# Hookden

> Webhook capture bins for agents: get a URL, wait for webhooks, set replies, verify signatures.

- name: dev.pages.hookden/hookden
- version: 1.3.0
- connection class: R0 (autonomous)
- trust: 80/100 flags: no-repository
- quality: 79/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/dev.pages.hookden%2Fhookden
- tools: https://api.protogrid.dev/v1/servers/dev.pages.hookden%2Fhookden/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "hookden": {
      "type": "http",
      "url": "https://hookden.pages.dev/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 85
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% ~updated-50d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 79/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: verify_signature (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_bin (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_captures (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 1,704 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 7, about 1,704 tokens to load them all
- tool set hash: bb7f5533cb23af3affd36293be9d0b92
- badge: [![protogrid quality](https://protogrid.dev/badge/dev.pages.hookden/hookden.svg)](https://protogrid.dev/servers/dev.pages.hookden/hookden)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://hookden.pages.dev/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (7)

- `create_bin`: Create a new webhook capture bin. Returns a public capture_url — point any webhook (Stripe, GitHub, Slack, your own service…) at it and every request sent there (any method, any subpath, headers + raw body) is stored. Then read what arrived with list_captures, get_capture, or wait_for_capture. Anonymous bins keep requests ~24h. No auth needed.
- `get_capture`: Get one captured request in full: method, path, query, every header, and the body. Binary bodies are returned base64-encoded (up to 8KB, with a URL for the raw bytes).
- `list_captures`: List requests captured by a bin, oldest first. Compact summaries (id, method, path, time, content-type, body size, signature status). Use get_capture for full headers/body. Pass `after` (a capture id) to only see newer captures.
- `send_test_webhook`: Simulate a webhook delivery into a bin — no external sender or HTTP client needed. Seeds one realistic, clearly-labeled sample capture (default: a GitHub push event) and returns it in full, so you can exercise the whole loop (create_bin → send_test_webhook → list_captures / get_capture) entirely from MCP. Pass `example` to pick a provider payload from the /examples library (e.g. "stripe-payment-intent-succeeded", "slack-event-callback", "shopify-order-created"). Sample captures are marked as simulated and never count as real webhook traffic.
- `set_response`: Configure what a bin replies to webhook senders: HTTP status, content-type, body, custom response headers, optional delay. Body and header values support {{…}} templates rendered per-request from the INCOMING delivery — {{body.challenge}}, {{query.hub.challenge}}, {{header.x-hook-secret}}, {{hmac_sha256 body.plainToken YOUR_SECRET}} — so a bin can pass provider verification handshakes with zero code: Slack URL verification (body {{body.challenge}}), Zoom CRC (JSON with the hmac_sha256 helper), Meta/WhatsApp GET echo (text/plain {{query.hub.challenge}}), Strava (JSON {"hub.challenge":"{{query.hub.challenge}}"}), Asana (response header X-Hook-Secret: {{header.x-hook-secret}}). Only the fields you pass change; everything else keeps its current value. Works on bins created via create_bin by this same client; the incoming request is still captured in full either way.
- `verify_signature`: Verify a webhook signature against a secret — 25 provider-exact schemes plus a generic HMAC mode, the same engine that computes ✓/✗ badges on captures. Covers HMAC-SHA256 (GitHub, Stripe, Svix/Standard Webhooks, Shopify-style base64, URL-signing Square/HubSpot/Trello…), ECDSA (SendGrid), RSA (Kick) and HMAC-MD5 (Patreon). Pass the scheme, the secret, the delivery's headers, and the BYTE-EXACT raw body (body_base64 for binary). The secret is used only for this one in-memory computation — never stored or logged. No bin needed. If verification fails, the #1 cause is a re-serialized body: point the real webhook at a capture bin (create_bin) to get the true raw bytes first.
- `wait_for_capture`: Block until the next request arrives at a bin (or a timeout passes), then return it in full. Ideal flow: create_bin → configure the webhook sender → trigger it → wait_for_capture. If `after_id` is omitted, waits for the next capture after "now". Returns timed_out:true instead of erroring when nothing arrives.