Webhook.site MCP Server

io.github.zebbern由 GitHub 帳號 zebbern 發布v3.0.0更新於 Oct 25, 2026

Capture HTTP, email, and DNS callbacks with webhook.site from MCP clients.

已驗證STDIO僅桌面開發者工具安全與監控

概覽

AI 產生的概覽

本機 MCP 伺服器，讓助理建立 webhook.site 收件匣並擷取 HTTP、郵件與 DNS 回呼，用於測試與除錯。

可以做什麼
建立、設定、檢視、列出與刪除 webhook.site 收件匣，取得 HTTP 網址、臨時信箱與 DNS 名稱，並向其送出測試請求。讀取、搜尋、加註、下載附件、匯出與刪除已擷取的 HTTP、郵件與 DNS 事件。即時等待新請求或郵件，暫留並自訂回應下一個請求，開啟擷取郵件中的驗證或重設連結。產生經授權的帶外 SSRF、XSS 與 canary 酬載並檢查回呼是否送達。設定 API 金鑰後可管理 Custom Actions、Schedules、Global Variables、Groups、Queue Profiles、Templates、Databases 與團隊使用者。
適用情境
適合測試 webhook、除錯 API 回呼、用臨時信箱走完註冊與密碼重設流程，或進行需要帶外回呼的經授權安全測試。
執行需求
以 stdio 在本機執行，通常透過 uvx 或 pip 安裝；需要 Python 3.10+ 及所列 Python 相依套件。匿名使用可取得 7 天有效的網址；選用的 WEBHOOK_SITE_API_KEY 可啟用永久網址與帳戶工具。選用環境變數可調整到期時間、限流等待、連結跳轉允許的主機以及代理或 CA 設定。需要能連線至 webhook.site 的網路。
安裝前請注意
擷取的請求、郵件與 DNS 查詢都會經過第三方服務 webhook.site。WEBHOOK_SITE_API_KEY 提供帳戶層級存取權限，使用管理員金鑰時還可管理團隊使用者，付費方案有配額限制。多個工具會永久刪除資料，包括 delete_webhook、delete_request 與 delete_all_requests。follow_email_link 會開啟擷取郵件中的連結，並可能連線至透過 FOLLOW_EMAIL_LINK_ALLOW_HOSTS 放行的主機。安全酬載工具聲明僅限經授權的測試使用。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Webhook.site MCP Server，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

Webhook.site MCP Server

[PyPI] [Python] [MCP]

A Model Context Protocol (MCP) server for webhook.site - instantly capture HTTP requests, emails, and DNS lookups. Perfect for testing webhooks, debugging API callbacks, security testing, and bug bounty hunting.

Security helper tools (SSRF, XSS, canary tokens) are for authorized testing only — systems you own or have explicit permission to test.

Table of Contents

Quick Start

Installation

bash
# Using uvx (recommended - no install needed)uvx webhook-mcp-server==3.0.0
# Or install via pippip install webhook-mcp-server==3.0.0

Use 3.0.0 or newer. 2.1.3 does not start on MCP 2.0; 3.0 renames a few tools (see Upgrading from 2.x).

VS Code / GitHub Copilot

Add to .vscode/mcp.json:

json
{  "servers": {    "webhook-mcp-server": {      "type": "stdio",      "command": "uvx",      "args": ["webhook-mcp-server==3.0.0"]    }  }}

Cursor

Add to .cursor/mcp.json (project) or your user MCP config:

json
{  "mcpServers": {    "webhook-mcp-server": {      "command": "uvx",      "args": ["webhook-mcp-server==3.0.0"]    }  }}

Claude Desktop

Add to claude_desktop_config.json:

json
{  "mcpServers": {    "webhook-mcp-server": {      "command": "uvx",      "args": ["webhook-mcp-server==3.0.0"]    }  }}

Configuration

All settings are environment variables on the server process. Put them in the env block of your MCP client config.

VariablePurpose
WEBHOOK_SITE_API_KEYYour webhook.site API key. Makes new URLs permanent (your plan's quota) and unlocks list_webhooks, Custom Actions, Schedules, Global Variables, Groups, Queue Profiles, Templates, Databases, Users and CSV export
WEBHOOK_SITE_DEFAULT_EXPIRYSeconds until new URLs expire when the call does not pass expiry. Unset means permanent on a paid account (7 days for anonymous URLs)
WEBHOOK_MCP_RATE_LIMIT_MAX_WAITWhen webhook.site answers 429 with a Retry-After up to this many seconds (default 15), the call waits and retries once; longer waits are reported as an error naming the wait
FOLLOW_EMAIL_LINK_ALLOW_HOSTSfollow_email_link only opens links to public internet hosts, and connects to the address it checked (no DNS rebinding). To test a sign-up flow on your own machine or intranet, list what to allow: localhost,127.0.0.1,*.corp.example,10.0.0.0/8
HTTPS_PROXY / HTTP_PROXY / NO_PROXYHonoured by follow_email_link. The proxy makes the connection, so the target is checked before the request instead of being pinned
SSL_CERT_FILE / SSL_CERT_DIRCustom CA bundle for follow_email_link, for corporate TLS interception

If the request to a verification link completes and then redirects somewhere that is not allowed (a local dev server, an intranet dashboard), the tool reports that hop's status with the refused target in blocked_redirect instead of failing: the request that consumed the token already went through, whether or not the site counted it as verified.

What Can You Do?

Capture Webhooks

"Create a webhook and show me the URL""What requests have been sent to my webhook?""Wait for a request to come in"
[Webhooks]

Security/Bug Bounty:

"Generate an SSRF payload to test for blind vulnerabilities""Create XSS callback payloads to detect blind XSS attacks""Make me a canary token to detect if someone accesses a URL"
[Security]

Email Automation:

"Create a temp email and wait for a password reset link""Monitor this webhook for emails and extract all links from them""Give me 3 temporary emails at once" (batch creation)
[Email]

API Testing:

"Create a webhook that returns a 404 error with a custom message""Make a webhook with CORS enabled that waits 5 seconds before responding""Send 10 different test requests to a webhook and show me all the captured data""Hold the next request and answer it with a 402 and this JSON body"
[API]

Real-time Monitoring:

"Create a webhook and wait for any HTTP request to arrive""Monitor for DNS lookups to detect if a server is making DNS queries""Search all requests for ones containing 'password' in the body"
[Monitoring]

Data Analysis:

"Export all captured webhook requests to JSON format""Show me statistics on requests received in the last hour""Filter and show only POST requests with specific headers"
[Data]

Automate with your account:

"Add a Custom Action that forwards every request to my staging API""Schedule a health check of https://example.com every 5 minutes and alert on a bad status""Write a WebhookScript that answers with the request's JSON field 'id'"
[Practical]

Canary Tokens

"Create a canary URL to track document access""Generate a DNS canary for the config file""Set up an email tracker pixel"
[CanaryTokens]

Tools Reference

Everything works without an account on anonymous 7-day URLs. With WEBHOOK_SITE_API_KEY set, URLs are permanent and the account tools unlock the features of your plan. Every webhook_token accepts the UUID, an alias, a pasted https://webhook.site/... URL or the inbox address. Full parameters for each tool: docs/TOOLS.md.

31 tools, generated from the server by scripts/gen_tool_docs.py.

Diagnostics
ToolWhat it does
server_statusCheck this server's setup: API key, account reachability, plan, real-time socket, env config.
Webhooks
ToolWhat it does
create_webhookCreate a disposable inbox to sign up on a website: HTTP URL, temp email, DNS.
configure_webhookCreate a webhook with custom settings, or update one (pass webhook_token).
get_webhook_infoShow a webhook's settings, expiry, request count and every address.
get_webhook_emailReturn the temp inbox to sign up, verify, magic-link, or reset a password.
list_webhooksList the webhooks (URLs / inboxes) in the account. Needs WEBHOOK_SITE_API_KEY.
delete_webhookPermanently delete a webhook and every captured request/email.
Requests
ToolWhat it does
send_requestsSend one JSON body (data) or several (payloads) to the webhook URL to test capture.
get_webhook_requestsList captured HTTP, email, or DNS events for a webhook, one page at a time.
search_requestsSearch captured events by method, body text, headers, type, or date.
get_requestReturn one captured event: the newest by default, or request_id.
update_requestAttach a note to a captured request, or set its dynamic response.
download_request_fileDownload an uploaded file or email attachment (base64) by its file_id.
delete_requestDelete one captured HTTP, email, or DNS event by request id.
delete_all_requestsClear captured events on a webhook, optionally by date or search query.
export_webhook_dataFull dump of captured events with HTML and untruncated bodies, as JSON or CSV.
Real-time
ToolWhat it does
wait_for_requestWait until a new HTTP (or DNS) callback hits the webhook (1-120s).
wait_for_emailWait for a sign-up, verify, magic-link, or password-reset email (1-120s).
respond_to_next_requestHold the next request that hits the webhook and answer it with your own status, headers and body.
follow_email_linkOpen the verify / magic-link / reset URL from a captured sign-up email.
Account features (API key)
ToolWhat it does
manage_custom_actionsManage the Custom Actions webhook.site runs on every request or email a token receives.
manage_schedulesManage Schedules: webhook.site calls request_url on an interval (needs API key).
manage_global_variablesManage Global Variables shared by all URLs, usable as $name$ in Custom Actions and Schedules.
manage_groupsManage Groups that organise the account's webhooks (needs API key).
manage_queuesManage Queue Profiles that throttle queued Custom Actions (needs API key).
manage_templatesManage Templates: reusable sets of Custom Actions plus predefined variables (needs API key).
manage_databasesManage webhook.site Databases and run SQL against them (needs API key).
manage_usersManage team users on an Enterprise account (needs an administrator API key).
Security testing
ToolWhat it does
generate_oob_payloadsBuild authorized out-of-band payloads that ping this webhook: SSRF URLs, XSS callbacks, or canary tokens.
check_for_callbacksSee if SSRF, XSS, or canary callbacks arrived in the last N minutes.
extract_links_from_requestPull confirm, reset, magic-link, and other URLs from a captured email or HTTP body.

Upgrading from 2.x

2.x tool3.0 replacement
create_webhook_with_config, update_webhookconfigure_webhook (pass webhook_token to update)
get_webhook_url, get_webhook_dnsfields of get_webhook_info
get_latest_requestget_request
send_to_webhook, send_multiple_requestssend_requests (data or payloads)
generate_ssrf_payload, generate_xss_callback, generate_canary_tokengenerate_oob_payloads (kind=ssrf|xss|canary, canary_type)

Examples

Sign up on a website

  1. create_webhook — get email ({token}@emailhook.site)
  2. Use that address on the site (sign-up, verify, magic link, or password reset)
  3. wait_for_email — receive the message, confirm / login / reset URLs, and any OTP
  4. follow_email_link to open a verify link, or type verification_codes on the site

If you already have a token, get_webhook_email returns the same inbox.

Create a Webhook

json
// Response from create_webhook{  "token": "abc123-def456-...",  "url": "https://webhook.site/abc123-def456-...",  "email": "[email protected]",  "dns": "abc123-def456-....dnshook.site"}

Wait for Password Reset Email

json
// Response from wait_for_email{  "email_received": true,  "subject": "Password Reset Request",  "from": "[email protected]",  "auth_links": ["https://example.com/reset?token=xyz789"],  "verification_codes": ["847291"]}

Poll for new events without paging

json
// get_webhook_requests(webhook_token, since=<next_since from the previous call>){  "requests": [ ... only what arrived after the cursor ... ],  "next_since": 1788472548944304}

SSRF Testing Payload

json
// Response from generate_oob_payloads(kind="ssrf"){  "payloads": {    "http": "https://webhook.site/token?id=ssrf-test",    "dns": "ssrf-test.token.dnshook.site",    "ip_decimal": "http://2130706433/token",    "ip_hex": "http://0x7f000001/token"  }}

Each Webhook Token Provides

EndpointFormatUse Case
HTTP URLhttps://webhook.site/{token}Capture HTTP/HTTPS requests (any sub-path too)
Subdomainhttps://{token}.webhook.siteAlternative URL format
Forced statushttps://webhook.site/{token}/{status}Answer with that status, for retry-logic tests
Email{token}@emailhook.siteCapture incoming emails
DNS{token}.dnshook.siteCapture DNS lookups (every subdomain)

Documentation

PageContents
docs/TOOLS.mdEvery tool with parameters and hints, generated from the server
docs/webhook-site-notes.mdWhat webhook.site actually does, verified live, including where the official docs are wrong
docs/testing.mdThe four test layers, recordings, verification scripts, model evals, account safety
docs/releasing.mdVersion bumps, tagging, the publish workflow
CHANGELOG.mdVersion history

Development

bash
git clone https://github.com/zebbern/webhook-mcp-server.gitcd webhook-mcp-serverpip install -e ".[dev]"pytest -m "not live and not live_auth"     # offline suite incl. replay of recorded live exchangespython server.py                            # run the server on stdio

The offline suite replays real recorded webhook.site exchanges; the live tool check and the live / live_auth tiers hit the real API. Details in docs/testing.md.

Layout: server.py (entry point and lifespan), handlers/tools.py (tool registrations), services/ (one module per API area), utils/ (HTTP client, real-time socket, URL safety, references), scripts/ (live check, generators, verifiers), evals/ (model-in-the-loop prompts).

Requirements

  • Python 3.10+
  • mcp >= 2.0.0
  • httpx >= 0.26.0, httpcore >= 1.0.0, anyio >= 4.0.0
  • python-socketio[asyncio_client] >= 5.11.0 (real-time waiting; the tools fall back to polling without it)

Contributing

Bug reports and PRs are welcome. Keep a PR to one change, add a test whose expectation was checked against the real API (see docs/testing.md), and run python scripts/gen_tool_docs.py after touching a tool.

Credits

This project is not affiliated with or endorsed by webhook.site

Links

Made with ❤️ for the MCP community

來源：README.md，提交 0027ea9

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v3.0.0最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分