README.md
Webhook.site MCP Server
A Model Context Protocol (MCP) server for webhook.site - instantly capture HTTP requests, emails, and DNS lookups. Perfect for testing webhooks, debugging API callbacks, security testing, and bug bounty hunting.
Quick Start
Installation
# Using uvx (recommended - no install needed)
uvx webhook-mcp-server
# Or install via pip
pip install webhook-mcp-server
VS Code / GitHub Copilot
Add to .vscode/mcp.json:
{
"servers": {
"webhook-mcp-server": {
"type": "stdio",
"command": "uvx",
"args": ["webhook-mcp-server"]
}
}
}
Claude Desktop
Add to claude_desktop_config.json:
{
"mcpServers": {
"webhook-mcp-server": {
"command": "uvx",
"args": ["webhook-mcp-server"]
}
}
}
What Can You Do?
Capture Webhooks
"Create a webhook and show me the URL"
"What requests have been sent to my webhook?"
"Wait for a request to come in"
Security/Bug Bounty:
"Generate an SSRF payload to test for blind vulnerabilities"
"Create XSS callback payloads to detect blind XSS attacks"
"Make me a canary token to detect if someone accesses a URL"
Email Automation:
"Create a temp email and wait for a password reset link"
"Monitor this webhook for emails and extract all links from them"
"Give me 3 temporary emails at once" (batch creation)
API Testing:
"Create a webhook that returns a 404 error with a custom message"
"Make a webhook with CORS enabled that waits 5 seconds before responding"
"Send 10 different test requests to a webhook and show me all the captured data"
Real-time Monitoring:
"Create a webhook and wait for any HTTP request to arrive"
"Monitor for DNS lookups to detect if a server is making DNS queries"
"Search all requests for ones containing 'password' in the body"
Data Analysis:
"Export all captured webhook requests to JSON format"
"Show me statistics on requests received in the last hour"
"Filter and show only POST requests with specific headers"
Creative/Practical:
"Create a webhook that pretends to be a Stripe payment API"
"Make a fake login endpoint that captures credentials (for pentesting)"
"Set up an email inbox that auto-extracts verification codes"
Canary Tokens
"Create a canary URL to track document access"
"Generate a DNS canary for the config file"
"Set up an email tracker pixel"
Tools Reference
Webhook Management
| Tool | Description |
|---|---|
create_webhook |
Create a new webhook endpoint |
create_webhook_with_config |
Create with custom response, status, CORS, timeout |
get_webhook_url |
Get the full URL for a webhook token |
get_webhook_email |
Get the email address for a webhook |
get_webhook_dns |
Get the DNS subdomain for a webhook |
get_webhook_info |
Get webhook settings and |
Tools 6
create_webhookCreate a new webhook endpointcreate_webhook_with_configCreate with custom response, status, CORS, timeoutget_webhook_urlGet the full URL for a webhook tokenget_webhook_emailGet the email address for a webhookget_webhook_dnsGet the DNS subdomain for a webhookget_webhook_infoGet webhook settings and dataTry it
→Create a new webhook and give me the URL to use for testing.
→Create a webhook that returns a 404 error with a custom message.
→Monitor my webhook for incoming emails and extract any links found in them.
→Generate an SSRF payload to test for blind vulnerabilities.
→Export all captured webhook requests from the last hour to JSON format.