Webhook.site MCP Server

io.github.zebbern由 GitHub 账号 zebbern 发布v3.0.0更新于 Oct 25, 2026

Capture HTTP, email, and DNS callbacks with webhook.site from MCP clients.

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

本地 MCP 服务器，让助手创建 webhook.site 收件箱并捕获 HTTP、邮件和 DNS 回调，用于测试与调试。

可以做什么
创建、配置、查看、列出和删除 webhook.site 收件箱，获取 HTTP 网址、临时邮箱和 DNS 名称，并向其发送测试请求。读取、搜索、添加备注、下载附件、导出和删除已捕获的 HTTP、邮件与 DNS 事件。实时等待新请求或邮件，暂扣并自定义响应下一个请求，打开捕获邮件中的验证或重置链接。生成经授权的带外 SSRF、XSS 和 canary 载荷并检查回调是否到达。配置 API 密钥后可管理 Custom Actions、Schedules、Global Variables、Groups、Queue Profiles、Templates、Databases 和团队用户。
适用场景
适合测试 webhook、调试 API 回调、用临时邮箱走通注册与密码重置流程，或进行需要带外回调的经授权安全测试。
运行要求
以 stdio 在本地运行，通常通过 uvx 或 pip 安装；需要 Python 3.10+ 及所列 Python 依赖。匿名使用可获得 7 天有效的网址；可选的 WEBHOOK_SITE_API_KEY 可启用永久网址和账户工具。可选环境变量可调整过期时间、限流等待、链接跳转允许的主机以及代理或 CA 设置。需要能访问 webhook.site 的网络。
安装前请注意
捕获的请求、邮件和 DNS 查询都会经过第三方服务 webhook.site。WEBHOOK_SITE_API_KEY 提供账户级访问权限，使用管理员密钥时还可管理团队用户，付费方案有配额限制。多个工具会永久删除数据，包括 delete_webhook、delete_request 和 delete_all_requests。follow_email_link 会打开捕获邮件中的链接，并可能访问通过 FOLLOW_EMAIL_LINK_ALLOW_HOSTS 放行的主机。安全载荷工具声明仅限经授权的测试使用。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Webhook.site MCP Server，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

Webhook.site MCP Server

[PyPI] [Python] [MCP]

A Model Context Protocol (MCP) server for webhook.site - instantly capture HTTP requests, emails, and DNS lookups. Perfect for testing webhooks, debugging API callbacks, security testing, and bug bounty hunting.

Security helper tools (SSRF, XSS, canary tokens) are for authorized testing only — systems you own or have explicit permission to test.

Table of Contents

Quick Start

Installation

bash
# Using uvx (recommended - no install needed)uvx webhook-mcp-server==3.0.0
# Or install via pippip install webhook-mcp-server==3.0.0

Use 3.0.0 or newer. 2.1.3 does not start on MCP 2.0; 3.0 renames a few tools (see Upgrading from 2.x).

VS Code / GitHub Copilot

Add to .vscode/mcp.json:

json
{  "servers": {    "webhook-mcp-server": {      "type": "stdio",      "command": "uvx",      "args": ["webhook-mcp-server==3.0.0"]    }  }}

Cursor

Add to .cursor/mcp.json (project) or your user MCP config:

json
{  "mcpServers": {    "webhook-mcp-server": {      "command": "uvx",      "args": ["webhook-mcp-server==3.0.0"]    }  }}

Claude Desktop

Add to claude_desktop_config.json:

json
{  "mcpServers": {    "webhook-mcp-server": {      "command": "uvx",      "args": ["webhook-mcp-server==3.0.0"]    }  }}

Configuration

All settings are environment variables on the server process. Put them in the env block of your MCP client config.

VariablePurpose
WEBHOOK_SITE_API_KEYYour webhook.site API key. Makes new URLs permanent (your plan's quota) and unlocks list_webhooks, Custom Actions, Schedules, Global Variables, Groups, Queue Profiles, Templates, Databases, Users and CSV export
WEBHOOK_SITE_DEFAULT_EXPIRYSeconds until new URLs expire when the call does not pass expiry. Unset means permanent on a paid account (7 days for anonymous URLs)
WEBHOOK_MCP_RATE_LIMIT_MAX_WAITWhen webhook.site answers 429 with a Retry-After up to this many seconds (default 15), the call waits and retries once; longer waits are reported as an error naming the wait
FOLLOW_EMAIL_LINK_ALLOW_HOSTSfollow_email_link only opens links to public internet hosts, and connects to the address it checked (no DNS rebinding). To test a sign-up flow on your own machine or intranet, list what to allow: localhost,127.0.0.1,*.corp.example,10.0.0.0/8
HTTPS_PROXY / HTTP_PROXY / NO_PROXYHonoured by follow_email_link. The proxy makes the connection, so the target is checked before the request instead of being pinned
SSL_CERT_FILE / SSL_CERT_DIRCustom CA bundle for follow_email_link, for corporate TLS interception

If the request to a verification link completes and then redirects somewhere that is not allowed (a local dev server, an intranet dashboard), the tool reports that hop's status with the refused target in blocked_redirect instead of failing: the request that consumed the token already went through, whether or not the site counted it as verified.

What Can You Do?

Capture Webhooks

"Create a webhook and show me the URL""What requests have been sent to my webhook?""Wait for a request to come in"
[Webhooks]

Security/Bug Bounty:

"Generate an SSRF payload to test for blind vulnerabilities""Create XSS callback payloads to detect blind XSS attacks""Make me a canary token to detect if someone accesses a URL"
[Security]

Email Automation:

"Create a temp email and wait for a password reset link""Monitor this webhook for emails and extract all links from them""Give me 3 temporary emails at once" (batch creation)
[Email]

API Testing:

"Create a webhook that returns a 404 error with a custom message""Make a webhook with CORS enabled that waits 5 seconds before responding""Send 10 different test requests to a webhook and show me all the captured data""Hold the next request and answer it with a 402 and this JSON body"
[API]

Real-time Monitoring:

"Create a webhook and wait for any HTTP request to arrive""Monitor for DNS lookups to detect if a server is making DNS queries""Search all requests for ones containing 'password' in the body"
[Monitoring]

Data Analysis:

"Export all captured webhook requests to JSON format""Show me statistics on requests received in the last hour""Filter and show only POST requests with specific headers"
[Data]

Automate with your account:

"Add a Custom Action that forwards every request to my staging API""Schedule a health check of https://example.com every 5 minutes and alert on a bad status""Write a WebhookScript that answers with the request's JSON field 'id'"
[Practical]

Canary Tokens

"Create a canary URL to track document access""Generate a DNS canary for the config file""Set up an email tracker pixel"
[CanaryTokens]

Tools Reference

Everything works without an account on anonymous 7-day URLs. With WEBHOOK_SITE_API_KEY set, URLs are permanent and the account tools unlock the features of your plan. Every webhook_token accepts the UUID, an alias, a pasted https://webhook.site/... URL or the inbox address. Full parameters for each tool: docs/TOOLS.md.

31 tools, generated from the server by scripts/gen_tool_docs.py.

Diagnostics
ToolWhat it does
server_statusCheck this server's setup: API key, account reachability, plan, real-time socket, env config.
Webhooks
ToolWhat it does
create_webhookCreate a disposable inbox to sign up on a website: HTTP URL, temp email, DNS.
configure_webhookCreate a webhook with custom settings, or update one (pass webhook_token).
get_webhook_infoShow a webhook's settings, expiry, request count and every address.
get_webhook_emailReturn the temp inbox to sign up, verify, magic-link, or reset a password.
list_webhooksList the webhooks (URLs / inboxes) in the account. Needs WEBHOOK_SITE_API_KEY.
delete_webhookPermanently delete a webhook and every captured request/email.
Requests
ToolWhat it does
send_requestsSend one JSON body (data) or several (payloads) to the webhook URL to test capture.
get_webhook_requestsList captured HTTP, email, or DNS events for a webhook, one page at a time.
search_requestsSearch captured events by method, body text, headers, type, or date.
get_requestReturn one captured event: the newest by default, or request_id.
update_requestAttach a note to a captured request, or set its dynamic response.
download_request_fileDownload an uploaded file or email attachment (base64) by its file_id.
delete_requestDelete one captured HTTP, email, or DNS event by request id.
delete_all_requestsClear captured events on a webhook, optionally by date or search query.
export_webhook_dataFull dump of captured events with HTML and untruncated bodies, as JSON or CSV.
Real-time
ToolWhat it does
wait_for_requestWait until a new HTTP (or DNS) callback hits the webhook (1-120s).
wait_for_emailWait for a sign-up, verify, magic-link, or password-reset email (1-120s).
respond_to_next_requestHold the next request that hits the webhook and answer it with your own status, headers and body.
follow_email_linkOpen the verify / magic-link / reset URL from a captured sign-up email.
Account features (API key)
ToolWhat it does
manage_custom_actionsManage the Custom Actions webhook.site runs on every request or email a token receives.
manage_schedulesManage Schedules: webhook.site calls request_url on an interval (needs API key).
manage_global_variablesManage Global Variables shared by all URLs, usable as $name$ in Custom Actions and Schedules.
manage_groupsManage Groups that organise the account's webhooks (needs API key).
manage_queuesManage Queue Profiles that throttle queued Custom Actions (needs API key).
manage_templatesManage Templates: reusable sets of Custom Actions plus predefined variables (needs API key).
manage_databasesManage webhook.site Databases and run SQL against them (needs API key).
manage_usersManage team users on an Enterprise account (needs an administrator API key).
Security testing
ToolWhat it does
generate_oob_payloadsBuild authorized out-of-band payloads that ping this webhook: SSRF URLs, XSS callbacks, or canary tokens.
check_for_callbacksSee if SSRF, XSS, or canary callbacks arrived in the last N minutes.
extract_links_from_requestPull confirm, reset, magic-link, and other URLs from a captured email or HTTP body.

Upgrading from 2.x

2.x tool3.0 replacement
create_webhook_with_config, update_webhookconfigure_webhook (pass webhook_token to update)
get_webhook_url, get_webhook_dnsfields of get_webhook_info
get_latest_requestget_request
send_to_webhook, send_multiple_requestssend_requests (data or payloads)
generate_ssrf_payload, generate_xss_callback, generate_canary_tokengenerate_oob_payloads (kind=ssrf|xss|canary, canary_type)

Examples

Sign up on a website

  1. create_webhook — get email ({token}@emailhook.site)
  2. Use that address on the site (sign-up, verify, magic link, or password reset)
  3. wait_for_email — receive the message, confirm / login / reset URLs, and any OTP
  4. follow_email_link to open a verify link, or type verification_codes on the site

If you already have a token, get_webhook_email returns the same inbox.

Create a Webhook

json
// Response from create_webhook{  "token": "abc123-def456-...",  "url": "https://webhook.site/abc123-def456-...",  "email": "[email protected]",  "dns": "abc123-def456-....dnshook.site"}

Wait for Password Reset Email

json
// Response from wait_for_email{  "email_received": true,  "subject": "Password Reset Request",  "from": "[email protected]",  "auth_links": ["https://example.com/reset?token=xyz789"],  "verification_codes": ["847291"]}

Poll for new events without paging

json
// get_webhook_requests(webhook_token, since=<next_since from the previous call>){  "requests": [ ... only what arrived after the cursor ... ],  "next_since": 1788472548944304}

SSRF Testing Payload

json
// Response from generate_oob_payloads(kind="ssrf"){  "payloads": {    "http": "https://webhook.site/token?id=ssrf-test",    "dns": "ssrf-test.token.dnshook.site",    "ip_decimal": "http://2130706433/token",    "ip_hex": "http://0x7f000001/token"  }}

Each Webhook Token Provides

EndpointFormatUse Case
HTTP URLhttps://webhook.site/{token}Capture HTTP/HTTPS requests (any sub-path too)
Subdomainhttps://{token}.webhook.siteAlternative URL format
Forced statushttps://webhook.site/{token}/{status}Answer with that status, for retry-logic tests
Email{token}@emailhook.siteCapture incoming emails
DNS{token}.dnshook.siteCapture DNS lookups (every subdomain)

Documentation

PageContents
docs/TOOLS.mdEvery tool with parameters and hints, generated from the server
docs/webhook-site-notes.mdWhat webhook.site actually does, verified live, including where the official docs are wrong
docs/testing.mdThe four test layers, recordings, verification scripts, model evals, account safety
docs/releasing.mdVersion bumps, tagging, the publish workflow
CHANGELOG.mdVersion history

Development

bash
git clone https://github.com/zebbern/webhook-mcp-server.gitcd webhook-mcp-serverpip install -e ".[dev]"pytest -m "not live and not live_auth"     # offline suite incl. replay of recorded live exchangespython server.py                            # run the server on stdio

The offline suite replays real recorded webhook.site exchanges; the live tool check and the live / live_auth tiers hit the real API. Details in docs/testing.md.

Layout: server.py (entry point and lifespan), handlers/tools.py (tool registrations), services/ (one module per API area), utils/ (HTTP client, real-time socket, URL safety, references), scripts/ (live check, generators, verifiers), evals/ (model-in-the-loop prompts).

Requirements

  • Python 3.10+
  • mcp >= 2.0.0
  • httpx >= 0.26.0, httpcore >= 1.0.0, anyio >= 4.0.0
  • python-socketio[asyncio_client] >= 5.11.0 (real-time waiting; the tools fall back to polling without it)

Contributing

Bug reports and PRs are welcome. Keep a PR to one change, add a test whose expectation was checked against the real API (see docs/testing.md), and run python scripts/gen_tool_docs.py after touching a tool.

Credits

This project is not affiliated with or endorsed by webhook.site

Links

Made with ❤️ for the MCP community

来源：README.md，提交 0027ea9

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v3.0.0最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分