Hooklistener MCP Server
Hosted MCP server that lets AI coding agents test webhooks end to end: create a public webhook URL, wait for the webhook to arrive, verify its signature, and replay it to localhost. The same server also covers email inboxes, WebSocket/Socket.IO/MQTT/SSE endpoints, localhost tunnels and uptime monitors.
- Endpoint:
https://app.hooklistener.com/api/mcp
- Transport: Streamable HTTP. Nothing to install or run locally.
- Auth: OAuth 2.1 with PKCE and dynamic client registration. Clients request
full_access or read_only. A Hooklistener API key (hklst_…) also works as a Bearer token for clients without OAuth.
- Tools: 67, in 7 toolsets. A new workspace lists 26 of them (every webhook tool plus the tool that starts each other product); a toolset appears once you use that product. Send
x-hooklistener-toolsets: all to list everything.
- Plans: works on every plan, including Free.
This repository holds the setup instructions and the MCP Registry entry (server.json). The server itself is operated by Hooklistener.
Connect your client
Claude Code
claude mcp add --transport http hooklistener https://app.hooklistener.com/api/mcp
Then run /mcp in Claude Code, select hooklistener and sign in with your browser. Full guide
Codex
codex mcp add hooklistener \
--url https://app.hooklistener.com/api/mcp \
--oauth-resource https://app.hooklistener.com/api/mcp
codex mcp login hooklistener --scopes full_access
Full guide
Cursor
.cursor/mcp.json:
{
"mcpServers": {
"hooklistener": { "url": "https://app.hooklistener.com/api/mcp" }
}
}
Full guide
VS Code (GitHub Copilot)
.vscode/mcp.json:
{
"servers": {
"hooklistener": { "type": "http", "url": "https://app.hooklistener.com/api/mcp" }
}
}
Full guide
Claude.ai and Claude Desktop
Customize → Connectors → + → Add custom connector → paste https://app.hooklistener.com/api/mcp → Add → Connect. Full guide
Cline
Cline documents bearer-token headers for remote servers, so use a Hooklistener API key (paid plans, created at Organization Settings → API Keys). In cline_mcp_settings.json:
{
"mcpServers": {
"hooklistener": {
"type": "streamableHttp",
"url": "https://app.hooklistener.com/api/mcp",
"headers": { "Authorization": "Bearer hklst_your_api_key" }
}
}
}
Agents installing the server for you can follow llms-install.md.
Other clients
Step-by-step guides: ChatGPT · Gemini CLI · Windsurf · Zed · OpenCode · Grok (xAI API)
Any MCP client that supports Streamable HTTP can connect with the endpoint above.
What your agent can do
| Category | Examples |
|---|
| Debug endpoints | create_endpoint, get_endpoint, list_endpoint_anomalies, set_endpoint_alerts |
| Captured requests | wait_for_request, list_requests (list or search), get_request, diagnose_request, investigate_request_retries |
| Verify, compare and replay | verify_request_signature (Stripe, GitHub, Slack), validate_request (JSON Schema), diff_requests, replay_request (replay or forward, edit the body and re-sign) |
| Mock responses | create_response_rule, test_response_rules |
| Request threads | set_thread_rule, list_request_threads |
| Replay cases and suites | save_request_case, run_endpoint_cases, wait_for_case_run |
| Real-time endpoints | create_realtime_endpoint (WebSocket, Socket.IO, MQTT, SSE), wait_for_realtime_message, send_realtime_message |
| Email inboxes | create_inbox, wait_for_email, get_email |
| Localhost tunnels | plan_tunnel_action, replay_tunnel_capture |
| Uptime monitors | create_monitor, get_monitor_status |
| Secrets and tasks | create_secret, cancel_task |
Every tool has a title and read-only/destructive annotations. Full reference: docs.hooklistener.com/mcp/available-tools
Example prompts
- "Create a Hooklistener endpoint for Stripe, trigger a test checkout, and wait for
checkout.session.completed."
- "Verify that webhook's signature with my Stripe secret, then replay it to
http://localhost:3000/webhooks, re-signed."
- "Create an inbox, sign up with it on staging, and read me the verification code from the email."
- "Save the last three webhooks as a replay suite and run it against localhost after my fix."
Safety
- Read-only access: request the
read_only scope and the agent can search, wait for, diff, validate and diagnose traffic, but can't create, edit, delete, replay, forward or send anything.
- Deletes are two-step: preview with
dry_run, then confirm.
- Replays and forwards need an idempotency key, so a retried call never sends a webhook twice.
- Credentials are masked in tool results: common secrets in headers, cookies, query strings and JSON bodies.
- Data is scoped to your organization and hosted in Europe.
No account yet?
Agents can create a temporary webhook URL without an account, which the user can claim later. See app.hooklistener.com/llms.txt.
Links