Which integrations are available for this server?

Allows capturing and replaying GitHub webhook requests for testing handler implementations. Supports testing Shopify webhook handlers by capturing and replaying webhook payloads. Enables testing of Stripe webhook handlers by capturing real requests, inspecting headers (including stripe-signature), and replaying them to local endpoints. Provides ability to test Twilio webhook handlers by capturing and replaying incoming requests.

How do I use hookray-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@hookray-mcp create a disposable webhook URL to test my Stripe handler" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

hookray-mcp

by ShotaTanikawa

Overview Schema Related Servers Score Discussions

TypeScript

Local

hookray-mcp

Webhook testing for AI agents — capture, inspect, replay HTTP requests from Claude Code, Cursor, Claude Desktop, or any MCP-compatible client.

npm version License: MIT

hookray-mcp is the Model Context Protocol server for HookRay. Drop it into your AI agent's config and the agent can spin up disposable webhook URLs, watch incoming requests live, and replay captured payloads against your local handler — without leaving the chat.

Why this exists

AI coding agents increasingly write webhook handlers (Stripe, GitHub, Shopify, Twilio, …). The agent loop today is:

Generate handler code
Manually test it by triggering a real event
Manually copy/paste the captured payload back to the agent
Agent fixes the bug
Repeat from step 2

With hookray-mcp installed, the agent does steps 2–4 itself:

You: "Build me a Stripe webhook handler at /api/stripe."
Agent: [writes code, then calls hookray-mcp tools]
       → create_webhook_inbox
       → wait_for_request   (you trigger an event in Stripe)
       → inspect_request
       → replay_request to localhost:3000/api/stripe
       → "Returned 500. The bug is in the signature check at line 14."

Related MCP server: RequestBin MCP Server

Install

# Anywhere npx works
npx -y hookray-mcp@latest

# Or globally
npm install -g hookray-mcp

Node.js 20+ required.

Configure your AI client

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "hookray": {
      "command": "npx",
      "args": ["-y", "hookray-mcp@latest"]
    }
  }
}

Claude Code

claude mcp add hookray -- npx -y hookray-mcp@latest

Cursor

Add to .cursor/mcp.json in your project (or the global Cursor MCP config):

{
  "mcpServers": {
    "hookray": {
      "command": "npx",
      "args": ["-y", "hookray-mcp@latest"]
    }
  }
}

With a HookRay API key (for Pro features)

If you have a HookRay account and want persistent inboxes, pass HOOKRAY_API_KEY:

{
  "mcpServers": {
    "hookray": {
      "command": "npx",
      "args": ["-y", "hookray-mcp@latest"],
      "env": {
        "HOOKRAY_API_KEY": "hkr_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

Get a key at hookray.com/app/settings/api-keys.

Tools

Tool	Description	Auth
`create_webhook_inbox`	Generate a fresh `https://hookray.com/api/hook/xxxx` URL that captures any HTTP request. Returns the URL + inbox id.	Anonymous OK. `persistent: true` needs Pro.
`list_requests`	List recent requests captured by an inbox (with filters: method, since, search, limit).	Anonymous OK.
`inspect_request`	Get the full method + headers + body + query params of a single captured request.	Anonymous OK.
`wait_for_request`	Block (up to 60 s) until a new request arrives. Critical for AI agent dev loops.	Anonymous OK.
`replay_request`	Forward a captured request to any URL — including `localhost`. Runs client-side from this package so private IPs work.	Anonymous OK.

Environment variables

Variable	Default	Notes
`HOOKRAY_BASE_URL`	`https://hookray.com`	Override for self-hosting or local dev.
`HOOKRAY_API_KEY`	(unset)	Required for persistent inboxes. Get one at hookray.com/app/settings/api-keys.

Example: Stripe webhook handler dev loop

> "Add a Stripe webhook handler at /api/stripe/webhook in this Next.js app."
[agent writes app/api/stripe/webhook/route.ts]

> "Now test it."
[agent calls hookray-mcp]
  → create_webhook_inbox        → https://hookray.com/api/hook/abc12345
  → "Paste this URL into Stripe → Add endpoint, then trigger an event."

[you trigger a test event from Stripe dashboard]

  → wait_for_request(inbox_id)  → {method: POST, content_type: application/json, ...}
  → inspect_request(...)        → full headers (incl. stripe-signature) + body
  → replay_request(destination_url=http://localhost:3000/api/stripe/webhook)
                                → {status_code: 400, body: "No signatures..."}
  → "Your handler is reading req.json() before constructEvent. Switch to
     req.text() — Stripe's signature check needs the raw body."
[agent edits the handler]
  → replay_request(...)         → {status_code: 200}

Free vs Pro

Capability	Free	HookRay Pro
Anonymous inboxes	✅	✅
Capture, list, inspect, wait	✅	✅
Replay to any URL (incl. localhost)	✅	✅
Inbox lifetime	7 days	10 years
Multiple inboxes	1 active	up to 10
Request history	100 / month	10,000 / month

Pro is $9 / month at hookray.com/pricing.

Limitations & non-goals

stdio transport only for v0.1. SSE / HTTP transports may come later.
No automatic agent triggering of real Stripe events — you still need to fire the event yourself from the provider dashboard or CLI. (Provider-specific sample-payload tools are on the roadmap.)
No WebSocket realtime — wait_for_request long-polls (1 s tick, 60 s max). Good enough for dev loops; not designed for production traffic.
SSRF safety on replay_request is your responsibility (the package runs on your machine, in your network).

Roadmap

Provider-specific template tools (send_stripe_test_event, send_github_test_event, …)
SSE transport for hosted MCP gateways
Streamed responses for long-running replays
First-class self-host docs (point at your own HookRay instance via HOOKRAY_BASE_URL)

Development

git clone https://github.com/ShotaTanikawa/hookray-mcp.git
cd hookray-mcp
pnpm install
pnpm build
pnpm test

License

Made by @ShotaTanikawa · HookRay · Feedback welcome — open an issue.

Available Tools

5 tools

create_webhook_inboxA

Create a new HookRay webhook inbox and return its public capture URL.

ParametersJSON Schema

Name	Required	Description	Default
`persistent`	No	If true, the inbox does not expire (requires Pro plan / API key). Default: false.

Output Schema

ParametersJSON Schema

Name	Required	Description
`inbox_id`	Yes	8-char slug, e.g. abc12345
`url`	Yes	Full HTTPS URL to POST webhooks to
`expires_at`	No	ISO 8601 timestamp
`max_requests`	No

TDQS

A3.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden but only states creation and return URL. It does not disclose side effects, authentication requirements (persistent requires Pro plan/API key), or any other behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that is front-loaded with the action and result, containing no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and an output schema, the description is adequate. However, it could be strengthened by mentioning its role in a workflow alongside sibling tools like wait_for_request.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the description does not add additional meaning beyond the schema's built-in description of the 'persistent' parameter. The output URL mention is about return value, not parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (Create), the resource (HookRay webhook inbox), and the output (public capture URL). It is specific and distinguishes from sibling tools which handle existing requests rather than creating inboxes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (before capturing webhooks) but lacks explicit guidance on when to use this tool versus alternatives, or any prerequisites like needing an API key for persistent inboxes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inspect_requestB

Inspect the full headers, body, query params, and metadata for a captured request.

ParametersJSON Schema

Name	Required	Description	Default
`inbox_id`	Yes
`request_id`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`method`	Yes
`headers`	Yes
`body`	Yes
`query_params`	Yes
`content_type`	No
`captured_at`	No	ISO 8601 timestamp
`source_ip`	No

TDQS

B3.3/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It implies read-only behavior by using 'inspect', but does not disclose any further behavioral traits such as permissions, rate limits, or side effects. The description is adequate but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence of 12 words, very concise and front-loaded with the verb 'Inspect'. However, it omits necessary parameter details, which slightly reduces effectiveness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema (not shown), the description need not explain return values. However, the tool has 0% schema parameter coverage, and sibling tools are distinct, so the description is mostly complete but lacks parameter semantics, which impacts completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, meaning the input schema provides no explanations for inbox_id and request_id. The description does not clarify these parameters, leaving the agent to infer their meaning from context. This is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool inspects full headers, body, query params, and metadata for a captured request. It distinguishes from sibling tools like create_webhook_inbox, list_requests, replay_request, and wait_for_request, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives, nor any prerequisites or exclusions. The description only states what the tool does without providing context for appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_requestsB

List webhook requests captured by a HookRay inbox.

ParametersJSON Schema

Name	Required	Description
`inbox_id`	Yes
`limit`	No
`method`	No
`since`	No	Only return requests after this ISO 8601 timestamp
`search`	No	Substring match on request body

Output Schema

ParametersJSON Schema

Name	Required	Description
`requests`	Yes

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral transparency. It only says 'List', failing to disclose pagination, ordering, or whether results are sorted. Schema hints at filtering but description adds no behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at 7 words, with no wasted words. However, it could be slightly more informative without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of 5 parameters, an output schema, and no annotations, the description is insufficient. It omits critical details like filtering options, pagination, and return format, leaving the agent underinformed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 40%, yet the tool description adds no parameter information beyond what the schema already provides. It does not explain the meaning of parameters like limit, method, or inbox_id.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool lists webhook requests from a HookRay inbox, with a specific verb and resource. It differentiates itself from siblings like create_webhook_inbox or inspect_request.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The purpose is implied by the name and description, but there is no direct comparison or exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

replay_requestB

Replay a captured HookRay request to any destination reachable from this machine.

ParametersJSON Schema

Name	Required	Description
`inbox_id`	Yes
`request_id`	Yes
`destination_url`	Yes	Where to forward the captured request. Any URL reachable from the user's machine is allowed.
`override_method`	No	Override the original request method.
`timeout_seconds`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`status_code`	Yes
`response_body_preview`	Yes	First 10 KB of the response body
`response_headers`	Yes
`latency_ms`	Yes

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only says 'replay', hinting at network activity but not explaining side effects, whether it modifies original data, or any authentication requirements. Schema fields like timeout_seconds suggest execution duration but lack elaboration.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence of 15 words, front-loaded with the core action. No unnecessary words. Every part is essential.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite 5 parameters and 3 required ones, the description omits context about what 'captured' means, how to obtain inbox_id/request_id, and what the output schema returns. The tool is moderately complex but the description is too sparse.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 40% (only destination_url and override_method have descriptions). The tool description adds no parameter meaning beyond what's in the schema. For inbox_id and request_id, no guidance is provided on where to obtain them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (replay), the resource (captured HookRay request), and the destination (any reachable from this machine). It distinguishes from sibling tools like create_webhook_inbox, inspect_request, etc., which do not perform replay.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for replaying requests but does not explicitly say when to use this tool versus alternatives like inspect_request or wait_for_request. There is no when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wait_for_requestB

Block until a new webhook arrives at an inbox, or return a timeout result.

ParametersJSON Schema

Name	Required	Description
`inbox_id`	Yes
`timeout_seconds`	No
`since`	No	Only consider requests captured after this ISO 8601 timestamp. Default: now.

TDQS

B3.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the blocking behavior and timeout result, but with no annotations, it falls short on details like side effects, idempotency, or whether it can be cancelled. The timeout parameter is mentioned implicitly but not fully explained.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise (one sentence) and front-loaded, but it is borderline under-specified. Every word earns its place, but it lacks context for effective tool invocation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description is too sparse for a blocking tool with three parameters. It fails to explain what the timeout result looks like, how to interpret the response, or that the call is long-running.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not explain any of the three parameters (inbox_id, timeout_seconds, since). With only 33% schema description coverage, the description should compensate, but it adds no parameter-specific meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool blocks until a new webhook arrives or returns a timeout result. The verb 'wait' matches the tool name, and the resource 'request' is implied. It distinguishes from siblings like 'create_webhook_inbox' (creation) and 'inspect_request' (inspection).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage as a blocking wait for new webhooks, but it doesn't explicitly state when to use this over alternatives like 'list_requests' or 'replay_request'. No guidance on prerequisites (e.g., create inbox first) or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

5 tool updatesv0.1.1May 28, 2026
- First observedcreate_webhook_inbox
- First observedinspect_request
- First observedlist_requests
- First observedreplay_request
- First observedwait_for_request

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.7/5.0

Disambiguation5/5

Each tool has a clearly distinct purpose: creating an inbox, listing requests, inspecting a request, replaying a request, and waiting for new requests. No ambiguity between them.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern (e.g., create_webhook_inbox, list_requests). No mixing of conventions.

Tool Count5/5

With 5 tools, the set is well-scoped for a webhook debugging server. Not too few or too many.

Completeness4/5

Core operations are covered (create, list, inspect, replay, wait). Missing delete functionality for inboxes or requests, but the agent can work around this minor gap.

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

pipehero A
io.github.pipehero
Debug webhooks from your AI agent: inspect and replay captured webhooks on localhost.
Developer Tools API Testing
72
AnyHook AOAuth
net.anyhook
A webhook inbox for agents: one call returns a live URL. Mock, verify, inspect and replay.
API Testing Testing & QA Tools Developer Tools
1
catchr A
dev.workers.perch-app.catchr
Instant no-signup webhook & HTTP-request inspector for testing webhooks and agent tool-callbacks.
API Testing Developer Tools
41
WebhookTest.net A
net.webhooktest
Anonymous webhook capture, inspection, waiting, and response configuration for AI agents.
API Testing Developer Tools Autonomous Agents
81

Related MCP Servers

UseWebhook MCP
API Testing Developer Tools Testing & QA Tools
figstra
A
license
Not graded
quality
D
maintenance
Enables generating webhook endpoints for testing, inspecting and comparing HTTP request payloads, replaying requests from history, and forwarding requests to localhost.
Updated a year ago (2025-07-02 19:13 UTC)
2
MIT
RequestBin MCP Serverofficial
API Testing Developer Tools Testing & QA Tools
requestbin
A
license
A
quality
D
maintenance
Enables AI coding agents to create webhook bins, inspect and replay HTTP requests, and stand up mock API endpoints directly from the editor.
Updated 3 months ago (2026-05-23 09:20 UTC)
13
14
MIT
hooksense-mcp
Autonomous Agents App Automation
ozers
A
license
A
quality
B
maintenance
Enables AI agents to create callback endpoints, wait for async webhook results, and verify signatures, eliminating the need for polling.
Updated 2 months ago (2026-07-06 20:17 UTC)
8
46
2
MIT
Webhook Capture MCP
API Testing Developer Tools
void-pulse
A
license
A
quality
C
maintenance
Captures incoming webhook/HTTP requests and lets AI assistants inspect, wait for, and replay them to debug webhook integrations.
Updated 24 days ago (2026-08-12 22:55 UTC)
6
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ShotaTanikawa/hookray-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

hookray-mcp

Why this exists

Install

Configure your AI client

Claude Desktop

Claude Code

Cursor

With a HookRay API key (for Pro features)

Tools

Environment variables

Example: Stripe webhook handler dev loop

Free vs Pro

Limitations & non-goals

Roadmap

Development

License

Available Tools

Output Schema

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

RequestBin MCP Serverofficial

Latest Blog Posts

MCP directory API