Webhook.site MCP Server

Webhook.site MCP Server

A Model Context Protocol (MCP) server for webhook.site - instantly capture HTTP requests, emails, and DNS lookups. Perfect for testing webhooks, debugging API callbacks, security testing, and bug bounty hunting.

Security helper tools (SSRF, XSS, canary tokens) are for authorized testing only — systems you own or have explicit permission to test.

---

Table of Contents

• Quick Start
• What Can You Do?
• Tools Reference
• Examples
• Each Webhook Token Provides
• Documentation
• Development
• Requirements
• Contributing
• Credits
• Links

---

Quick Start

Installation

# Using uvx (recommended - no install needed)

uvx webhook-mcp-server==3.0.0

Or install via pip

pip install webhook-mcp-server==3.0.0

Use 3.0.0 or newer. 2.1.3 does not start on MCP 2.0; 3.0 renames a few tools (see Upgrading from 2.x).

VS Code / GitHub Copilot

Add to .vscode/mcp.json:

{

"servers": { "webhook-mcp-server": { "type": "stdio", "command": "uvx", "args": ["webhook-mcp-server==3.0.0"] } } }

Cursor

Add to .cursor/mcp.json (project) or your user MCP config:

{

"mcpServers": { "webhook-mcp-server": { "command": "uvx", "args": ["webhook-mcp-server==3.0.0"] } } }

Claude Desktop

Add to claude_desktop_config.json:

{

"mcpServers": { "webhook-mcp-server": { "command": "uvx", "args": ["webhook-mcp-server==3.0.0"] } } }

Configuration

All settings are environment variables on the server process. Put them in the env block of your MCP client config.

If the request to a verification link completes and then redirects somewhere that is not allowed (a local dev server, an intranet dashboard), the tool reports that hop's status with the refused target in blocked_redirect instead of failing: the request that consumed the token already went through, whether or not the site counted it as verified.

---

What Can You Do?

Capture Webhooks

"Create a webhook and show me the URL"

"What requests have been sent to my webhook?" "Wait for a request to come in"

Security/Bug Bounty:

"Generate an SSRF payload to test for blind vulnerabilities"

"Create XSS callback payloads to detect blind XSS attacks" "Make me a canary token to detect if someone accesses a URL"

Email Automation:

"Create a temp email and wait for a password reset link"

"Monitor this webhook for emails and extract all links from them" "Give me 3 temporary emails at once" (batch creation)

API Testing:

"Create a webhook that returns a 404 error with a custom message"

"Make a webhook with CORS enabled that waits 5 seconds before responding" "Send 10 different test requests to a webhook and show me all the captured data" "Hold the next request and answer it with a 402 and this JSON body"

Real-time Monitoring:

"Create a webhook and wait for any HTTP request to arrive"

"Monitor for DNS lookups to detect if a server is making DNS queries" "Search all requests for ones containing 'password' in the body"

Data Analysis:

"Export all captured webhook requests to JSON format"

"Show me statistics on requests received in the last hour" "Filter and show only POST requests with specific headers"

Automate with your account:

"Add a Custom Action that forwards every request to my staging API"

"Schedule a health check of https://example.com every 5 minutes and alert on a bad status" "Write a WebhookScript that answers with the request's JSON field 'id'"

Canary Tokens

"Create a canary URL to track document access"

"Generate a DNS canary for the config file" "Set up an email tracker pixel"

---

Tools Reference

Everything works without an account on anonymous 7-day URLs. With WEBHOOK_SITE_API_KEY set, URLs are permanent and the account tools unlock the features of your plan. Every webhook_token accepts the UUID, an alias, a pasted https://webhook.site/... URL or the inbox address. Full parameters for each tool: docs/TOOLS.md.

31 tools, generated from the server by scripts/gen_tool_docs.py.

Diagnostics

Webhooks

Requests

Real-time

Account features (API key)

Security testing

Upgrading from 2.x

---

Examples

Sign up on a website

1. create_webhook — get email ({token}@emailhook.site)
2. Use that address on the site (sign-up, verify, magic link, or password reset)
3. wait_for_email — receive the message, confirm / login / reset URLs, and any OTP
4. follow_email_link to open a verify link, or type verification_codes on the site

If you already have a token, get_webhook_email returns the same inbox.

Create a Webhook

// Response from create_webhook

{ "token": "abc123-def456-...", "url": "https://webhook.site/abc123-def456-...", "email": "abc123-def456-...@emailhook.site", "dns": "abc123-def456-....dnshook.site" }

Wait for Password Reset Email

// Response from wait_for_