# Hookjar

> Public webhook inboxes for agents. Receive OAuth redirects, payment callbacks and CI notifications.

- name: lighting.comiza/hookjar
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 79/100 flags: no-repository
- quality: 83/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/lighting.comiza%2Fhookjar
- tools: https://api.protogrid.dev/v1/servers/lighting.comiza%2Fhookjar/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "hookjar": {
      "type": "http",
      "url": "https://comiza.lighting/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 99
- freshness: 85
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-98% ~updated-72d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 83/100 (good)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list carries no ttlMs, so clients re-fetch it

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: create_inbox (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_inboxes (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_requests (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 468 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 6, about 468 tokens to load them all
- tool set hash: 0a6d7d9b70571c610d28cea8556d2af6
- badge: [![protogrid quality](https://protogrid.dev/badge/lighting.comiza/hookjar.svg)](https://protogrid.dev/servers/lighting.comiza/hookjar)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://comiza.lighting/mcp (streamable-http, auth none, reachable true, uptime30d 0.982906)

## Packages

_none_

## Tools (6)

- `create_inbox`: Create a public URL that captures any HTTP request sent to it. Use it when you need something outside this session to reach you: an OAuth redirect, a payment provider callback, a CI notification, a webhook you are testing. Returns the URL to hand to the other service. Requests are readable with get_requests or wait_for_request.
- `delete_inbox`: Delete an inbox and everything captured in it.
- `get_request`: Return the full method, headers, query string and body of a single captured request. Text bodies come back as text, binary as base64.
- `get_requests`: List what has arrived in an inbox, newest last. Returns summaries without bodies. Use get_request for the full contents of one.
- `list_inboxes`: List the inboxes you currently own, with their URLs and expiry.
- `wait_for_request`: Block until a request lands in the inbox, then return it. This is the tool to use straight after you have triggered the action that should produce the callback. Returns immediately if something already arrived after the sequence number you pass.