AnyHook

net.anyhook由 anyhook.net 發布官方發布者v0.5.0更新於 Nov 4, 2026

A webhook inbox for agents: one call returns a live URL. Mock, verify, inspect and replay.

已驗證Streamable HTTP可網頁執行開發者工具安全與監控

概覽

AI 產生的概覽

AnyHook 為助理提供 webhook 收件匣:建立具公開入站網址的應用、檢視與重播事件、產生並驗證簽章酬載。

可以做什麼
  • 建立與列出 webhook 應用,查看入站網址、來源與目的位址
  • 列出、檢視並排查事件,包括未送達與失敗的事件,並重播單筆或批次失敗事件
  • 產生 Stripe、GitHub、Slack 的簽章酬載,並以密鑰驗證收到的簽章
  • 部署、測試並讀取在沙箱中執行的處理常式程式碼,可依事件或排程觸發
  • 查看方案額度與用量,取得應用的電子郵件收件位址
適用情境
適合助理撰寫或除錯 webhook 整合時檢視實際投遞、重現簽章失敗,或在不自行架設伺服器的情況下取得接收網址。本機開發時產生簽章測試酬載也很方便。
執行需求
可作為託管端點 anyhook.net/mcp 使用(瀏覽器登入或 Bearer API 金鑰),也可透過 npx anyhook-mcp 在本機執行,需要 Node 22 或更新版本。遠端模式需要 ANYHOOK_API_KEY;未設定時本機僅提供 mock、verify、providers 工具與記憶體儲存,quickstart 工具可自助開通臨時端點。自架部署可用 ANYHOOK_API_BASE 覆寫 API 位址。
安裝前請注意
API 金鑰(ANYHOOK_API_KEY)可存取帳戶下的應用與事件酬載。anyhook_connect 需提供 Stripe 或 GitHub 金鑰以在服務商端註冊 webhook。事件酬載常含個人資料,重播會再次執行目的端處理常式,可能重複產生寫入與副作用。重播與程式碼執行會消耗方案配額與運算額度,未認領的 quickstart 端點會過期。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 AnyHook,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable,透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式,或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南,先向你展示發布者、端點和登入方式,經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/net.anyhook%2Fanyhook/install.md,並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前,先告訴我它的發布者、端點和登入方式,等我確認。不要把 API 金鑰寫進命令或我會提交的檔案;問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "anyhook": {
      "type": "http",
      "url": "https://anyhook.net/mcp"
    }
  }
}

README

anyhook-mcp

An MCP server that gives AI agents eyes on webhooks, inspect events, replay deliveries, mock signed payloads, create apps. Designed for the 45-second AI handler workflow.

Apache 2.0 · npm i -g anyhook-mcp


Forward webhooks to localhost

A public webhook URL that forwards to your machine, with no account:

bash
npx -y anyhook-mcp listen 3000
text
Webhook URL   https://in.anyhook.net/q-3fa9c1d2/listenForwards to   http://localhost:3000/
This URL is temporary and lasts until Nov 11. To keep it: https://anyhook.net/claim/...
Paste the URL into Stripe, GitHub or any webhook sender. Ctrl-C to stop.While this is stopped, events are logged but not forwarded.
Connected. Waiting for events.12:00:03  200  41 ms  invoice.paid12:00:19  500  12 ms  invoice.paid  AnyHook retries on its schedule
  • The URL stays. Restart the command and it is the same URL, so there is nothing to paste into the provider again.
  • Signatures verify. Your server gets the bytes the provider sent, so stripe.webhooks.constructEvent and friends work as they do in production.
  • Nothing is lost when your laptop is shut. Events are stored either way. A failed delivery is retried, and one that arrived while this was stopped can be replayed.

listen 3000/api/webhooks sets the path. With ANYHOOK_API_KEY set it uses that account, and --app <slug> picks the app. Needs Node 22 or newer.

It is for webhooks, not a general tunnel. The sender gets its answer from AnyHook, so your server's response goes to the event log rather than back to the sender. To expose a whole site, use ngrok or Cloudflare Tunnel.

Already have an AnyHook account?

Connect the hosted endpoint instead of running anything: add https://anyhook.net/mcp to Claude Code, claude.ai, Codex or VS Code and sign in through the browser, no key to copy. Steps for each app: https://anyhook.net/mcp.

No account yet (local mode)

No API key needed to start:

bash
claude mcp add anyhook -- npx -y anyhook-mcp

Then ask your agent to run anyhook_quickstart, it creates a free relay endpoint + API key instantly (no signup), and this MCP session auto-connects. All account tools (events, replay, apps) work immediately. The response includes a claim_url to keep the endpoint permanently; unclaimed, it expires in 7 days. It is a new endpoint, not an account you already have.

What it does

Drop this MCP server into Claude Desktop / Cursor / Claude Code and your agent can:

  • anyhook_apps_list, see every app in your AnyHook account with its inbound URL
  • anyhook_apps_create, spin up a new app from a prompt
  • anyhook_connect, give a Stripe key or GitHub token: the webhook is registered at the provider and signature-checked from the first event (the key is not stored)
  • anyhook_events, list recent events, filter by app / status
  • anyhook_inspect, pull a single event's headers, body, signature status
  • anyhook_replay, re-send a stored event to its destinations (outside the monthly quota, within a daily replay limit and the compute allowance; an event held for quota counts as new)
  • anyhook_undelivered, list events that never reached a destination
  • anyhook_usage, the plan's limits and what the account has used of each, with when they reset
  • anyhook_replay_failed, bulk-replay an app's failed events, oldest first (the last 24 hours and 50 per call by default, up to 100), saying when more are waiting
  • anyhook_mock, generate a signed Stripe / GitHub / Slack payload for local handler testing
  • anyhook_verify, verify any incoming signature against your secret
  • anyhook_providers, list every webhook provider AnyHook supports

The inbound URL an app gives you accepts webhook POSTs and also answers provider setup handshakes automatically: Meta's GET carrying hub.mode=subscribe gets its hub.challenge echoed back, even before the app is configured, so the URL can be registered in the Meta App Dashboard first and wired up after.

Two modes:

ModeWhenWhat works
remoteANYHOOK_API_KEY is setAll tools above, live against your AnyHook account
localNo API keyProvider toolkit (mock / verify / providers) + an in-memory store you can simulate events into. Useful for trying it out before signing up.

Quick start

bash
npm install -g anyhook-mcp# or run without installingnpx -y anyhook-mcp

Get an API key from https://anyhook.net/dashboard/settings. Keys start with ahk_live_.


Install in Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "anyhook": {      "command": "npx",      "args": ["-y", "anyhook-mcp"],      "env": {        "ANYHOOK_API_KEY": "ahk_live_xxxxxxxx"      }    }  }}

Restart Claude Desktop. The tools appear under the hammer icon.


Install in Cursor

Open Settings → MCP → Add new MCP server. Or edit ~/.cursor/mcp.json:

json
{  "mcpServers": {    "anyhook": {      "command": "npx",      "args": ["-y", "anyhook-mcp"],      "env": {        "ANYHOOK_API_KEY": "ahk_live_xxxxxxxx"      }    }  }}

Install in Claude Code

bash
claude mcp add anyhook -e ANYHOOK_API_KEY=ahk_live_xxxxxxxx -- npx -y anyhook-mcp

Or add the same mcpServers entry to your project's .mcp.json.


Remote endpoint (no local process)

The same server is hosted at https://anyhook.net/mcp (streamable HTTP, stateless). Claude Code, claude.ai, Codex and VS Code sign in through the browser (OAuth), no key to copy: https://anyhook.net/mcp has the steps for each. Any other client sends Authorization: Bearer ahk_live_... with a key from the dashboard:

json
{ "mcpServers": { "anyhook": { "url": "https://anyhook.net/mcp", "headers": { "Authorization": "Bearer ahk_live_..." } } } }

The endpoint has no anyhook_quickstart: that tool exists only in local mode.


Local-only mode (no account needed)

Skip the env var:

json
{  "mcpServers": {    "anyhook": {      "command": "npx",      "args": ["-y", "anyhook-mcp"]    }  }}

The agent gets anyhook_mock, anyhook_verify, anyhook_providers, anyhook_simulate, anyhook_events (against memory store), and anyhook_inspect (against memory store). Useful for "generate me a signed Stripe payment_intent.succeeded and POST it to localhost:3000" flows during local dev.


Example conversations

Triage a failing endpoint:

"Show me undelivered events for the stripe-prod app from the last hour, then replay them."

The agent calls anyhook_undelivered then anyhook_replay for each, surfacing the responses inline.

Create an app for a new integration:

"Make a new AnyHook app called replicate-video-jobs, source generic, point it at https://my-app.vercel.app/api/replicate-callback."

Calls anyhook_apps_create, returns the inbound URL you paste into Replicate.

Sanity-check a signature failure:

"Here's an inbound payload from Stripe that AnyHook is rejecting. Verify the signature manually with secret whsec_xxx."

Calls anyhook_verify with the supplied headers + body + secret, returns valid: false plus the failure reason.

Mock a webhook for local testing:

"Generate a Stripe payment_intent.succeeded event and POST it to http://localhost:3000/api/webhooks/stripe."

Calls anyhook_mock with targetUrl set; returns the request that was sent + your handler's response.


Environment variables

VarRequiredDefaultPurpose
ANYHOOK_API_KEYfor remote mode-ahk_live_* from https://anyhook.net/dashboard/settings
ANYHOOK_API_BASEnohttps://anyhook.netOverride for self-hosted AnyHook deployments

Why this is interesting

AI agents have been blind to their own webhook infrastructure. They can write the integration code, but once an event misbehaves in production they can't see it, you tell them what happened. With this MCP server, Claude / Cursor can read the actual event log, replay deliveries, debug signature failures, and even spin up new apps. It closes the loop between writing webhook code and operating it.


License

Apache-2.0 © AnyHook

來源:packages/mcp/README.md,提交 3f0252c

工具

16

anyhook_mock

Mock a webhook

Generate a webhook request with a valid signature for Stripe, GitHub, or Slack. If targetUrl is provided, the request is POSTed there and the response is returned.

輸入參數dataevent必填secretprovider必填targetUrl

anyhook_verify

Verify a webhook signature

Verify a webhook signature against a secret, for every source the AnyHook edge verifies, including stripe, github, shopify, slack, line, discord, linear, vercel, paddle, hubspot, paypal and xero.

輸入參數body必填secret必填headers必填provider必填requestUrl

anyhook_providers

List supported providers and event types

List webhook providers AnyHook can mock, along with the event types available for each.

無需輸入參數。

anyhook_apps_list

List your AnyHook apps

List apps in your AnyHook account with inbound URLs, sources, and destination URLs. Check isActive: an inactive app's inbound URL answers setup handshakes but acknowledges and discards event POSTs (202, reason app_inactive) instead of relaying them. Destination signing secrets are redacted to has_signing_secret plus a 4-char hint; a new secret in plaintext comes only from rotating it. An app whose slug was changed lists its former URLs under legacyInboundUrls; those still route to it.

無需輸入參數。

anyhook_inbox

Get this app's email inbox address

Every AnyHook app is also an email inbox: mail sent to {user}.{app}@anyhook.net becomes an event (type email.received) you can read with anyhook_events. Returns the address and webhook URL for one of your apps.

輸入參數app

anyhook_apps_create

Create a new AnyHook app

Create a new app with a name, provider source, and (optionally) destinations. Returns the inbound URL. The app is active immediately. Created WITHOUT destinations it still receives and LOGS every event (inspect-only), it just delivers nowhere until a destination is added (PATCH /api/v1/apps/{slug} with {"destinations": [...]}).

輸入參數name必填source必填destinations

anyhook_connect

Connect Stripe or GitHub with one key

Wire a provider to AnyHook in one call: give a Stripe or GitHub key and AnyHook registers the app's inbound URL as a webhook at the provider, saves the signing secret it yields, and turns on signature verification at the edge. The provider is read from the key; the key is used once and not stored. Without appSlug a new app is created (and removed again if the provider refuses the key). Re-running replaces the registration instead of duplicating it. GitHub sends a signed ping immediately, so the first event appears within seconds. Add a destination afterwards (PATCH /api/v1/apps/{slug}) to forward events; until then they are received and logged.

輸入參數targetappSlugprovider_key必填

anyhook_replay

Replay an event

Re-send a stored event to its destinations. Replays sit outside the monthly event quota but within a daily replay limit per plan and the monthly compute allowance (anyhook_usage), and replaying an event that was held for quota bills it as a new event. The destination does run its handler again: a receiver that is not idempotent will process the event twice while debugging.

輸入參數id必填

anyhook_undelivered

List undelivered events for an app

Show events for the given app that have not successfully reached any destination (failed or still retrying).

輸入參數limitappSlug必填

anyhook_replay_failed

Bulk-replay an app's failed events

Re-send an app's failed events after the destination is fixed, oldest first: by default those received in the last 24 hours, at most 50 per call (since and limit change both; limit goes up to 100). Events held by an open circuit are included. An event replayed once is not selected again, so a second call continues with the rest. The result lists what was replayed, what was skipped and why, and more: true while failed events are still waiting. Replays count against the plan's daily replay limit.

輸入參數limitsinceappSlug必填

anyhook_code_get

Read an app's code handler

The code that runs on this app's events: its source, the names of its secrets (never the values), whether events are reaching it, and runs used this month against the plan's limit.

輸入參數appSlug必填

anyhook_code_deploy

Deploy code that runs on an app's events

Save a handler that runs on every event this app receives, in an isolated sandbox, with AnyHook's retries and replay around it: no server of your own. Each run's console output and return value are stored as that delivery's response (anyhook_inspect shows them). It can also run on a cron schedule. Pro and Scale; runs are capped per month with no overage, retries, test runs and schedule firings each count, and each run and package install is charged to the monthly compute allowance (anyhook_usage shows both). Test it with anyhook_code_test before real events arrive.

輸入參數code必填appSlug必填enabledsecretsschedule

anyhook_code_test

Run an app's code on a stored event

Run the saved handler now and return its logs, return value and duration: on a stored event (the latest when event_id is omitted) or on a body you give. Counts as a run. Nothing is delivered, but whatever the code itself sends does happen.

輸入參數bodyappSlug必填event_id

anyhook_usage

Show plan limits and usage

What the plan allows and what this account has used of each: events this month (per delivery, large events count per 64 KB), overage, the compute allowance and what used it (retries, replays, waiting on slow destinations, code runs, builds, schedules), API calls today (each tool call that reads or changes the account counts one), code runs and package snapshots, with when each resets. Call it when something answers with a limit, before bulk work such as replay_failed, or when the user asks what they are using.

無需輸入參數。

anyhook_events

List recent webhook events

List webhook events, most recent first: id, app, type, status, attempt, destination status code, latency, timestamp. Summaries only, no request headers or body; anyhook_inspect reads one event's payload by the id from here. Uses your AnyHook account when connected, otherwise the local in-memory store.

輸入參數limitstatusappSlug

anyhook_inspect

Inspect a specific event

Full detail for one event by id, including the inbound headers and body that anyhook_events omits, plus the destination's response. Payloads can be large and often contain personal data, so fetch one at a time, only when the body is needed. Account or local store.

輸入參數id必填

版本歷史

5
  1. v0.5.0最新Nov 4, 2026
  2. v0.4.0Oct 19, 2026
  3. v0.3.0Oct 11, 2026
  4. v0.2.4Sep 25, 2026
  5. v0.2.2Sep 16, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

其他 Anyhook 整合