# Datoka Hooks

> Public webhook relay with signed observations, retries and verified receivers. Self-service.

- name: dev.workers.bhazarstudio.datoka-hooks-test/datoka-hooks
- version: 0.7.6
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 79/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/dev.workers.bhazarstudio.datoka-hooks-test%2Fdatoka-hooks
- tools: https://api.protogrid.dev/v1/servers/dev.workers.bhazarstudio.datoka-hooks-test%2Fdatoka-hooks/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "datoka-hooks": {
      "type": "http",
      "url": "https://datoka-hooks.bhazarstudio.workers.dev/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-16d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 79/100 (good)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 9 of 9 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 2,504 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 11 tool changes in 30 days
- fail `stability.rug_pull`: 8 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 9, about 2,504 tokens to load them all
- tool set hash: b6c39dca2a772123aee89901de5f4e09
- tools last changed: 2026-10-07T07:48:22.809Z
- badge: [![protogrid quality](https://protogrid.dev/badge/dev.workers.bhazarstudio.datoka-hooks-test/datoka-hooks.svg)](https://protogrid.dev/servers/dev.workers.bhazarstudio.datoka-hooks-test/datoka-hooks)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-07 `verify_hook_receipt` changed (title, description, inputSchema) **meaning changed**
  - before: Verify a relay receipt within your authenticated hook.
  - after: Check an unchanged event and signed receipt returned by get_hook_delivery within the authenticated hook. Requires the delivery token; does not send an event. A valid signature attests relay observations, not business truth or exactly-once processing.
- 2026-10-07 `get_hook_delivery` changed (title, description, inputSchema) **meaning changed**
  - before: Read delivery state and signed observations.
  - after: Read one accepted event by its returned deliveryId and hook delivery token. Poll after accept_hook_event to distinguish queued, retried and completed delivery. Signed observations attest relay attempts, not successful business processing by the receiver. No new delivery or payment.
- 2026-10-07 `accept_hook_event` changed (title, description, inputSchema) **meaning changed**
  - before: Enqueue an event for your verified receiver, idempotent by eventId and exact bytes.
  - after: Enqueue up to 65536 payload bytes for a previously verified receiver using its delivery token. Returns a deliveryId, not proof of delivery. Reuse eventId and exact bytes on retries, then poll get_hook_delivery. The free allowance is 100 events/day per verified receiver; extra admissions consume purchased credits. No arbitrary destination can be supplied here.
- 2026-10-07 `revoke_destination` changed (title, description, inputSchema) **meaning changed**
  - before: Permanently revoke client access. Previously accepted deliveries finish.
  - after: Permanently revoke this hook with its management token after explicit owner approval. New submissions are rejected; previously accepted deliveries finish. This does not cancel queued events and cannot be undone. Use get_destination_status first if you only need to inspect access.
- 2026-10-07 `get_destination_status` changed (title, description, inputSchema) **meaning changed**
  - before: Read verification/revocation status and challenge.
  - after: Read the existing hook ownership challenge and verification or revocation status using its management token. No activation or delivery. Use after registration or an interrupted verification; use get_hook_delivery for one accepted event.
- 2026-10-07 `verify_destination` changed (title, description, inputSchema) **meaning changed**
  - before: Verify the well-known challenge file and activate your destination.
  - after: Fetch the ownership challenge from the previously registered receiver and activate it when valid. First publish the exact challenge returned by register_destination. Requires the management token; does not deliver an event. Use get_destination_status to inspect progress without activation.
- 2026-10-07 `register_destination` changed (title, description, inputSchema) **meaning changed**
  - before: Create an isolated access. Keep recoveryKey secret and reuse it only with the same target on retries.
  - after: Register an HTTPS receiver you control. Returns hookId, private credentials and the ownership challenge; delivery remains inactive. Publish the exact challenge on your origin, then call verify_destination. Keep recoveryKey secret and reuse it with the identical target after interruption; do not register again with a new key.
- 2026-10-07 `purchase_hook_credits` changed (title, inputSchema)
- 2026-10-07 `get_hook_credits` changed (title, description, inputSchema) **meaning changed**
  - before: Read your extra admission credit balance.
  - after: Read remaining purchased admission credits for an existing hook using its management token. Free and read-only; does not purchase credits. Use purchase_hook_credits to request a quote. The daily free allowance remains separate.
- 2026-10-02 `purchase_hook_credits` added
  - Request an x402 quote without payment, or buy credits with an explicitly authorized signed payment. Reuse purchaseId and the same payment after any timeout.

Full history: https://api.protogrid.dev/v1/servers/dev.workers.bhazarstudio.datoka-hooks-test%2Fdatoka-hooks/changes

## Remotes

- https://datoka-hooks.bhazarstudio.workers.dev/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (9)

- `accept_hook_event`: Enqueue up to 65536 payload bytes for a previously verified receiver using its delivery token. Returns a deliveryId, not proof of delivery. Reuse eventId and exact bytes on retries, then poll get_hook_delivery. The free allowance is 100 events/day per verified receiver; extra admissions consume purchased credits. No arbitrary destination can be supplied here.
- `get_destination_status`: Read the existing hook ownership challenge and verification or revocation status using its management token. No activation or delivery. Use after registration or an interrupted verification; use get_hook_delivery for one accepted event.
- `get_hook_credits`: Read remaining purchased admission credits for an existing hook using its management token. Free and read-only; does not purchase credits. Use purchase_hook_credits to request a quote. The daily free allowance remains separate.
- `get_hook_delivery`: Read one accepted event by its returned deliveryId and hook delivery token. Poll after accept_hook_event to distinguish queued, retried and completed delivery. Signed observations attest relay attempts, not successful business processing by the receiver. No new delivery or payment.
- `purchase_hook_credits`: Request an x402 quote without payment, or buy credits with an explicitly authorized signed payment. Reuse purchaseId and the same payment after any timeout.
- `register_destination`: Register an HTTPS receiver you control. Returns hookId, private credentials and the ownership challenge; delivery remains inactive. Publish the exact challenge on your origin, then call verify_destination. Keep recoveryKey secret and reuse it with the identical target after interruption; do not register again with a new key.
- `revoke_destination`: Permanently revoke this hook with its management token after explicit owner approval. New submissions are rejected; previously accepted deliveries finish. This does not cancel queued events and cannot be undone. Use get_destination_status first if you only need to inspect access.
- `verify_destination`: Fetch the ownership challenge from the previously registered receiver and activate it when valid. First publish the exact challenge returned by register_destination. Requires the management token; does not deliver an event. Use get_destination_status to inspect progress without activation.
- `verify_hook_receipt`: Check an unchanged event and signed receipt returned by get_hook_delivery within the authenticated hook. Requires the delivery token; does not send an event. A valid signature attests relay observations, not business truth or exactly-once processing.