Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "hookden": {
      "type": "http",
      "url": "https://hookden.pages.dev/mcp"
    }
  }
}

claude mcp add --transport http hookden https://hookden.pages.dev/mcp

[mcp_servers.hookden]
url = "https://hookden.pages.dev/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hookden": {
      "type": "remote",
      "url": "https://hookden.pages.dev/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "hookden": {
      "type": "http",
      "url": "https://hookden.pages.dev/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=hookden&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vaG9va2Rlbi5wYWdlcy5kZXYvbWNwIn0%3D"
}

{
  "servers": {
    "hookden": {
      "type": "http",
      "url": "https://hookden.pages.dev/mcp"
    }
  }
}

{
  "mcpServers": {
    "hookden": {
      "httpUrl": "https://hookden.pages.dev/mcp"
    }
  }
}

extensions:
  "hookden":
    enabled: true
    name: "hookden"
    type: streamable_http
    uri: "https://hookden.pages.dev/mcp"
    timeout: 300

Quality 79 / 100good

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene71 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
fail
tools.annotationsno tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: create_bin (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); send_test_webhook (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); set_response (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
pass
tools.token_costabout 1,704 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

7 tools, about 1,704 tokens to load them all · tool set bb7f5533cb23 · checked 2026-10-19 16:53 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 80 / 100

no-repository

provenance55

liveness100

freshness85

hygiene80

+dns-namespace +website +reachable +uptime-100% ~updated-49d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://hookden.pages.dev/mcp` streamable-http	none	yes	100%	331 ms	2025-06-18	2026-10-19

Tools (7)

`create_bin`	Create a new webhook capture bin. Returns a public capture_url — point any webhook (Stripe, GitHub, Slack, your own service…) at it and every request sent there (any method, any subpath, headers + raw body) is stored. Then read what arrived with list_captures, get_capture, or wait_for_capture. Anonymous bins keep requests ~24h. No auth needed.
`get_capture`	Get one captured request in full: method, path, query, every header, and the body. Binary bodies are returned base64-encoded (up to 8KB, with a URL for the raw bytes).
`list_captures`	List requests captured by a bin, oldest first. Compact summaries (id, method, path, time, content-type, body size, signature status). Use get_capture for full headers/body. Pass `after` (a capture id) to only see newer captures.
`send_test_webhook`	Simulate a webhook delivery into a bin — no external sender or HTTP client needed. Seeds one realistic, clearly-labeled sample capture (default: a GitHub push event) and returns it in full, so you can exercise the whole loop (create_bin → send_test_webhook → list_captures / get_capture) entirely from MCP. Pass `example` to pick a provider payload from the /examples library (e.g. "stripe-payment-intent-succeeded", "slack-event-callback", "shopify-order-created"). Sample captures are marked as simulated and never count as real webhook traffic.
`set_response`	Configure what a bin replies to webhook senders: HTTP status, content-type, body, custom response headers, optional delay. Body and header values support {{…}} templates rendered per-request from the INCOMING delivery — {{body.challenge}}, {{query.hub.challenge}}, {{header.x-hook-secret}}, {{hmac_sha256 body.plainToken YOUR_SECRET}} — so a bin can pass provider verification handshakes with zero code: Slack URL verification (body {{body.challenge}}), Zoom CRC (JSON with the hmac_sha256 helper), Meta/WhatsApp GET echo (text/plain {{query.hub.challenge}}), Strava (JSON {"hub.challenge":"{{query.hub.challenge}}"}), Asana (response header X-Hook-Secret: {{header.x-hook-secret}}). Only the fields you pass change; everything else keeps its current value. Works on bins created via create_bin by this same client; the incoming request is still captured in full either way.
`verify_signature`	Verify a webhook signature against a secret — 25 provider-exact schemes plus a generic HMAC mode, the same engine that computes ✓/✗ badges on captures. Covers HMAC-SHA256 (GitHub, Stripe, Svix/Standard Webhooks, Shopify-style base64, URL-signing Square/HubSpot/Trello…), ECDSA (SendGrid), RSA (Kick) and HMAC-MD5 (Patreon). Pass the scheme, the secret, the delivery's headers, and the BYTE-EXACT raw body (body_base64 for binary). The secret is used only for this one in-memory computation — never stored or logged. No bin needed. If verification fails, the #1 cause is a re-serialized body: point the real webhook at a capture bin (create_bin) to get the true raw bytes first.
`wait_for_capture`	Block until the next request arrives at a bin (or a timeout passes), then return it in full. Ideal flow: create_bin → configure the webhook sender → trigger it → wait_for_capture. If `after_id` is omitted, waits for the next capture after "now". Returns timed_out:true instead of erroring when nothing arrives.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "dev.pages.hookden/hookden",
  "icons": [
    {
      "src": "https://hookden.pages.dev/icon.png",
      "sizes": [
        "192x192"
      ],
      "mimeType": "image/png"
    },
    {
      "src": "https://hookden.pages.dev/favicon.svg",
      "sizes": [
        "any"
      ],
      "mimeType": "image/svg+xml"
    }
  ],
  "title": "Hookden",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://hookden.pages.dev/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.3.0",
  "websiteUrl": "https://hookden.pages.dev",
  "description": "Webhook capture bins for agents: get a URL, wait for webhooks, set replies, verify signatures."
}