Hooklistener

com.hooklistenerPublished by hooklistener.comOfficial publisherv1.0.1Updated Oct 24, 2026

Webhook, email, WebSocket and tunnel testing for AI agents: capture, wait, verify, replay.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Hosted MCP server that lets an AI agent create webhook URLs, wait for and verify incoming requests, and replay them to localhost.

What you can do
Create and manage webhook endpoints, alerts and anomaly checks, and mock response rules and request threads for them. Wait for, list, search, inspect and diagnose captured requests, including retry investigation. Verify signatures (Stripe, GitHub, Slack), validate payloads against JSON Schema, diff requests, and replay or forward them to localhost with edits and re-signing. Save requests as replay cases and suites and run them against an endpoint. Create real-time endpoints (WebSocket, Socket.IO, MQTT, SSE) and wait for or send messages. Create email inboxes and wait for and read messages, plan localhost tunnels, run uptime monitors, and manage secrets and tasks.
When to use it
Useful when an agent is building or debugging integrations that receive webhooks, email or real-time messages and needs a public URL, captured traffic, signature checks and replay against a local server. Also fits testing signup email flows and monitoring endpoint uptime.
Requirements
Remote Streamable HTTP endpoint; nothing to install locally. OAuth 2.1 with PKCE and dynamic client registration, requesting the full_access or read_only scope; a Hooklistener API key can be sent as a Bearer token for clients without OAuth. Works on every plan including Free, and a temporary webhook URL can be created without an account.
Before you install
Full access lets the agent create, edit, delete, replay, forward and send data; request the read_only scope to limit it. Replays and forwards send real webhook traffic, and deletes are two-step with a dry_run preview. The server stores captured traffic, including headers, cookies and bodies, scoped to your organization and hosted in Europe; credentials are masked in results but still pass through the service.

Installation

In SourceWeft

  1. Open Hooklistener in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.hooklistener%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "hooklistener": {
      "type": "http",
      "url": "https://app.hooklistener.com/api/mcp"
    }
  }
}

README

[Hooklistener]

Hooklistener MCP Server

Hosted MCP server that lets AI coding agents test webhooks end to end: create a public webhook URL, wait for the webhook to arrive, verify its signature, and replay it to localhost. The same server also covers email inboxes, WebSocket/Socket.IO/MQTT/SSE endpoints, localhost tunnels and uptime monitors.

  • Endpoint: https://app.hooklistener.com/api/mcp
  • Transport: Streamable HTTP. Nothing to install or run locally.
  • Auth: OAuth 2.1 with PKCE and dynamic client registration. Clients request full_access or read_only. A Hooklistener API key (hklst_…) also works as a Bearer token for clients without OAuth.
  • Tools: 67, in 7 toolsets. A new workspace lists 26 of them (every webhook tool plus the tool that starts each other product); a toolset appears once you use that product. Send x-hooklistener-toolsets: all to list everything.
  • Plans: works on every plan, including Free.

This repository holds the setup instructions and the MCP Registry entry (server.json). The server itself is operated by Hooklistener.

Connect your client

Claude Code

bash
claude mcp add --transport http hooklistener https://app.hooklistener.com/api/mcp

Then run /mcp in Claude Code, select hooklistener and sign in with your browser. Full guide

Codex

bash
codex mcp add hooklistener \  --url https://app.hooklistener.com/api/mcp \  --oauth-resource https://app.hooklistener.com/api/mcpcodex mcp login hooklistener --scopes full_access   # or read_only

Full guide

Cursor

.cursor/mcp.json:

json
{  "mcpServers": {    "hooklistener": { "url": "https://app.hooklistener.com/api/mcp" }  }}

Full guide

VS Code (GitHub Copilot)

.vscode/mcp.json:

json
{  "servers": {    "hooklistener": { "type": "http", "url": "https://app.hooklistener.com/api/mcp" }  }}

Full guide

Claude.ai and Claude Desktop

Customize → Connectors → + → Add custom connector → paste https://app.hooklistener.com/api/mcp → Add → Connect. Full guide

Cline

Cline documents bearer-token headers for remote servers, so use a Hooklistener API key (paid plans, created at Organization Settings → API Keys). In cline_mcp_settings.json:

json
{  "mcpServers": {    "hooklistener": {      "type": "streamableHttp",      "url": "https://app.hooklistener.com/api/mcp",      "headers": { "Authorization": "Bearer hklst_your_api_key" }    }  }}

Agents installing the server for you can follow llms-install.md.

Other clients

Step-by-step guides: ChatGPT · Gemini CLI · Windsurf · Zed · OpenCode · Grok (xAI API)

Any MCP client that supports Streamable HTTP can connect with the endpoint above.

What your agent can do

CategoryExamples
Debug endpointscreate_endpoint, get_endpoint, list_endpoint_anomalies, set_endpoint_alerts
Captured requestswait_for_request, list_requests (list or search), get_request, diagnose_request, investigate_request_retries
Verify, compare and replayverify_request_signature (Stripe, GitHub, Slack), validate_request (JSON Schema), diff_requests, replay_request (replay or forward, edit the body and re-sign)
Mock responsescreate_response_rule, test_response_rules
Request threadsset_thread_rule, list_request_threads
Replay cases and suitessave_request_case, run_endpoint_cases, wait_for_case_run
Real-time endpointscreate_realtime_endpoint (WebSocket, Socket.IO, MQTT, SSE), wait_for_realtime_message, send_realtime_message
Email inboxescreate_inbox, wait_for_email, get_email
Localhost tunnelsplan_tunnel_action, replay_tunnel_capture
Uptime monitorscreate_monitor, get_monitor_status
Secrets and taskscreate_secret, cancel_task

Every tool has a title and read-only/destructive annotations. Full reference: docs.hooklistener.com/mcp/available-tools

Example prompts

  • "Create a Hooklistener endpoint for Stripe, trigger a test checkout, and wait for checkout.session.completed."
  • "Verify that webhook's signature with my Stripe secret, then replay it to http://localhost:3000/webhooks, re-signed."
  • "Create an inbox, sign up with it on staging, and read me the verification code from the email."
  • "Save the last three webhooks as a replay suite and run it against localhost after my fix."

Safety

  • Read-only access: request the read_only scope and the agent can search, wait for, diff, validate and diagnose traffic, but can't create, edit, delete, replay, forward or send anything.
  • Deletes are two-step: preview with dry_run, then confirm.
  • Replays and forwards need an idempotency key, so a retried call never sends a webhook twice.
  • Credentials are masked in tool results: common secrets in headers, cookies, query strings and JSON bodies.
  • Data is scoped to your organization and hosted in Europe.

No account yet?

Agents can create a temporary webhook URL without an account, which the user can claim later. See app.hooklistener.com/llms.txt.

Links

Source: README.md at commit d0b5ef0

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

2
  1. v1.0.1LatestSep 27, 2026
  2. v1.0.0Sep 26, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.