io.github.THE-KIPDEV由 GitHub 账号 THE-KIPDEV 发布v0.1.1更新于 Oct 24, 2026
Webhook URLs for AI agents: receive, wait for, replay, sign and verify webhooks (Stripe, GitHub…).
为助手提供公网 webhook 捕获地址，用于接收、查看、重放、签名和校验来自 Stripe、GitHub、Shopify 等服务的 webhook。
Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。
把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。
阅读 https://sourceweft.com/mcp/io.github.THE-KIPDEV%2Fwebhook-toolkit/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。把它添加到你客户端的 mcpServers 配置中。
{
"mcpServers": {
"webhook-toolkit": {
"type": "http",
"url": "https://webhook-toolkit.com/mcp"
}
}
}Receive, forward, sign and verify webhooks from your terminal, your test suite and your AI agent.
One package: a CLI (webhook-toolkit, alias whtk), a typed library and an MCP server, backed by webhook-toolkit.com.
That's it: no account, no config. You get a public URL; paste it into Stripe, GitHub, Shopify or any other sender, and every webhook shows up in your terminal and is re-sent to your local handler:
Every request is also kept in a web inspector (headers, raw body, replay), so nothing is lost when your handler crashes.
A few things worth knowing:
…/r/<token>/stripe?x=1 is forwarded to http://localhost:3000/webhooks/stripe?x=1, so one URL can feed several handlers.host and content-length), so signature checks in your handler pass exactly as in production.--json prints NDJSON (listening, request, forward events) for scripting: whtk listen -f 3000 --json | jq .request.event.NO_COLOR, FORCE_COLOR and are off when output is not a terminal.The verifier replays the usual mistakes (whitespace in the secret, added or stripped trailing newline, CRLF conversion, expired timestamp, and for Twilio: http vs https, port, query string, trailing slash, repeated parameters) and tells you which one matches. The same logic powers the online signature validator.
The library gives your tests a real public URL and a way to wait for what lands on it. It works anonymously; set WEBHOOK_TOOLKIT_KEY in CI for permanent URLs and higher limits.
waitForRequest checks requests that already arrived since the endpoint was created, then long-polls until timeoutMs, so the order of "trigger" and "wait" does not matter. It rejects with a WebhookToolkitError (code: "timeout") when nothing matched.
To test your handler without any network at all, sign the payload locally:
The package is ESM-only. CommonJS test runners work on Node ≥ 20.19 / 22.12 (native
require(esm)); Jest needs its ESM mode.
webhook-toolkit mcp is a Model Context Protocol server. Your coding agent can create a webhook URL, wait for the delivery after triggering it, read the payload, then replay it or send freshly signed events to your localhost handler while it fixes the code.
The API key is optional: everything except list_webhook_urls and explain_webhook_request works anonymously.
Claude Code
Cursor (.cursor/mcp.json), Windsurf (~/.codeium/windsurf/mcp_config.json), Claude Desktop (claude_desktop_config.json)
VS Code (.vscode/mcp.json)
Codex CLI (~/.codex/config.toml)
ChatGPT, Claude.ai and other remote-capable clients: add a custom connector pointing at the hosted server, nothing to install:
(Streamable HTTP, optional Authorization: Bearer whk_….) The hosted server cannot reach your machine, so replaying to localhost and send_signed_webhook need the local server above.
Outputs are compact text plus the key JSON; bodies over 20 KB are truncated with a note pointing to the inspector. To embed the server in your own process: import { createMcpServer } from "webhook-toolkit/mcp".
sign() and verify() run locally with node:crypto: secrets never leave your machine. Signatures are byte-for-byte identical to the webhook-toolkit.com signer, and the tests check them against the providers' published examples (GitHub, Slack, Twilio, Svix).
verify() returns { valid, reason?, message, expected?, received?, timestamp? }. Failure reasons: missing_signature, malformed_signature, missing_timestamp, missing_url, invalid_secret, timestamp_out_of_tolerance (default 300 s, toleranceSeconds: 0 disables), signature_mismatch, secret_whitespace, body_trailing_newline_added, body_trailing_newline_removed, body_line_endings_changed, url_mismatch (Twilio), body_hash_mismatch (Twilio JSON). Comparisons are constant-time.
detectProvider(headers, body) returns { provider, event } from a data-driven table (DETECTION_RULES), for example { provider: "stripe", event: "invoice.paid" } or { provider: "twilio", event: "message.received" }. It knows Stripe, GitHub, GitLab, Bitbucket, Shopify, WooCommerce, Slack, SendGrid, Twilio, Paddle, Svix (Clerk, Resend), GoCardless, PayPal, Discord, Linear, Typeform, Calendly, Square, HubSpot, Zoom, Lemon Squeezy, Coinbase Commerce, Twitch, Mux, Vercel, Netlify, Sentry, Trello, Plaid, Mandrill, Jira, Postmark, Mollie, Adyen, Mailgun and Redsys. Adding one is a table entry plus a test fixture.
listen --forward is free and fine for most webhooks, but the sender receives the capture URL's response, not your app's. When the sender needs your real answer (Slack slash commands, Twilio TwiML, Shopify mandatory responses, OAuth callbacks), use the relay:
Requests to the public URL are proxied over a WebSocket to your machine and your local response (status, headers, body) goes back to the caller. It reconnects with backoff. The relay comes with the 7-day Pass or Pro.
Details and the Business plan: webhook-toolkit.com/pricing. Everything that runs locally (signing, verifying, detection, forwarding) is free and stays free.
listen --forward works the same way and adds a stored inspector, provider/event detection, replay, signing and verification tools, a test-suite API and an MCP server.forwardRequest(request, target) re-sends a captured request from your machine (the same function behind listen --forward and replay). Errors are WebhookToolkitError with status (HTTP status, 0 for network errors), code (unauthorized, upgrade_required, plan_limit, expired, timeout, network_error, …) and upgradeUrl on 402 answers. Everything is typed; types ship with the package.
whtk login stores the key in ~/.config/webhook-toolkit/config.json (or $XDG_CONFIG_HOME/webhook-toolkit/config.json) with mode 600. The same file remembers the last URL used by listen.
A capture URL's token is a capability: anyone holding it can read the requests sent to it. Use an account for anything sensitive; the owner's key is then required to change or delete the URL.
Node.js 18.17 or later. Runtime dependencies: @modelcontextprotocol/sdk and zod (MCP server) and ws (relay).
Issues and pull requests are welcome: see CONTRIBUTING.md. New providers for detection or signing are the easiest place to start.
MIT © 2026 Kipdev. Hosted service: webhook-toolkit.com.
来源：README.md，提交 8923bc8
Create a webhook URL
Create a public HTTPS URL that captures every request sent to it (any method, any sub-path). Use it when you need an endpoint to receive a webhook from a third-party service while building or debugging an integration. Returns the URL to configure in the service and a live inspector link for the human.
nameList my webhook URLs
List the webhook URLs of the account behind the API key (requires an API key).
无需输入参数。
Wait for a webhook
Block until the next request reaches a webhook URL (or the timeout elapses), then return it in full: method, path, headers, body, detected provider and event. Use right after triggering an action that should send a webhook. Call again with `after` set to the last request's createdAt to wait for the following one.
aftertoken必填timeout_secondsList captured requests
List the most recent requests captured by a webhook URL, newest first (summaries; use get_webhook_request for one full request).
limittoken必填Get a captured request
Return one captured request in full (headers, raw body, detected provider/event).
token必填request_id必填Set the HTTP response
Choose what the webhook URL answers to callers (status code, body, content type) — e.g. return 500 to test the sender's retries, or a specific JSON/XML body the service expects.
bodytoken必填statuscontent_typeReplay a captured request
Re-send a captured request (same method, headers and raw body) to a PUBLIC URL and return the target's response. Localhost and private IPs are refused here: for localhost use the CLI (`npx webhook-toolkit replay`) or the local MCP server (`npx webhook-toolkit mcp`).
token必填request_id必填target_url必填Sign a test webhook payload
Build a webhook body with a VALID signature header for a provider, to test a handler's signature verification without triggering a real event. Providers: stripe, github, shopify, slack, twilio, mailgun. Returns the headers, the exact body to send and a ready-to-run curl command.
secret必填payloadprovider必填event_typetarget_urlVerify a webhook signature
Check whether a webhook signature is valid for a raw body and a secret, and diagnose why it fails (wrong secret, whitespace, re-serialized JSON body, expired timestamp, wrong URL for Twilio). Providers: stripe, github, shopify, slack, twilio.
urlsecret必填provider必填raw_body必填signature必填timestampExplain a webhook / write its handler (AI)
AI analysis of a captured request. mode=explain: who sent it, which event, key fields, how to verify the signature, pitfalls. mode=handler: complete receiving code that verifies the signature and handles this event. Included in paid plans; anonymous and free users get 3 trials.
modetoken必填languagerequest_id必填已满足适用检查项的 100%
该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。
npx webhook-toolkit listen --forward http://localhost:3000/webhooks webhook-toolkit · listening
Webhook URL https://webhook-toolkit.com/r/l90c9MKIdo0o Inspector https://webhook-toolkit.com/e/l90c9MKIdo0o Forwarding → http://localhost:3000/webhooks Expires in 7 days (2026-09-25 15:42) Anonymous URL. Run `webhook-toolkit login` to get a permanent one.
Waiting for webhooks. Ctrl+C to stop.
15:42:11 POST /stripe stripe checkout.session.completed 248 B ↳ 200 OK · 3 ms 15:42:11 POST /github github push 269 B ↳ 500 Internal Server Error · 1 ms {"error":"handler crashed: cannot read properties of undefined"}npm i -g webhook-toolkit # or run any command with npx webhook-toolkit …# Prints the headers and a curl command, with a realistic sample eventwhtk sign stripe --secret whsec_… --event checkout.session.completed
# Or send it straight to your handlerwhtk sign github --secret my-secret --file push.json --send http://localhost:3000/api/githubwhtk sign twilio --secret <auth token> --url https://example.com/sms --send 3000whtk verify stripe --secret whsec_test_secret --body-file body.json \ -H "Stripe-Signature: t=1726000000,v1=a530ce3d81556a0eced506e1d1cad777bc55bc1e408e54dd6bfef08e1dde216c"✗ Invalid Stripe signature (body_trailing_newline_added) The signature matches the body without its trailing newline: a newline was appended after signing (proxy, logger, copy-paste). Verify the raw bytes exactly as received. expected t=1726000000,v1=1e0085bf1054f89ac8882e2e5fcbfdf301b1d6445e8ed7a316120cd5dc651ba9 received t=1726000000,v1=a530ce3d81556a0eced506e1d1cad777bc55bc1e408e54dd6bfef08e1dde216c timestamp 1726000000 (738 days ago)import { expect, test } from "vitest";import { WebhookToolkit, verify } from "webhook-toolkit";
const wt = new WebhookToolkit(); // anonymous, or reads WEBHOOK_TOOLKIT_KEY
test("creating an order notifies the customer's webhook", async () => { const endpoint = await wt.createEndpoint({ name: "ci-orders" });
// The app under test sends its outgoing webhooks to the capture URL. await api.post("/settings/webhooks", { url: endpoint.url, secret: "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw" }); await api.post("/orders", { sku: "tshirt", quantity: 2 });
const req = await wt.waitForRequest(endpoint.token, { timeoutMs: 30_000, filter: (r) => JSON.parse(r.body).type === "order.created", });
expect(JSON.parse(req.body).data.quantity).toBe(2); // Your outgoing signatures are correct, too: expect(verify("svix", { secret: "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw", rawBody: req.body, headers: req.headers }).valid).toBe(true);});import { sign } from "webhook-toolkit";
const { headers, body } = sign("stripe", { secret: process.env.STRIPE_WEBHOOK_SECRET!, event: "checkout.session.completed" });const res = await fetch("http://localhost:3000/api/webhooks/stripe", { method: "POST", headers, body });expect(res.status).toBe(200);import { expect, test } from "@playwright/test";import { WebhookToolkit } from "webhook-toolkit";
const wt = new WebhookToolkit();
test("'Send test event' reaches the configured URL", async ({ page }) => { const endpoint = await wt.createEndpoint();
await page.goto("/settings/integrations"); await page.getByLabel("Webhook URL").fill(endpoint.url); await page.getByRole("button", { name: "Save" }).click(); await page.getByRole("button", { name: "Send test event" }).click();
const req = await wt.waitForRequest(endpoint.token, { timeoutMs: 15_000 }); expect(req.method).toBe("POST"); expect(req.headers["content-type"]).toContain("application/json");});claude mcp add webhook-toolkit -- npx -y webhook-toolkit mcp# with a key:claude mcp add webhook-toolkit --env WEBHOOK_TOOLKIT_KEY=whk_… -- npx -y webhook-toolkit mcp{ "mcpServers": { "webhook-toolkit": { "command": "npx", "args": ["-y", "webhook-toolkit", "mcp"], "env": { "WEBHOOK_TOOLKIT_KEY": "whk_…" } } }}{ "inputs": [ { "type": "promptString", "id": "webhook-toolkit-key", "description": "webhook-toolkit.com API key (optional)", "password": true } ], "servers": { "webhook-toolkit": { "type": "stdio", "command": "npx", "args": ["-y", "webhook-toolkit", "mcp"], "env": { "WEBHOOK_TOOLKIT_KEY": "${input:webhook-toolkit-key}" } } }}[mcp_servers.webhook-toolkit]command = "npx"args = ["-y", "webhook-toolkit", "mcp"]env = { WEBHOOK_TOOLKIT_KEY = "whk_…" }https://webhook-toolkit.com/mcpimport { sign, verify } from "webhook-toolkit";
// In an Express handler (use express.raw so the body stays byte-exact)app.post("/webhooks/stripe", express.raw({ type: "*/*" }), (req, res) => { const result = verify("stripe", { secret: process.env.STRIPE_WEBHOOK_SECRET!, rawBody: req.body, headers: req.headers }); if (!result.valid) return res.status(400).send(result.message); // …});whtk login # oncewhtk relay --to 3000 webhook-toolkit relay · live
Public URL https://webhook-toolkit.com/relay/my-app (any sub-path works) Forwarding → http://localhost:3000import { WebhookToolkit, WebhookToolkitError, sign, verify, detectProvider, forwardRequest } from "webhook-toolkit";
const wt = new WebhookToolkit({ apiKey, baseUrl }); // both optional (env: WEBHOOK_TOOLKIT_KEY, WEBHOOK_TOOLKIT_URL)