AnyHook

net.anyhook由 anyhook.net 发布官方发布者v0.5.0更新于 Nov 4, 2026

A webhook inbox for agents: one call returns a live URL. Mock, verify, inspect and replay.

已验证Streamable HTTP可网页运行开发者工具安全与监控

概览

AI 生成的概览

AnyHook 为助手提供 webhook 收件箱:创建带公网入站地址的应用、查看与重放事件、生成并校验签名载荷。

可以做什么
  • 创建和列出 webhook 应用,查看入站地址、来源与目标地址
  • 列出、查看并排查事件,包括未送达和失败的事件,并重放单条或批量失败事件
  • 生成 Stripe、GitHub、Slack 的签名载荷,并用密钥校验收到的签名
  • 部署、测试并读取在沙箱中运行的处理器代码,可按事件或定时触发
  • 查看套餐限额与用量,获取应用的邮件收件地址
适用场景
适合助手编写或调试 webhook 集成时查看真实投递、复现签名失败,或在不自建服务器的情况下获得接收地址。本地开发时生成签名测试载荷也很方便。
运行要求
可作为托管端点 anyhook.net/mcp 使用(浏览器登录或 Bearer API 密钥),也可通过 npx anyhook-mcp 本地运行,需要 Node 22 或更高版本。远程模式需要 ANYHOOK_API_KEY;未设置时本地仅提供 mock、verify、providers 工具和内存存储,quickstart 工具可自助开通临时端点。自建部署可用 ANYHOOK_API_BASE 覆盖 API 地址。
安装前请注意
API 密钥(ANYHOOK_API_KEY)可访问账户下的应用和事件载荷。anyhook_connect 需要提供 Stripe 或 GitHub 密钥以在服务商处注册 webhook。事件载荷常含个人数据,重放会再次执行目标处理器,可能重复产生写入和副作用。重放和代码运行会消耗套餐配额与计算额度,未认领的 quickstart 端点会过期。

安装

在 SourceWeft 中

  1. 打开 控制台中的 AnyHook,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable,通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体,或 SourceWeft 对话中。智能体会读取该服务器的安装指南,先向你展示发布者、端点和登录方式,经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/net.anyhook%2Fanyhook/install.md,并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前,先告诉我它的发布者、端点和登录方式,等我确认。不要把 API 密钥写进命令或我会提交的文件;问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "anyhook": {
      "type": "http",
      "url": "https://anyhook.net/mcp"
    }
  }
}

README

anyhook-mcp

An MCP server that gives AI agents eyes on webhooks, inspect events, replay deliveries, mock signed payloads, create apps. Designed for the 45-second AI handler workflow.

Apache 2.0 · npm i -g anyhook-mcp


Forward webhooks to localhost

A public webhook URL that forwards to your machine, with no account:

bash
npx -y anyhook-mcp listen 3000
text
Webhook URL   https://in.anyhook.net/q-3fa9c1d2/listenForwards to   http://localhost:3000/
This URL is temporary and lasts until Nov 11. To keep it: https://anyhook.net/claim/...
Paste the URL into Stripe, GitHub or any webhook sender. Ctrl-C to stop.While this is stopped, events are logged but not forwarded.
Connected. Waiting for events.12:00:03  200  41 ms  invoice.paid12:00:19  500  12 ms  invoice.paid  AnyHook retries on its schedule
  • The URL stays. Restart the command and it is the same URL, so there is nothing to paste into the provider again.
  • Signatures verify. Your server gets the bytes the provider sent, so stripe.webhooks.constructEvent and friends work as they do in production.
  • Nothing is lost when your laptop is shut. Events are stored either way. A failed delivery is retried, and one that arrived while this was stopped can be replayed.

listen 3000/api/webhooks sets the path. With ANYHOOK_API_KEY set it uses that account, and --app <slug> picks the app. Needs Node 22 or newer.

It is for webhooks, not a general tunnel. The sender gets its answer from AnyHook, so your server's response goes to the event log rather than back to the sender. To expose a whole site, use ngrok or Cloudflare Tunnel.

Already have an AnyHook account?

Connect the hosted endpoint instead of running anything: add https://anyhook.net/mcp to Claude Code, claude.ai, Codex or VS Code and sign in through the browser, no key to copy. Steps for each app: https://anyhook.net/mcp.

No account yet (local mode)

No API key needed to start:

bash
claude mcp add anyhook -- npx -y anyhook-mcp

Then ask your agent to run anyhook_quickstart, it creates a free relay endpoint + API key instantly (no signup), and this MCP session auto-connects. All account tools (events, replay, apps) work immediately. The response includes a claim_url to keep the endpoint permanently; unclaimed, it expires in 7 days. It is a new endpoint, not an account you already have.

What it does

Drop this MCP server into Claude Desktop / Cursor / Claude Code and your agent can:

  • anyhook_apps_list, see every app in your AnyHook account with its inbound URL
  • anyhook_apps_create, spin up a new app from a prompt
  • anyhook_connect, give a Stripe key or GitHub token: the webhook is registered at the provider and signature-checked from the first event (the key is not stored)
  • anyhook_events, list recent events, filter by app / status
  • anyhook_inspect, pull a single event's headers, body, signature status
  • anyhook_replay, re-send a stored event to its destinations (outside the monthly quota, within a daily replay limit and the compute allowance; an event held for quota counts as new)
  • anyhook_undelivered, list events that never reached a destination
  • anyhook_usage, the plan's limits and what the account has used of each, with when they reset
  • anyhook_replay_failed, bulk-replay an app's failed events, oldest first (the last 24 hours and 50 per call by default, up to 100), saying when more are waiting
  • anyhook_mock, generate a signed Stripe / GitHub / Slack payload for local handler testing
  • anyhook_verify, verify any incoming signature against your secret
  • anyhook_providers, list every webhook provider AnyHook supports

The inbound URL an app gives you accepts webhook POSTs and also answers provider setup handshakes automatically: Meta's GET carrying hub.mode=subscribe gets its hub.challenge echoed back, even before the app is configured, so the URL can be registered in the Meta App Dashboard first and wired up after.

Two modes:

ModeWhenWhat works
remoteANYHOOK_API_KEY is setAll tools above, live against your AnyHook account
localNo API keyProvider toolkit (mock / verify / providers) + an in-memory store you can simulate events into. Useful for trying it out before signing up.

Quick start

bash
npm install -g anyhook-mcp# or run without installingnpx -y anyhook-mcp

Get an API key from https://anyhook.net/dashboard/settings. Keys start with ahk_live_.


Install in Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "anyhook": {      "command": "npx",      "args": ["-y", "anyhook-mcp"],      "env": {        "ANYHOOK_API_KEY": "ahk_live_xxxxxxxx"      }    }  }}

Restart Claude Desktop. The tools appear under the hammer icon.


Install in Cursor

Open Settings → MCP → Add new MCP server. Or edit ~/.cursor/mcp.json:

json
{  "mcpServers": {    "anyhook": {      "command": "npx",      "args": ["-y", "anyhook-mcp"],      "env": {        "ANYHOOK_API_KEY": "ahk_live_xxxxxxxx"      }    }  }}

Install in Claude Code

bash
claude mcp add anyhook -e ANYHOOK_API_KEY=ahk_live_xxxxxxxx -- npx -y anyhook-mcp

Or add the same mcpServers entry to your project's .mcp.json.


Remote endpoint (no local process)

The same server is hosted at https://anyhook.net/mcp (streamable HTTP, stateless). Claude Code, claude.ai, Codex and VS Code sign in through the browser (OAuth), no key to copy: https://anyhook.net/mcp has the steps for each. Any other client sends Authorization: Bearer ahk_live_... with a key from the dashboard:

json
{ "mcpServers": { "anyhook": { "url": "https://anyhook.net/mcp", "headers": { "Authorization": "Bearer ahk_live_..." } } } }

The endpoint has no anyhook_quickstart: that tool exists only in local mode.


Local-only mode (no account needed)

Skip the env var:

json
{  "mcpServers": {    "anyhook": {      "command": "npx",      "args": ["-y", "anyhook-mcp"]    }  }}

The agent gets anyhook_mock, anyhook_verify, anyhook_providers, anyhook_simulate, anyhook_events (against memory store), and anyhook_inspect (against memory store). Useful for "generate me a signed Stripe payment_intent.succeeded and POST it to localhost:3000" flows during local dev.


Example conversations

Triage a failing endpoint:

"Show me undelivered events for the stripe-prod app from the last hour, then replay them."

The agent calls anyhook_undelivered then anyhook_replay for each, surfacing the responses inline.

Create an app for a new integration:

"Make a new AnyHook app called replicate-video-jobs, source generic, point it at https://my-app.vercel.app/api/replicate-callback."

Calls anyhook_apps_create, returns the inbound URL you paste into Replicate.

Sanity-check a signature failure:

"Here's an inbound payload from Stripe that AnyHook is rejecting. Verify the signature manually with secret whsec_xxx."

Calls anyhook_verify with the supplied headers + body + secret, returns valid: false plus the failure reason.

Mock a webhook for local testing:

"Generate a Stripe payment_intent.succeeded event and POST it to http://localhost:3000/api/webhooks/stripe."

Calls anyhook_mock with targetUrl set; returns the request that was sent + your handler's response.


Environment variables

VarRequiredDefaultPurpose
ANYHOOK_API_KEYfor remote mode-ahk_live_* from https://anyhook.net/dashboard/settings
ANYHOOK_API_BASEnohttps://anyhook.netOverride for self-hosted AnyHook deployments

Why this is interesting

AI agents have been blind to their own webhook infrastructure. They can write the integration code, but once an event misbehaves in production they can't see it, you tell them what happened. With this MCP server, Claude / Cursor can read the actual event log, replay deliveries, debug signature failures, and even spin up new apps. It closes the loop between writing webhook code and operating it.


License

Apache-2.0 © AnyHook

来源:packages/mcp/README.md,提交 3f0252c

工具

16

anyhook_mock

Mock a webhook

Generate a webhook request with a valid signature for Stripe, GitHub, or Slack. If targetUrl is provided, the request is POSTed there and the response is returned.

输入参数dataevent必填secretprovider必填targetUrl

anyhook_verify

Verify a webhook signature

Verify a webhook signature against a secret, for every source the AnyHook edge verifies, including stripe, github, shopify, slack, line, discord, linear, vercel, paddle, hubspot, paypal and xero.

输入参数body必填secret必填headers必填provider必填requestUrl

anyhook_providers

List supported providers and event types

List webhook providers AnyHook can mock, along with the event types available for each.

无需输入参数。

anyhook_apps_list

List your AnyHook apps

List apps in your AnyHook account with inbound URLs, sources, and destination URLs. Check isActive: an inactive app's inbound URL answers setup handshakes but acknowledges and discards event POSTs (202, reason app_inactive) instead of relaying them. Destination signing secrets are redacted to has_signing_secret plus a 4-char hint; a new secret in plaintext comes only from rotating it. An app whose slug was changed lists its former URLs under legacyInboundUrls; those still route to it.

无需输入参数。

anyhook_inbox

Get this app's email inbox address

Every AnyHook app is also an email inbox: mail sent to {user}.{app}@anyhook.net becomes an event (type email.received) you can read with anyhook_events. Returns the address and webhook URL for one of your apps.

输入参数app

anyhook_apps_create

Create a new AnyHook app

Create a new app with a name, provider source, and (optionally) destinations. Returns the inbound URL. The app is active immediately. Created WITHOUT destinations it still receives and LOGS every event (inspect-only), it just delivers nowhere until a destination is added (PATCH /api/v1/apps/{slug} with {"destinations": [...]}).

输入参数name必填source必填destinations

anyhook_connect

Connect Stripe or GitHub with one key

Wire a provider to AnyHook in one call: give a Stripe or GitHub key and AnyHook registers the app's inbound URL as a webhook at the provider, saves the signing secret it yields, and turns on signature verification at the edge. The provider is read from the key; the key is used once and not stored. Without appSlug a new app is created (and removed again if the provider refuses the key). Re-running replaces the registration instead of duplicating it. GitHub sends a signed ping immediately, so the first event appears within seconds. Add a destination afterwards (PATCH /api/v1/apps/{slug}) to forward events; until then they are received and logged.

输入参数targetappSlugprovider_key必填

anyhook_replay

Replay an event

Re-send a stored event to its destinations. Replays sit outside the monthly event quota but within a daily replay limit per plan and the monthly compute allowance (anyhook_usage), and replaying an event that was held for quota bills it as a new event. The destination does run its handler again: a receiver that is not idempotent will process the event twice while debugging.

输入参数id必填

anyhook_undelivered

List undelivered events for an app

Show events for the given app that have not successfully reached any destination (failed or still retrying).

输入参数limitappSlug必填

anyhook_replay_failed

Bulk-replay an app's failed events

Re-send an app's failed events after the destination is fixed, oldest first: by default those received in the last 24 hours, at most 50 per call (since and limit change both; limit goes up to 100). Events held by an open circuit are included. An event replayed once is not selected again, so a second call continues with the rest. The result lists what was replayed, what was skipped and why, and more: true while failed events are still waiting. Replays count against the plan's daily replay limit.

输入参数limitsinceappSlug必填

anyhook_code_get

Read an app's code handler

The code that runs on this app's events: its source, the names of its secrets (never the values), whether events are reaching it, and runs used this month against the plan's limit.

输入参数appSlug必填

anyhook_code_deploy

Deploy code that runs on an app's events

Save a handler that runs on every event this app receives, in an isolated sandbox, with AnyHook's retries and replay around it: no server of your own. Each run's console output and return value are stored as that delivery's response (anyhook_inspect shows them). It can also run on a cron schedule. Pro and Scale; runs are capped per month with no overage, retries, test runs and schedule firings each count, and each run and package install is charged to the monthly compute allowance (anyhook_usage shows both). Test it with anyhook_code_test before real events arrive.

输入参数code必填appSlug必填enabledsecretsschedule

anyhook_code_test

Run an app's code on a stored event

Run the saved handler now and return its logs, return value and duration: on a stored event (the latest when event_id is omitted) or on a body you give. Counts as a run. Nothing is delivered, but whatever the code itself sends does happen.

输入参数bodyappSlug必填event_id

anyhook_usage

Show plan limits and usage

What the plan allows and what this account has used of each: events this month (per delivery, large events count per 64 KB), overage, the compute allowance and what used it (retries, replays, waiting on slow destinations, code runs, builds, schedules), API calls today (each tool call that reads or changes the account counts one), code runs and package snapshots, with when each resets. Call it when something answers with a limit, before bulk work such as replay_failed, or when the user asks what they are using.

无需输入参数。

anyhook_events

List recent webhook events

List webhook events, most recent first: id, app, type, status, attempt, destination status code, latency, timestamp. Summaries only, no request headers or body; anyhook_inspect reads one event's payload by the id from here. Uses your AnyHook account when connected, otherwise the local in-memory store.

输入参数limitstatusappSlug

anyhook_inspect

Inspect a specific event

Full detail for one event by id, including the inbound headers and body that anyhook_events omits, plus the destination's response. Payloads can be large and often contain personal data, so fetch one at a time, only when the body is needed. Account or local store.

输入参数id必填

版本历史

5
  1. v0.5.0最新Nov 4, 2026
  2. v0.4.0Oct 19, 2026
  3. v0.3.0Oct 11, 2026
  4. v0.2.4Sep 25, 2026
  5. v0.2.2Sep 16, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

其他 Anyhook 集成