Capture HTTP, email, and DNS callbacks with webhook.site from MCP clients.
io.github.zebbern/webhook-mcp-server — Model Context Protocol (MCP) Server
This MCP server captures webhook activity via webhook.site from MCP clients. It is designed to record HTTP requests, emails, and DNS lookups, providing access to callback data for testing, debugging, and analysis of webhook behavior.
🛠️ Key Features
webhook.site–based webhook capture
HTTP request callback recording
Email callback capture
DNS lookup callback capture
Topics include MCP tooling, webhook APIs, and webhook event handlers
🚀 Use Cases
Testing webhooks
Debugging API callbacks
Security testing
Bug bounty hunting
⚡ Developer Benefits
Supports MCP clients using webhook-related tools
Provides a centralized way to inspect webhook-site events from MCP workflows
⚠️ Limitations
Server documentation excerpt does not specify tool count or detailed MCP tool/function interfaces.
A Model Context Protocol (MCP) server for webhook.site - instantly capture HTTP requests, emails, and DNS lookups. Perfect for testing webhooks, debugging API callbacks, security testing, and bug bounty hunting.
Security helper tools (SSRF, XSS, canary tokens) are for authorized testing only — systems you own or have explicit permission to test.
All settings are environment variables on the server process. Put them in the env block of your MCP client config.
Variable
Purpose
WEBHOOK_SITE_API_KEY
Your webhook.site API key. Makes new URLs permanent (your plan's quota) and unlocks list_webhooks, Custom Actions, Schedules, Global Variables, Groups, Queue Profiles, Templates, Databases, Users and CSV export
WEBHOOK_SITE_DEFAULT_EXPIRY
Seconds until new URLs expire when the call does not pass expiry. Unset means permanent on a paid account (7 days for anonymous URLs)
WEBHOOK_MCP_RATE_LIMIT_MAX_WAIT
When webhook.site answers 429 with a Retry-After up to this many seconds (default 15), the call waits and retries once; longer waits are reported as an error naming the wait
FOLLOW_EMAIL_LINK_ALLOW_HOSTS
follow_email_link only opens links to public internet hosts, and connects to the address it checked (no DNS rebinding). To test a sign-up flow on your own machine or intranet, list what to allow: localhost,127.0.0.1,*.corp.example,10.0.0.0/8
HTTPS_PROXY / HTTP_PROXY / NO_PROXY
Honoured by follow_email_link. The proxy makes the connection, so the target is checked before the request instead of being pinned
SSL_CERT_FILE / SSL_CERT_DIR
Custom CA bundle for follow_email_link, for corporate TLS interception
If the request to a verification link completes and then redirects somewhere that is not allowed (a local dev server, an intranet dashboard), the tool reports that hop's status with the refused target in blocked_redirect instead of failing: the request that consumed the token already went through, whether or not the site counted it as verified.
What Can You Do?
Capture Webhooks
code
"Create a webhook and show me the URL"
"What requests have been sent to my webhook?"
"Wait for a request to come in"
Webhooks
Security/Bug Bounty:
code
"Generate an SSRF payload to test for blind vulnerabilities"
"Create XSS callback payloads to detect blind XSS attacks"
"Make me a canary token to detect if someone accesses a URL"
Security
Email Automation:
code
"Create a temp email and wait for a password reset link"
"Monitor this webhook for emails and extract all links from them"
"Give me 3 temporary emails at once" (batch creation)
Email
API Testing:
code
"Create a webhook that returns a 404 error with a custom message"
"Make a webhook with CORS enabled that waits 5 seconds before responding"
"Send 10 different test requests to a webhook and show me all the captured data"
"Hold the next request and answer it with a 402 and this JSON body"
API
Real-time Monitoring:
code
"Create a webhook and wait for any HTTP request to arrive"
"Monitor for DNS lookups to detect if a server is making DNS queries"
"Search all requests for ones containing 'password' in the body"
Monitoring
Data Analysis:
code
"Export all captured webhook requests to JSON format"
"Show me statistics on requests received in the last hour"
"Filter and show only POST requests with specific headers"
Data
Automate with your account:
code
"Add a Custom Action that forwards every request to my staging API"
"Schedule a health check of https://example.com every 5 minutes and alert on a bad status"
"Write a WebhookScript that answers with the request's JSON field 'id'"
Practical
Canary Tokens
code
"Create a canary URL to track document access"
"Generate a DNS canary for the config file"
"Set up an email tracker pixel"
CanaryTokens
Tools Reference
Everything works without an account on anonymous 7-day URLs. With WEBHOOK_SITE_API_KEY set, URLs are permanent and the account tools unlock the features of your plan. Every webhook_token accepts the UUID, an alias, a pasted https://webhook.site/... URL or the inbox address. Full parameters for each tool: docs/TOOLS.md.
31 tools, generated from the server by scripts/gen_tool_docs.py.
Diagnostics
Tool
What it does
server_status
Check this server's setup: API key, account reachability, plan, real-time socket, env config.
Webhooks
Tool
What it does
create_webhook
Create a disposable inbox to sign up on a website: HTTP URL, temp email, DNS.
configure_webhook
Create a webhook with custom settings, or update one (pass webhook_token).
get_webhook_info
Show a webhook's settings, expiry, request count and every address.
get_webhook_email
Return the temp inbox to sign up, verify, magic-link, or reset a password.
list_webhooks
List the webhooks (URLs / inboxes) in the account. Needs WEBHOOK_SITE_API_KEY.
delete_webhook
Permanently delete a webhook and every captured request/email.
Requests
Tool
What it does
send_requests
Send one JSON body (data) or several (payloads) to the webhook URL to test capture.
get_webhook_requests
List captured HTTP, email, or DNS events for a webhook, one page at a time.
search_requests
Search captured events by method, body text, headers, type, or date.
get_request
Return one captured event: the newest by default, or request_id.
update_request
Attach a note to a captured request, or set its dynamic response.
download_request_file
Download an uploaded file or email attachment (base64) by its file_id.
delete_request
Delete one captured HTTP, email, or DNS event by request id.
delete_all_requests
Clear captured events on a webhook, optionally by date or search query.
export_webhook_data
Full dump of captured events with HTML and untruncated bodies, as JSON or CSV.
Real-time
Tool
What it does
wait_for_request
Wait until a new HTTP (or DNS) callback hits the webhook (1-120s).
wait_for_email
Wait for a sign-up, verify, magic-link, or password-reset email (1-120s).
respond_to_next_request
Hold the next request that hits the webhook and answer it with your own status, headers and body.
follow_email_link
Open the verify / magic-link / reset URL from a captured sign-up email.
Account features (API key)
Tool
What it does
manage_custom_actions
Manage the Custom Actions webhook.site runs on every request or email a token receives.
manage_schedules
Manage Schedules: webhook.site calls request_url on an interval (needs API key).
manage_global_variables
Manage Global Variables shared by all URLs, usable as $name$ in Custom Actions and Schedules.
manage_groups
Manage Groups that organise the account's webhooks (needs API key).
manage_queues
Manage Queue Profiles that throttle queued Custom Actions (needs API key).
manage_templates
Manage Templates: reusable sets of Custom Actions plus predefined variables (needs API key).
manage_databases
Manage webhook.site Databases and run SQL against them (needs API key).
manage_users
Manage team users on an Enterprise account (needs an administrator API key).
Security testing
Tool
What it does
generate_oob_payloads
Build authorized out-of-band payloads that ping this webhook: SSRF URLs, XSS callbacks, or canary tokens.
check_for_callbacks
See if SSRF, XSS, or canary callbacks arrived in the last N minutes.
extract_links_from_request
Pull confirm, reset, magic-link, and other URLs from a captured email or HTTP body.
create_webhook — get email ({token}@emailhook.site)
Use that address on the site (sign-up, verify, magic link, or password reset)
wait_for_email — receive the message, confirm / login / reset URLs, and any OTP
follow_email_link to open a verify link, or type verification_codes on the site
If you already have a token, get_webhook_email returns the same inbox.
Create a Webhook
json
// Response from create_webhook{"token":"abc123-def456-...","url":"https://webhook.site/abc123-def456-...","email":"abc123-def456-...@emailhook.site","dns":"abc123-def456-....dnshook.site"}
Wait for Password Reset Email
json
// Response from wait_for_email{"email_received":true,"subject":"Password Reset Request","from":"noreply@example.com","auth_links":["https://example.com/reset?token=xyz789"],"verification_codes":["847291"]}
Poll for new events without paging
json
// get_webhook_requests(webhook_token, since=<next_since from the previous call>){"requests":[ ... only what arrived after the cursor ... ],"next_since":1788472548944304}
SSRF Testing Payload
json
// Response from generate_oob_payloads(kind="ssrf"){"payloads":{"http":"https://webhook.site/token?id=ssrf-test","dns":"ssrf-test.token.dnshook.site","ip_decimal":"http://2130706433/token","ip_hex":"http://0x7f000001/token"}}
git clone https://github.com/zebbern/webhook-mcp-server.git
cd webhook-mcp-server
pip install -e ".[dev]"
pytest -m "not live and not live_auth"# offline suite incl. replay of recorded live exchanges
python server.py # run the server on stdio
The offline suite replays real recorded webhook.site exchanges; the live tool check and the live / live_auth tiers hit the real API. Details in docs/testing.md.
Layout: server.py (entry point and lifespan), handlers/tools.py (tool registrations), services/ (one module per API area), utils/ (HTTP client, real-time socket, URL safety, references), scripts/ (live check, generators, verifiers), evals/ (model-in-the-loop prompts).
python-socketio[asyncio_client] >= 5.11.0 (real-time waiting; the tools fall back to polling without it)
Contributing
Bug reports and PRs are welcome. Keep a PR to one change, add a test whose expectation was checked against the real API (see docs/testing.md), and run python scripts/gen_tool_docs.py after touching a tool.
