Webhook.site MCP Server

io.github.zebbernPublished by GitHub account zebbernv3.0.0Updated Oct 25, 2026

Capture HTTP, email, and DNS callbacks with webhook.site from MCP clients.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that lets an assistant create webhook.site inboxes and capture HTTP, email and DNS callbacks for testing and debugging.

What you can do
Create, configure, inspect, list and delete webhook.site inboxes with HTTP URLs, temp email addresses and DNS names, and send test requests to them. Read, search, annotate, download attachments from, export and delete captured HTTP, email and DNS events. Wait in real time for incoming requests or emails, hold and answer the next request, and open verification or reset links from captured emails. Generate authorized out-of-band SSRF, XSS and canary payloads and check whether callbacks arrived. With an API key, manage Custom Actions, Schedules, Global Variables, Groups, Queue Profiles, Templates, Databases and team users.
When to use it
Useful when testing webhooks, debugging API callbacks, exercising sign-up and password-reset flows with temporary inboxes, or running authorized security testing that needs out-of-band callbacks.
Requirements
Runs locally over stdio, typically via uvx or pip; needs Python 3.10+ and the listed Python dependencies. Works anonymously on 7-day URLs; an optional WEBHOOK_SITE_API_KEY enables permanent URLs and account tools. Optional environment variables tune expiry, rate-limit waiting, allowed hosts for link following, and proxy or CA settings. Network access to webhook.site is required.
Before you install
Captured requests, emails and DNS lookups pass through the third-party webhook.site service. WEBHOOK_SITE_API_KEY grants account-level access, including team user management with an administrator key, and paid plans have quotas. Many tools delete data permanently, including delete_webhook, delete_request and delete_all_requests. follow_email_link opens links from captured emails and can reach hosts allowed via FOLLOW_EMAIL_LINK_ALLOW_HOSTS. Security payload tools are stated to be for authorized,

Installation

In SourceWeft

  1. Open Webhook.site MCP Server in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Webhook.site MCP Server

[PyPI] [Python] [MCP]

A Model Context Protocol (MCP) server for webhook.site - instantly capture HTTP requests, emails, and DNS lookups. Perfect for testing webhooks, debugging API callbacks, security testing, and bug bounty hunting.

Security helper tools (SSRF, XSS, canary tokens) are for authorized testing only — systems you own or have explicit permission to test.

Table of Contents

Quick Start

Installation

bash
# Using uvx (recommended - no install needed)uvx webhook-mcp-server==3.0.0
# Or install via pippip install webhook-mcp-server==3.0.0

Use 3.0.0 or newer. 2.1.3 does not start on MCP 2.0; 3.0 renames a few tools (see Upgrading from 2.x).

VS Code / GitHub Copilot

Add to .vscode/mcp.json:

json
{  "servers": {    "webhook-mcp-server": {      "type": "stdio",      "command": "uvx",      "args": ["webhook-mcp-server==3.0.0"]    }  }}

Cursor

Add to .cursor/mcp.json (project) or your user MCP config:

json
{  "mcpServers": {    "webhook-mcp-server": {      "command": "uvx",      "args": ["webhook-mcp-server==3.0.0"]    }  }}

Claude Desktop

Add to claude_desktop_config.json:

json
{  "mcpServers": {    "webhook-mcp-server": {      "command": "uvx",      "args": ["webhook-mcp-server==3.0.0"]    }  }}

Configuration

All settings are environment variables on the server process. Put them in the env block of your MCP client config.

VariablePurpose
WEBHOOK_SITE_API_KEYYour webhook.site API key. Makes new URLs permanent (your plan's quota) and unlocks list_webhooks, Custom Actions, Schedules, Global Variables, Groups, Queue Profiles, Templates, Databases, Users and CSV export
WEBHOOK_SITE_DEFAULT_EXPIRYSeconds until new URLs expire when the call does not pass expiry. Unset means permanent on a paid account (7 days for anonymous URLs)
WEBHOOK_MCP_RATE_LIMIT_MAX_WAITWhen webhook.site answers 429 with a Retry-After up to this many seconds (default 15), the call waits and retries once; longer waits are reported as an error naming the wait
FOLLOW_EMAIL_LINK_ALLOW_HOSTSfollow_email_link only opens links to public internet hosts, and connects to the address it checked (no DNS rebinding). To test a sign-up flow on your own machine or intranet, list what to allow: localhost,127.0.0.1,*.corp.example,10.0.0.0/8
HTTPS_PROXY / HTTP_PROXY / NO_PROXYHonoured by follow_email_link. The proxy makes the connection, so the target is checked before the request instead of being pinned
SSL_CERT_FILE / SSL_CERT_DIRCustom CA bundle for follow_email_link, for corporate TLS interception

If the request to a verification link completes and then redirects somewhere that is not allowed (a local dev server, an intranet dashboard), the tool reports that hop's status with the refused target in blocked_redirect instead of failing: the request that consumed the token already went through, whether or not the site counted it as verified.

What Can You Do?

Capture Webhooks

"Create a webhook and show me the URL""What requests have been sent to my webhook?""Wait for a request to come in"
[Webhooks]

Security/Bug Bounty:

"Generate an SSRF payload to test for blind vulnerabilities""Create XSS callback payloads to detect blind XSS attacks""Make me a canary token to detect if someone accesses a URL"
[Security]

Email Automation:

"Create a temp email and wait for a password reset link""Monitor this webhook for emails and extract all links from them""Give me 3 temporary emails at once" (batch creation)
[Email]

API Testing:

"Create a webhook that returns a 404 error with a custom message""Make a webhook with CORS enabled that waits 5 seconds before responding""Send 10 different test requests to a webhook and show me all the captured data""Hold the next request and answer it with a 402 and this JSON body"
[API]

Real-time Monitoring:

"Create a webhook and wait for any HTTP request to arrive""Monitor for DNS lookups to detect if a server is making DNS queries""Search all requests for ones containing 'password' in the body"
[Monitoring]

Data Analysis:

"Export all captured webhook requests to JSON format""Show me statistics on requests received in the last hour""Filter and show only POST requests with specific headers"
[Data]

Automate with your account:

"Add a Custom Action that forwards every request to my staging API""Schedule a health check of https://example.com every 5 minutes and alert on a bad status""Write a WebhookScript that answers with the request's JSON field 'id'"
[Practical]

Canary Tokens

"Create a canary URL to track document access""Generate a DNS canary for the config file""Set up an email tracker pixel"
[CanaryTokens]

Tools Reference

Everything works without an account on anonymous 7-day URLs. With WEBHOOK_SITE_API_KEY set, URLs are permanent and the account tools unlock the features of your plan. Every webhook_token accepts the UUID, an alias, a pasted https://webhook.site/... URL or the inbox address. Full parameters for each tool: docs/TOOLS.md.

31 tools, generated from the server by scripts/gen_tool_docs.py.

Diagnostics
ToolWhat it does
server_statusCheck this server's setup: API key, account reachability, plan, real-time socket, env config.
Webhooks
ToolWhat it does
create_webhookCreate a disposable inbox to sign up on a website: HTTP URL, temp email, DNS.
configure_webhookCreate a webhook with custom settings, or update one (pass webhook_token).
get_webhook_infoShow a webhook's settings, expiry, request count and every address.
get_webhook_emailReturn the temp inbox to sign up, verify, magic-link, or reset a password.
list_webhooksList the webhooks (URLs / inboxes) in the account. Needs WEBHOOK_SITE_API_KEY.
delete_webhookPermanently delete a webhook and every captured request/email.
Requests
ToolWhat it does
send_requestsSend one JSON body (data) or several (payloads) to the webhook URL to test capture.
get_webhook_requestsList captured HTTP, email, or DNS events for a webhook, one page at a time.
search_requestsSearch captured events by method, body text, headers, type, or date.
get_requestReturn one captured event: the newest by default, or request_id.
update_requestAttach a note to a captured request, or set its dynamic response.
download_request_fileDownload an uploaded file or email attachment (base64) by its file_id.
delete_requestDelete one captured HTTP, email, or DNS event by request id.
delete_all_requestsClear captured events on a webhook, optionally by date or search query.
export_webhook_dataFull dump of captured events with HTML and untruncated bodies, as JSON or CSV.
Real-time
ToolWhat it does
wait_for_requestWait until a new HTTP (or DNS) callback hits the webhook (1-120s).
wait_for_emailWait for a sign-up, verify, magic-link, or password-reset email (1-120s).
respond_to_next_requestHold the next request that hits the webhook and answer it with your own status, headers and body.
follow_email_linkOpen the verify / magic-link / reset URL from a captured sign-up email.
Account features (API key)
ToolWhat it does
manage_custom_actionsManage the Custom Actions webhook.site runs on every request or email a token receives.
manage_schedulesManage Schedules: webhook.site calls request_url on an interval (needs API key).
manage_global_variablesManage Global Variables shared by all URLs, usable as $name$ in Custom Actions and Schedules.
manage_groupsManage Groups that organise the account's webhooks (needs API key).
manage_queuesManage Queue Profiles that throttle queued Custom Actions (needs API key).
manage_templatesManage Templates: reusable sets of Custom Actions plus predefined variables (needs API key).
manage_databasesManage webhook.site Databases and run SQL against them (needs API key).
manage_usersManage team users on an Enterprise account (needs an administrator API key).
Security testing
ToolWhat it does
generate_oob_payloadsBuild authorized out-of-band payloads that ping this webhook: SSRF URLs, XSS callbacks, or canary tokens.
check_for_callbacksSee if SSRF, XSS, or canary callbacks arrived in the last N minutes.
extract_links_from_requestPull confirm, reset, magic-link, and other URLs from a captured email or HTTP body.

Upgrading from 2.x

2.x tool3.0 replacement
create_webhook_with_config, update_webhookconfigure_webhook (pass webhook_token to update)
get_webhook_url, get_webhook_dnsfields of get_webhook_info
get_latest_requestget_request
send_to_webhook, send_multiple_requestssend_requests (data or payloads)
generate_ssrf_payload, generate_xss_callback, generate_canary_tokengenerate_oob_payloads (kind=ssrf|xss|canary, canary_type)

Examples

Sign up on a website

  1. create_webhook — get email ({token}@emailhook.site)
  2. Use that address on the site (sign-up, verify, magic link, or password reset)
  3. wait_for_email — receive the message, confirm / login / reset URLs, and any OTP
  4. follow_email_link to open a verify link, or type verification_codes on the site

If you already have a token, get_webhook_email returns the same inbox.

Create a Webhook

json
// Response from create_webhook{  "token": "abc123-def456-...",  "url": "https://webhook.site/abc123-def456-...",  "email": "[email protected]",  "dns": "abc123-def456-....dnshook.site"}

Wait for Password Reset Email

json
// Response from wait_for_email{  "email_received": true,  "subject": "Password Reset Request",  "from": "[email protected]",  "auth_links": ["https://example.com/reset?token=xyz789"],  "verification_codes": ["847291"]}

Poll for new events without paging

json
// get_webhook_requests(webhook_token, since=<next_since from the previous call>){  "requests": [ ... only what arrived after the cursor ... ],  "next_since": 1788472548944304}

SSRF Testing Payload

json
// Response from generate_oob_payloads(kind="ssrf"){  "payloads": {    "http": "https://webhook.site/token?id=ssrf-test",    "dns": "ssrf-test.token.dnshook.site",    "ip_decimal": "http://2130706433/token",    "ip_hex": "http://0x7f000001/token"  }}

Each Webhook Token Provides

EndpointFormatUse Case
HTTP URLhttps://webhook.site/{token}Capture HTTP/HTTPS requests (any sub-path too)
Subdomainhttps://{token}.webhook.siteAlternative URL format
Forced statushttps://webhook.site/{token}/{status}Answer with that status, for retry-logic tests
Email{token}@emailhook.siteCapture incoming emails
DNS{token}.dnshook.siteCapture DNS lookups (every subdomain)

Documentation

PageContents
docs/TOOLS.mdEvery tool with parameters and hints, generated from the server
docs/webhook-site-notes.mdWhat webhook.site actually does, verified live, including where the official docs are wrong
docs/testing.mdThe four test layers, recordings, verification scripts, model evals, account safety
docs/releasing.mdVersion bumps, tagging, the publish workflow
CHANGELOG.mdVersion history

Development

bash
git clone https://github.com/zebbern/webhook-mcp-server.gitcd webhook-mcp-serverpip install -e ".[dev]"pytest -m "not live and not live_auth"     # offline suite incl. replay of recorded live exchangespython server.py                            # run the server on stdio

The offline suite replays real recorded webhook.site exchanges; the live tool check and the live / live_auth tiers hit the real API. Details in docs/testing.md.

Layout: server.py (entry point and lifespan), handlers/tools.py (tool registrations), services/ (one module per API area), utils/ (HTTP client, real-time socket, URL safety, references), scripts/ (live check, generators, verifiers), evals/ (model-in-the-loop prompts).

Requirements

  • Python 3.10+
  • mcp >= 2.0.0
  • httpx >= 0.26.0, httpcore >= 1.0.0, anyio >= 4.0.0
  • python-socketio[asyncio_client] >= 5.11.0 (real-time waiting; the tools fall back to polling without it)

Contributing

Bug reports and PRs are welcome. Keep a PR to one change, add a test whose expectation was checked against the real API (see docs/testing.md), and run python scripts/gen_tool_docs.py after touching a tool.

Credits

This project is not affiliated with or endorsed by webhook.site

Links

Made with ❤️ for the MCP community

Source: README.md at commit 0027ea9

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v3.0.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts