Give your AI agent a webhook endpoint

Agents keep running into the same wall: they're asked to "set up the Stripe webhook and make sure it works", but they have no public URL to receive anything at, no way to see what a provider actually sent, and no way to wait for a delivery that hasn't happened yet. Pasting curl loops into a shell tool works, badly. An MCP server fixes this properly: the agent gets webhook capture as a first-class tool.

One line of config

Hookden runs a native MCP server over Streamable HTTP — no auth, no API key, no sessions. Add it to any MCP client:

{ "mcpServers": { "hookden": { "type": "http", "url": "https://hookden.pages.dev/mcp" } } }

Client-specific versions of the same thing:

Claude Code: claude mcp add --transport http hookden https://hookden.pages.dev/mcp
Cursor: put the JSON above in .cursor/mcp.json (project) or ~/.cursor/mcp.json (global)
Anything else: most clients accept the mcpServers JSON shape; the transport is plain Streamable HTTP (POST JSON-RPC to /mcp), so even a hand-rolled client is a few lines.

The seven tools

Tool	What it does
`create_bin`	Mints a public capture URL (`/h/…`). Point any webhook at it — every request (any method, any subpath, headers + raw body, binary-safe) is stored.
`list_captures`	Compact summaries of what's arrived: id, method, path, time, content-type, body size, signature status. Supports `after` for incremental reads.
`get_capture`	One request in full — method, path, query, every header, body (base64 for binary).
`wait_for_capture`	Blocks up to 45 s until the next request lands, then returns it in full. Returns `timed_out: true` instead of erroring when nothing arrives, so agents can loop safely.
`send_test_webhook`	Seeds a simulated, clearly-labeled sample delivery into the bin and returns it in full — default is a GitHub push; pass `example` to pick any of the provider payloads (Stripe, Slack, Shopify…). Lets an agent with no HTTP client run the entire loop before wiring a real sender.
`set_response`	Configures what the bin replies — status, content-type, body, custom response headers, delay. Body/header values take `{{…}}` templates rendered from the incoming request (`{{body.challenge}}`, `{{query.hub.challenge}}`, `{{header.x-hook-secret}}`, an `hmac_sha256` helper), so an agent can make a bin pass Slack, Zoom CRC, Meta/WhatsApp and Strava verification handshakes — and echo Asana’s `X-Hook-Secret` response header — without writing a single line of server code.
`verify_signature`	Checks a webhook signature against a secret — 25 provider-exact schemes (GitHub, Stripe, Svix/Standard Webhooks, Square, HubSpot, Zendesk…) plus a generic HMAC mode, including the ECDSA (SendGrid), RSA (Kick) and HMAC-MD5 (Patreon) schemes a generic HMAC tool structurally can’t verify. Needs no bin; the secret is used in-memory for the one computation and never stored or logged. On a mismatch it lists missing headers and the most likely causes.

Why `wait_for_capture` is the point

Without it, an agent has to poll: call a list tool, sleep, call again — burning turns and tokens on "nothing yet". With a blocking wait, the natural agent flow is one clean sequence:

1. create_bin                         → get capture_url
2. configure the sender               → paste capture_url into Stripe/GitHub/your app
3. trigger the event                  → push a commit, fire a test event…
4. wait_for_capture                   → the actual delivery, headers + raw body

Step 4 returns the exact bytes the provider sent — which is what the agent needs to write a correct handler, debug a signature failure, or prove the integration works end-to-end.

A human can watch the same bin

Every bin the agent creates also has a human dashboard at its /b/… URL — live view, pretty-printed JSON, signature checks, replay, diff. So "agent does the work, human supervises in a browser tab" is built in: ask your agent for the bin's inspect_url and open it.

Limits, honestly

Anonymous (agent-created) bins keep captures for ~24 hours; signing up on the website extends retention to 30 days.
wait_for_capture caps at 45 s per call — loop it for longer waits (it's designed for that).
Normal rate limits apply per IP. Bodies over 100 KB are truncated in storage (flagged, so you know).
No auth also means: don't send secrets you can't rotate to a capture URL. Same rule as any request-inspector.

Prefer raw HTTP?

Everything the MCP tools do is also plain REST — curl https://hookden.pages.dev/new mints a bin, and the full contract is machine-readable at /openapi.json (OpenAPI 3.1). The MCP server is a thinner path for agents; the API is there when you want it. There's also /llms.txt for agent discovery.

No signup needed. Or from your terminal: curl https://hookden.pages.dev/new

← All guides · Signature debugger · Payload examples · Docs · Hookden vs webhook.site