook_requestsRead events with pagination or a durable sequence cursor.No findings
Why it is in this group
- The name "get_webhook_requests" says "get": a word for reading.
Description, as the server wrote it Read events with pagination or a durable sequence cursor.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
search_requestsSearch captured bodies, URLs, and headers for a literal substring.No findings
Why it is in this group
- The name "search_requests" says "search": a word for reading.
Description, as the server wrote it Search captured bodies, URLs, and headers for a literal substring.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
server_statusInspect native storage, retention, and enabled capture transports.No findings
Why it is in this group
- The name "server_status" says "status": a word for reading.
Description, as the server wrote it Inspect native storage, retention, and enabled capture transports.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
wait_for_emailWait for an email received by Openhook's SMTP listener.No findings
Why it is in this group
- The name "wait_for_email" says "wait": a word for reading.
Description, as the server wrote it Wait for an email received by Openhook's SMTP listener.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
wait_for_requestWait up to 120 seconds; pass next_since when reconnecting to avoid missing events.No findings
Why it is in this group
- The name "wait_for_request" says "wait": a word for reading.
Description, as the server wrote it Wait up to 120 seconds; pass next_since when reconnecting to avoid missing events.
Annotations the server declares
- destructiveHint: false
- openWorldHint: false
- readOnlyHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http openhook-inbox https://openhook.dev/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__openhook-inbox__server_status",
"mcp__openhook-inbox__get_hosted_inboxes",
"mcp__openhook-inbox__get_webhook_info",
"mcp__openhook-inbox__get_webhook_email",
"mcp__openhook-inbox__get_webhook_requests",
"mcp__openhook-inbox__get_webhook_activity",
"mcp__openhook-inbox__search_requests",
"mcp__openhook-inbox__get_request",
"mcp__openhook-inbox__wait_for_request",
"mcp__openhook-inbox__wait_for_email"
],
"ask": [
"mcp__openhook-inbox__download_request_file",
"mcp__openhook-inbox__export_webhook_data",
"mcp__openhook-inbox__extract_links_from_request",
"mcp__openhook-inbox__generate_oob_payloads",
"mcp__openhook-inbox__check_for_callbacks"
],
"deny": [
"mcp__openhook-inbox__create_webhook",
"mcp__openhook-inbox__access_hosted_inbox",
"mcp__openhook-inbox__configure_webhook",
"mcp__openhook-inbox__register_github_webhook",
"mcp__openhook-inbox__register_stripe_webhook",
"mcp__openhook-inbox__register_linear_webhook",
"mcp__openhook-inbox__unregister_webhook",
"mcp__openhook-inbox__delete_webhook",
"mcp__openhook-inbox__rotate_webhook_token",
"mcp__openhook-inbox__update_request",
"mcp__openhook-inbox__delete_request",
"mcp__openhook-inbox__delete_all_requests",
"mcp__openhook-inbox__send_requests",
"mcp__openhook-inbox__respond_to_next_request"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as openhook-inbox. Review it before you use it.