Hooklistener

com.hooklistener由 hooklistener.com 發布官方發布者v1.0.1更新於 Oct 24, 2026

Webhook, email, WebSocket and tunnel testing for AI agents: capture, wait, verify, replay.

已驗證Streamable HTTP可網頁執行開發者工具安全與監控

概覽

AI 產生的概覽

託管型 MCP 伺服器，讓 AI 代理建立 webhook 網址、等待並驗證傳入請求，並可將請求重播到本機服務。

可以做什麼
建立與管理 webhook 端點、告警與異常檢查，以及模擬回應規則和請求執行緒。等待、列出、搜尋、檢視與診斷擷取的請求，包含重試排查。驗證簽章（Stripe、GitHub、Slack）、依 JSON Schema 驗證內容、比較請求差異，並在編輯後重新簽章再重播或轉送到本機。將請求儲存為重播案例與套件並對端點執行。建立即時端點（WebSocket、Socket.IO、MQTT、SSE）並等待或傳送訊息。建立信箱並等待與讀取郵件，規劃本機通道，執行可用性監控，並管理密鑰與任務。
適用情境
適合代理在開發或偵錯接收 webhook、郵件或即時訊息的整合時使用，需要公開網址、擷取流量、驗證簽章並重播到本機伺服器。也適用於測試註冊驗證郵件流程與監控端點可用性。
執行需求
遠端 Streamable HTTP 端點，無需本機安裝。使用 OAuth 2.1（PKCE 與動態用戶端註冊），申請 full_access 或 read_only 權限範圍；不支援 OAuth 的用戶端可用 Hooklistener API 金鑰作為 Bearer 權杖。所有方案（含免費版）皆可使用，且無需帳號即可建立臨時 webhook 網址。
安裝前請注意
完整權限允許代理建立、編輯、刪除、重播、轉送與傳送資料；如需限制請申請 read_only 權限。重播與轉送會送出真實 webhook 流量，刪除為兩步操作並需 dry_run 預覽。伺服器會儲存擷取的流量（含標頭、Cookie 與內容），資料依組織隔離並託管於歐洲；結果中的憑證會被遮蔽，但仍會經過該服務。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Hooklistener，將其新增到工作區。
  2. 連接 所需的 憑證。它們會被私密儲存，絕不會在公開頁面上展示。
  3. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.hooklistener%2Fmcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。 客戶端會在首次連接時完成 OAuth 登入。

{
  "mcpServers": {
    "hooklistener": {
      "type": "http",
      "url": "https://app.hooklistener.com/api/mcp"
    }
  }
}

README

[Hooklistener]

Hooklistener MCP Server

Hosted MCP server that lets AI coding agents test webhooks end to end: create a public webhook URL, wait for the webhook to arrive, verify its signature, and replay it to localhost. The same server also covers email inboxes, WebSocket/Socket.IO/MQTT/SSE endpoints, localhost tunnels and uptime monitors.

  • Endpoint: https://app.hooklistener.com/api/mcp
  • Transport: Streamable HTTP. Nothing to install or run locally.
  • Auth: OAuth 2.1 with PKCE and dynamic client registration. Clients request full_access or read_only. A Hooklistener API key (hklst_…) also works as a Bearer token for clients without OAuth.
  • Tools: 67, in 7 toolsets. A new workspace lists 26 of them (every webhook tool plus the tool that starts each other product); a toolset appears once you use that product. Send x-hooklistener-toolsets: all to list everything.
  • Plans: works on every plan, including Free.

This repository holds the setup instructions and the MCP Registry entry (server.json). The server itself is operated by Hooklistener.

Connect your client

Claude Code

bash
claude mcp add --transport http hooklistener https://app.hooklistener.com/api/mcp

Then run /mcp in Claude Code, select hooklistener and sign in with your browser. Full guide

Codex

bash
codex mcp add hooklistener \  --url https://app.hooklistener.com/api/mcp \  --oauth-resource https://app.hooklistener.com/api/mcpcodex mcp login hooklistener --scopes full_access   # or read_only

Full guide

Cursor

.cursor/mcp.json:

json
{  "mcpServers": {    "hooklistener": { "url": "https://app.hooklistener.com/api/mcp" }  }}

Full guide

VS Code (GitHub Copilot)

.vscode/mcp.json:

json
{  "servers": {    "hooklistener": { "type": "http", "url": "https://app.hooklistener.com/api/mcp" }  }}

Full guide

Claude.ai and Claude Desktop

Customize → Connectors → + → Add custom connector → paste https://app.hooklistener.com/api/mcp → Add → Connect. Full guide

Cline

Cline documents bearer-token headers for remote servers, so use a Hooklistener API key (paid plans, created at Organization Settings → API Keys). In cline_mcp_settings.json:

json
{  "mcpServers": {    "hooklistener": {      "type": "streamableHttp",      "url": "https://app.hooklistener.com/api/mcp",      "headers": { "Authorization": "Bearer hklst_your_api_key" }    }  }}

Agents installing the server for you can follow llms-install.md.

Other clients

Step-by-step guides: ChatGPT · Gemini CLI · Windsurf · Zed · OpenCode · Grok (xAI API)

Any MCP client that supports Streamable HTTP can connect with the endpoint above.

What your agent can do

CategoryExamples
Debug endpointscreate_endpoint, get_endpoint, list_endpoint_anomalies, set_endpoint_alerts
Captured requestswait_for_request, list_requests (list or search), get_request, diagnose_request, investigate_request_retries
Verify, compare and replayverify_request_signature (Stripe, GitHub, Slack), validate_request (JSON Schema), diff_requests, replay_request (replay or forward, edit the body and re-sign)
Mock responsescreate_response_rule, test_response_rules
Request threadsset_thread_rule, list_request_threads
Replay cases and suitessave_request_case, run_endpoint_cases, wait_for_case_run
Real-time endpointscreate_realtime_endpoint (WebSocket, Socket.IO, MQTT, SSE), wait_for_realtime_message, send_realtime_message
Email inboxescreate_inbox, wait_for_email, get_email
Localhost tunnelsplan_tunnel_action, replay_tunnel_capture
Uptime monitorscreate_monitor, get_monitor_status
Secrets and taskscreate_secret, cancel_task

Every tool has a title and read-only/destructive annotations. Full reference: docs.hooklistener.com/mcp/available-tools

Example prompts

  • "Create a Hooklistener endpoint for Stripe, trigger a test checkout, and wait for checkout.session.completed."
  • "Verify that webhook's signature with my Stripe secret, then replay it to http://localhost:3000/webhooks, re-signed."
  • "Create an inbox, sign up with it on staging, and read me the verification code from the email."
  • "Save the last three webhooks as a replay suite and run it against localhost after my fix."

Safety

  • Read-only access: request the read_only scope and the agent can search, wait for, diff, validate and diagnose traffic, but can't create, edit, delete, replay, forward or send anything.
  • Deletes are two-step: preview with dry_run, then confirm.
  • Replays and forwards need an idempotency key, so a retried call never sends a webhook twice.
  • Credentials are masked in tool results: common secrets in headers, cookies, query strings and JSON bodies.
  • Data is scoped to your organization and hosted in Europe.

No account yet?

Agents can create a temporary webhook URL without an account, which the user can claim later. See app.hooklistener.com/llms.txt.

Links

來源：README.md，提交 d0b5ef0

工具

0
該伺服器需要登入，因此 SourceWeft 無法在沒有帳號的情況下讀取其工具，也未收錄。已連接帳號所能看到的內容可能因帳號及其權限而異。

版本歷史

2
  1. v1.0.1最新Sep 27, 2026
  2. v1.0.0Sep 26, 2026

評分

已滿足適用檢查項的 75%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。