Skip to main content
Glama
zebbern

Webhook.site MCP Server

by zebbern

Сервер MCP для Webhook.site

PyPI Python MCP

Сервер Model Context Protocol (MCP) для webhook.site — мгновенно перехватывайте HTTP-запросы, электронные письма и DNS-запросы. Идеально подходит для тестирования вебхуков, отладки API-колбэков, проверки безопасности и охоты за багами.

Инструменты безопасности (SSRF, XSS, canary-токены) предназначены только для авторизованного тестирования — систем, которыми вы владеете или на тестирование которых у вас есть явное разрешение.


Содержание


Related MCP server: hookray-mcp

Быстрый старт

Установка

# Using uvx (recommended - no install needed)
uvx webhook-mcp-server==2.2.2

# Or install via pip
pip install webhook-mcp-server==2.2.2

Используйте версию 2.2.2 или новее. 2.1.3 не запускается на MCP 2.0.

VS Code / GitHub Copilot

Добавьте в .vscode/mcp.json:

{
  "servers": {
    "webhook-mcp-server": {
      "type": "stdio",
      "command": "uvx",
      "args": ["webhook-mcp-server==2.2.2"]
    }
  }
}

Cursor

Добавьте в .cursor/mcp.json (проект) или в пользовательскую MCP-конфигурацию:

{
  "mcpServers": {
    "webhook-mcp-server": {
      "command": "uvx",
      "args": ["webhook-mcp-server==2.2.2"]
    }
  }
}

Claude Desktop

Добавьте в claude_desktop_config.json:

{
  "mcpServers": {
    "webhook-mcp-server": {
      "command": "uvx",
      "args": ["webhook-mcp-server==2.2.2"]
    }
  }
}

Что вы можете делать?

Перехват вебхуков

"Create a webhook and show me the URL"
"What requests have been sent to my webhook?"
"Wait for a request to come in"

Безопасность / Bug Bounty:

"Generate an SSRF payload to test for blind vulnerabilities"
"Create XSS callback payloads to detect blind XSS attacks"
"Make me a canary token to detect if someone accesses a URL"

Автоматизация электронной почты:

"Create a temp email and wait for a password reset link"
"Monitor this webhook for emails and extract all links from them"
"Give me 3 temporary emails at once" (batch creation)

Тестирование API:

"Create a webhook that returns a 404 error with a custom message"
"Make a webhook with CORS enabled that waits 5 seconds before responding"
"Send 10 different test requests to a webhook and show me all the captured data"

Мониторинг в реальном времени:

"Create a webhook and wait for any HTTP request to arrive"
"Monitor for DNS lookups to detect if a server is making DNS queries"
"Search all requests for ones containing 'password' in the body"

Анализ данных:

"Export all captured webhook requests to JSON format"
"Show me statistics on requests received in the last hour"
"Filter and show only POST requests with specific headers"

Творческие/практические сценарии:

"Create a webhook that pretends to be a Stripe payment API"
"Make a fake login endpoint that captures credentials (for pentesting)"
"Set up an email inbox that auto-extracts verification codes"

Canary-токены

"Create a canary URL to track document access"
"Generate a DNS canary for the config file"
"Set up an email tracker pixel"

Справочник инструментов

Управление вебхуками

Инструмент

Описание

create_webhook

Начните здесь: одноразовый URL, временная почта и DNS для регистрации или колбэков

create_webhook_with_config

Создание с пользовательским ответом, статусом, CORS, таймаутом

get_webhook_url

Получить полный URL для токена вебхука

get_webhook_email

Временный почтовый ящик {token}@email.webhook.site для регистрации / проверки / magic-link / сброса пароля

get_webhook_dns

Получить DNS-поддомен для вебхука

get_webhook_info

Получить настройки и статистику вебхука

update_webhook

Изменить конфигурацию вебхука

delete_webhook

Удалить конечную точку вебхука

Обработка запросов

Инструмент

Описание

send_to_webhook

Отправить JSON-данные на вебхук

get_webhook_requests

Список всех перехваченных запросов

search_requests

Поиск с фильтрами (метод, содержимое, дата)

get_latest_request

Получить самый последний перехваченный запрос

delete_request

Удалить конкретный запрос

delete_all_requests

Массовое удаление с фильтрами

Ожидание в реальном времени

Инструмент

Описание

wait_for_request

Ожидание нового HTTP-запроса (опрос, 1–120 с). Установите return_existing, чтобы использовать старый трафик.

wait_for_email

После регистрации: ожидание письма со ссылкой для проверки / magic-link / сброса и OTP-кодами

follow_email_link

Открыть перехваченный URL из письма (проверка / magic / сброс) и вернуть содержимое страницы

Безопасность / Bug Bounty

Инструмент

Описание

generate_ssrf_payload

Создание SSRF-тестовых нагрузок (HTTP, DNS, на основе IP)

generate_xss_callback

Создание XSS-колбэков с перехватом cookie/DOM

generate_canary_token

Создание отслеживаемых URL, DNS или email-канареек

check_for_callbacks

Быстрая проверка OOB-колбэков

extract_links_from_request

Извлечение ссылок подтверждения / сброса / magic-link из письма или HTTP-запроса

Пакетные и вспомогательные операции

Инструмент

Описание

send_multiple_requests

Отправка пакета запросов для нагрузочного теста

export_webhook_data

Экспорт всех запросов в JSON


Примеры

Регистрация на сайте

  1. create_webhook — получите email ({token}@email.webhook.site)

  2. Используйте этот адрес на сайте (регистрация, проверка, magic link или сброс пароля)

  3. wait_for_email — получите письмо, ссылки для подтверждения / входа / сброса и любой OTP

  4. follow_email_link, чтобы открыть ссылку для проверки, или введите verification_codes на сайте

Если у вас уже есть токен, get_webhook_email вернёт тот же почтовый ящик.

Создание вебхука

// Response from create_webhook
{
  "token": "abc123-def456-...",
  "url": "https://webhook.site/abc123-def456-...",
  "email": "abc123-def456-...@email.webhook.site",
  "dns": "abc123-def456-....dnshook.site"
}

Ожидание письма со сбросом пароля

// Response from wait_for_email
{
  "email_received": true,
  "subject": "Password Reset Request",
  "from": "noreply@example.com",
  "auth_links": ["https://example.com/reset?token=xyz789"],
  "verification_codes": ["847291"]
}

SSRF-тестовая нагрузка

// Response from generate_ssrf_payload
{
  "payloads": {
    "http": "https://webhook.site/token?id=ssrf-test",
    "dns": "ssrf-test.token.dnshook.site",
    "ip_decimal": "http://2130706433/token",
    "ip_hex": "http://0x7f000001/token"
  }
}

Что предоставляет каждый вебхук-токен

Конечная точка

Формат

Вариант использования

HTTP URL

https://webhook.site/{token}

Перехват HTTP/HTTPS-запросов

Поддомен

https://{token}.webhook.site

Альтернативный формат URL

Email

{token}@email.webhook.site

Перехват входящих писем

DNS

{token}.dnshook.site

Перехват DNS-запросов


Архитектура

webhook-mcp-server/
├── server.py              # MCPServer entry point + lifespan
├── handlers/              # Typed @mcp.tool() registrations
├── services/              # Business logic
│   ├── webhook_service.py # Webhook CRUD
│   ├── request_service.py # Request management
│   └── bugbounty_service.py # Security payloads
├── models/                # Config / filter / result types
└── utils/                 # HTTP client, logging, validation

Ключевые особенности

  • Асинхронная архитектура — неблокирующий ввод-вывод для оптимальной производительности

  • Логика повторов — экспоненциальная задержка при временных сбоях

  • Проверка входных данных — валидация UUID, санитизация параметров

  • Структурированное логирование — JSON-логи для отладки и мониторинга

  • Типобезопасность — полные аннотации типов по всему коду


Разработка

Настройка

git clone https://github.com/zebbern/webhook-mcp-server.git
cd webhook-mcp-server
pip install -e ".[dev]"

Запуск тестов

# Offline unit tests (default for CI)
pytest -m "not live" -v

# Live webhook.site tests
pytest -m live -v

Локальный запуск

python server.py

Требования

  • Python 3.10+

  • mcp >= 2.0.0

  • httpx >= 0.25.0


Журнал изменений

Историю версий см. в CHANGELOG.md.


Вклад в проект

Вклад приветствуется! Вот как вы можете помочь:

  1. Сообщить об ошибках — откройте issue с описанием проблемы

  2. Предложить функции — откройте issue со своей идеей

  3. Отправить PR — сделайте форк репозитория и отправьте pull request

Настройка среды разработки

git clone https://github.com/zebbern/webhook-mcp-server.git
cd webhook-mcp-server
pip install -e ".[dev]"
pytest -m "not live" -v

Рекомендации

  • Следуйте существующему стилю кода

  • Добавляйте тесты для новых функций

  • Обновляйте документацию по мере необходимости

  • Держите PR сфокусированными на одном изменении


Благодарности

Этот проект не связан с webhook.site и не одобрен им.

Ссылки


Сделано с ❤️ для MCP-сообщества

Available Tools

24 tools
check_for_callbacksA

See if SSRF, XSS, or canary callbacks arrived in the last N minutes.

    Use after generate_ssrf_payload / generate_xss_callback / generate_canary_token.
    For a website verification email, use wait_for_email.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
identifierNo
since_minutesNo
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description is the sole source of behavioral context. It clearly implies a non-destructive check via 'See if ... arrived' and scopes it to callback types and a time window, but it does not explicitly state whether callbacks are consumed or whether this is a blocking vs. one-shot poll.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences place the primary behavior first, then usage context and an alternative. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The existence of an output schema means return values do not need to be restated. The description gives workflow and alternative context, but the undeclared identifier semantics and low schema coverage leave a real gap for a 3-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only webhook_token has a schema description, so the description must compensate. It indirectly documents since_minutes ('last N minutes') but gives no meaning to the nullable identifier filter, which remains ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('See if') and resource ('SSRF, XSS, or canary callbacks'), while time-window scoping differentiates it from generic request/email waiters. This is a distinct purpose among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs to use after the three generate_* tools and names wait_for_email as the correct alternative for website verification emails. This is concrete when-to-use guidance with an exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_webhookA

Create a disposable inbox to sign up on a website: HTTP URL, temp email, DNS.

    Use this first when the user wants to sign up, receive a verification /
    magic-link / password-reset email, catch a webhook callback, or get a
    one-off URL. Returns token, url, email ({token}@email.webhook.site),
    and dns. Next: give the email or URL to the site, then wait_for_email,
    then follow_email_link or use the OTP.
    
ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the transparency burden. It discloses that the tool creates a disposable inbox and returns token, URL, email, and DNS, and it outlines the intended workflow. It omits persistence/cleanup details, but the core creation and return behavior are clearly conveyed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: the first sentence defines the tool, the second states when to use it, and the third gives the downstream workflow. Every sentence earns its place, with no filler or redundant schema repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter creation tool with an output schema, the description provides complete operational context: purpose, trigger conditions, returned values, and recommended next steps. An agent can determine when to invoke create_webhook and how to proceed afterward without additional information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so there is no parameter-level semantics for the description to add. The description contributes value by explaining the returned fields (token, url, email, dns), which satisfies the baseline for a parameterless tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Create') and resource ('disposable inbox'), and enumerates concrete capabilities: HTTP URL, temp email, and DNS. It clearly establishes that this is the default first step for sign-up/verification workflows, distinguishing it from more specialized siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly lists when to use the tool: signing up, receiving verification/magic-link/password-reset emails, catching webhook callbacks, or getting a one-off URL. It also provides the recommended follow-on sequence (wait_for_email, follow_email_link/OTP), but it does not explicitly contrast it with create_webhook_with_config or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_webhook_with_configA

Create a webhook that returns a custom status, body, timeout, CORS, or alias.

    Use when the user wants the endpoint to pretend to be an API (404, delay,
    JSON body) instead of a default 200. For a normal sign-up inbox, use
    create_webhook.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
corsNo
aliasNo
expiryNo
timeoutNo
default_statusNo
default_contentNo
default_content_typeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden for behavioral disclosure. It conveys that the tool creates a webhook with customizable response behavior, but does not detail side effects, potential errors, or the impact of omitted parameters (e.g., defaults beyond the implied 200). It adds some context but not comprehensive transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, both front-loaded and relevant. The first sentence states the core function, the second provides usage guidance with an alternative. No filler or redundancies.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is moderately complex with seven optional parameters and an output schema (not shown). The description covers the primary use case but does not explain default behavior when no config is given, interactions between parameters, or how expiry works. It suffices for choosing the tool but not for fully predicting behavior without further schema info.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain all seven parameters. It only names five (status, body, timeout, CORS, alias) and does not elaborate on units, constraints, or the remaining params (expiry, default_content_type). The mapping is shallow and leaves significant gaps in understanding the parameters' meanings and valid values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates a webhook with custom status, body, timeout, CORS, or alias, and explicitly contrasts it with the simpler create_webhook for normal use cases. This distinguishes it from siblings and names the specific resources being configured.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance: use this tool when the endpoint should mimic an API (e.g., 404, delay, JSON body) rather than a default 200, and directs users to create_webhook for a standard sign-up inbox. This is strong when/when-not guidance with a named alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_all_requestsB

Clear captured events on a webhook, optionally by date or search query.

Use to reset an inbox before a new sign-up or test run.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryNo
date_toNo
date_fromNo
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavioral traits. While 'Clear captured events' implies deletion, it does not mention that the action is irreversible, the full scope (all matching requests), or any confirmations/undo options. The description's 'reset an inbox' metaphor is helpful but insufficient for a destructive operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally concise: two sentences that quickly convey the action and a primary use case. Every word earns its place with no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema and four parameters, the description lacks key details for a destructive operation: it does not state that the deletion is permanent, that it applies to all captured events for the webhook, or any safety mechanisms. The use-case sentence helps but is not enough to fully understand the tool's impact.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only documents 'webhook_token' (25% coverage). The description adds that clearing can be optionally filtered 'by date or search query', which partially explains the purpose of 'query', 'date_from', and 'date_to'. However, it does not specify the date format, query syntax, or how these parameters interact, leaving significant ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Clear captured events on a webhook') and the optional scoping by date or search query, which makes the core purpose obvious. However, it does not explicitly differentiate from the sibling tool 'delete_request' (singular) or mention 'all', relying on the tool name to imply bulk deletion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides a clear use case: 'Use to reset an inbox before a new sign-up or test run.' This gives strong contextual guidance for when to invoke the tool, though it does not mention when not to use it or name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_requestA

Delete one captured HTTP, email, or DNS event by request id.

ParametersJSON Schema
NameRequiredDescriptionDefault
request_idYes
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the destructive action and target scope, but does not disclose whether deletion is permanent, whether webhook ownership is required, or any side effects or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single 13-word sentence, front-loaded with the verb and target, with no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter delete tool with an output schema, the description is largely adequate, but it lacks usage boundaries and permanence/authorization details, leaving the agent to infer important operational context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes webhook_token as a UUID from create_webhook. The description adds that request_id identifies the event to delete, but does not provide its format, where to obtain it, or any additional context to compensate for the undocumented request_id parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Delete' and names the exact resource: 'one captured HTTP, email, or DNS event by request id.' This clearly distinguishes it from sibling tools like delete_webhook and delete_all_requests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'one...by request id' implies the tool is for deleting a single captured event, which provides some usage context. However, it does not explicitly state when not to use it or name alternatives such as delete_all_requests for bulk deletion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_webhookA

Permanently delete a webhook and every captured request/email.

Use when the user is done with a temp inbox or wants to clean up.

ParametersJSON Schema
NameRequiredDescriptionDefault
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden of behavioral disclosure. It states the action is 'Permanently delete' and that it deletes 'every captured request/email', which conveys irreversibility and scope. However, it does not mention any permissions, side effects, or error conditions. The description adds some value beyond the schema but could be more explicit about the destructive nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded. The first sentence states the core action, and the second sentence provides usage context. No wasted words; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no nested objects, output schema present), the description is fairly complete. It explains the destructive scope and usage context. It could mention that the action is irreversible, but the word 'Permanently' already implies that. The output schema exists, so return values need not be described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100% (the only parameter, webhook_token, is described as 'Webhook UUID returned by create_webhook'). The description does not add additional parameter semantics beyond what the schema provides. Baseline 3 is appropriate since the schema already documents the parameter well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Permanently delete a webhook and every captured request/email.' It uses a specific verb (delete) and resource (webhook), and distinguishes it from sibling tools like delete_request and delete_all_requests by specifying it deletes the webhook itself along with all captured data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context: 'Use when the user is done with a temp inbox or wants to clean up.' It implies when to use this tool, but does not explicitly mention alternatives or when not to use it. However, the context is clear enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

export_webhook_dataA

Full dump of captured HTTP/email/DNS events, including HTML and untruncated bodies.

Use this when list/wait tools omitted HTML or truncated a body.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility. While the tool appears to be a read-only data export (no side effects implied), the description does not explicitly state that it is non-destructive or mention any rate limits or permissions. It is adequate but could be more explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and to the point, with no unnecessary words. It efficiently conveys the tool's function and when to use it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description mentions the output includes 'HTML and untruncated bodies' which gives some context, but it does not explain the limit parameter or how pagination or data volume is handled. Since an output schema exists (as indicated), the return format need not be detailed, but the missing limit explanation leaves a slight gap in completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The webhook_token parameter is well described as 'Webhook UUID returned by create_webhook', but the limit parameter has no description in the schema nor in the tool description. With only one of two parameters documented, the schema coverage is low, and the description does not compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Full dump of captured HTTP/email/DNS events, including HTML and untruncated bodies.' It also distinguishes itself from siblings with the explicit note 'Use this when list/wait tools omitted HTML or truncated a body.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool versus alternatives: 'Use this when list/wait tools omitted HTML or truncated a body.' This directly addresses the decision point among the sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_canary_tokenA

Make a canary URL, DNS name, or email that alerts when someone opens it.

    Use to mark your own files or systems. token_type='email' is a tripwire,
    not a sign-up inbox — use create_webhook + wait_for_email for that.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
identifierNo
token_typeNourl
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It transparently states that the token 'alerts when someone opens it' and clarifies that email tokens are tripwires, not inboxes. However, it does not explicitly mention that alerts are sent via the required webhook_token, though this is implied by the parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of two sentences that directly address purpose and usage caveats without unnecessary fluff. It is well-structured and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool, the description covers its core purpose, usage, and a key behavioral note. It does not describe the return value, but that is not critical for this type of tool, and the output schema is not provided for evaluation. Overall, it is sufficiently complete for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains token_type options by mentioning URL, DNS, and email, and the schema describes webhook_token. However, the identifier parameter is not explained at all, leaving some ambiguity about its purpose. Schema coverage is incomplete, so the description adds partial meaning but not full clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Make a canary URL, DNS, or email that alerts when someone opens it.' It uses a specific verb and resource, and distinguishes it from sibling tools like create_webhook and wait_for_email.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit usage guidance: 'Use to mark your own files or systems.' It also warns against misuse for email ('not a sign-up inbox') and points to an alternative approach (create_webhook + wait_for_email), which clarifies when to use this tool versus others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_ssrf_payloadB

Build authorized SSRF callback URLs that ping this webhook.

    Use only on systems you are allowed to test — not for sign-up email.
    Confirm hits with check_for_callbacks. local_bypass_examples cannot
    be confirmed here.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
identifierNo
include_ipNo
include_dnsNo
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses authorized use and that local_bypass_examples cannot be confirmed, but it doesn't describe the output structure, whether the tool creates a webhook if none exists, or any side effects like logging or rate limits. This is a security-sensitive tool, so more behavioral context is needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief and front-loaded with the main action. The multi-line structure with bullet points is clear. No wasted words, but the paragraph break after the first sentence is odd. Still, it's concise and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is an output schema, so return format is covered. The tool has 4 parameters, 4 siblings, and no annotations. The description explains the core purpose, acceptable use, and a key limitation (local_bypass_examples not confirmable). However, it lacks context on how to use the generated URLs (e.g., where to insert them) and what the output looks like without an example, but that is mitigated by the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is low (25%), with only webhook_token having a description. The description mentions 'local_bypass_examples' which is not a parameter, but it doesn't explain identifier, include_ip, or include_dns beyond their names. Includes that they are booleans controlling IP/DNS payloads is inferrable but not explicit. However, the description does indicate that include_ip and include_dns relate to payload construction, so partial value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates SSRF callback URLs that ping a webhook. It distinguishes from siblings by naming check_for_callbacks as a companion for confirming hits, and noting local_bypass_examples cannot be confirmed, but it doesn't explicitly contrast with other generation tools like generate_xss_callback.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear usage guidance: use only on authorized systems, not for sign-up email, and confirms hits with check_for_callbacks. It doesn't mention what to do if not authorized or alternatives like generate_xss_callback, but the primary conditions are well stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_xss_callbackA

Build authorized XSS payloads that ping this webhook when they run.

    Use only on systems you are allowed to test. Confirm with check_for_callbacks.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
identifierNo
include_domNo
webhook_tokenYesWebhook UUID returned by create_webhook
include_cookiesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It mentions 'authorized' and that payloads ping the webhook, but does not disclose side effects (e.g., that the payload may collect cookies or DOM data) or security considerations beyond authorization. The phrase 'authorized XSS payloads' is slightly misleading since the tool itself doesn't authorize; it generates payloads for authorized use. This is adequate but not detailed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences total, zero waste. Effectively front-loaded with purpose and a usage caution. The description is concise and gets straight to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 4 parameters (one required) and an output schema, but the description is minimal. It doesn't explain output content, parameter roles, or how the payload integrates with the webhook. Given low schema coverage and no annotations, this falls short of what a complex security tool needs. It's missing essential details for an agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 25% (webhook_token has a description). The description does not explain any parameters, such as identifier, include_dom, or include_cookies. With low schema coverage, the description should compensate, but it doesn't address parameter meaning or defaults, leaving the agent to infer from names alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool builds authorized XSS payloads that ping a webhook when executed. This is specific (verb 'build', resource 'XSS payloads', purpose 'ping webhook') and distinguishes it from sibling tools like generate_ssrf_payload or create_webhook.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides usage context: 'Use only on systems you are allowed to test' and suggests confirming via check_for_callbacks. This gives clear authorization guidance, but does not explicitly compare to alternatives or state when not to use it; still, it's sufficient for indicating appropriate scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_latest_requestA

Return only the newest captured event (HTTP, email, or DNS).

    Use for a quick peek. Prefer wait_for_email after a sign-up, or
    get_webhook_requests to see history.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the burden. It implies a read-only operation via the word 'get' and the phrase 'quick peek', but does not disclose edge cases, permissions, or side effects. Some context is added but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the main purpose, followed by practical usage guidance. No redundant or filler content; every sentence contributes value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema and the simplicity of the tool (one parameter, getter), the description provides sufficient context. It mentions event types and usage scenarios, though it omits details like behavior with no events, which are likely covered by the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers 100% of the parameter with a description: 'Webhook UUID returned by create_webhook'. The tool description adds no additional meaning beyond what the schema already provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Return only the newest captured event' with specific resource types (HTTP, email, DNS). It distinguishes from siblings by explicitly naming alternatives like wait_for_email and get_webhook_requests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance: 'Use for a quick peek. Prefer wait_for_email after a sign-up, or get_webhook_requests to see history.' This tells when to use this tool and when to choose alternatives, fully meeting the criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_webhook_dnsA

Return the DNSHook domain for an existing webhook.

    Use for out-of-band DNS callbacks, not for sign-up email. create_webhook
    already returns dns.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
validateNo
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It implies a read-only operation ('Return') and mentions 'existing webhook,' but does not disclose potential errors, side effects, or authentication requirements. It is not misleading, but it is minimal; for a simple getter this is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences with the main purpose first. Every sentence adds value, clearly distinguishing usage and providing an alternative. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple getter with an output schema, the description covers the essential purpose, usage, and alternative. It does not mention the validate parameter, but that is a minor gap given the tool's simplicity. Overall, it is adequately complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (webhook_token is described, validate is not). The description does not elaborate on either parameter, leaving validate's purpose unclear. Since coverage is low, the description should compensate, but it does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action: 'Return the DNSHook domain for an existing webhook.' It explicitly distinguishes itself from related tools like get_webhook_email and notes that create_webhook already returns dns, providing a clear scope and purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage guidance: 'Use for out-of-band DNS callbacks, not for sign-up email.' It also points to an alternative (create_webhook already returns dns), making it clear when to use this tool versus others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_webhook_emailA

Return the temp inbox to sign up, verify, magic-link, or reset a password.

    Address is {token}@email.webhook.site. Use when the user already has a
    token. If they do not, call create_webhook first — it also returns
    email. After the site sends mail, call wait_for_email.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
validateNo
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the address pattern, that this only returns the inbox (not creates a token or waits for mail), which is useful behavioral context. However, it does not explicitly state read-only nature, error cases, or the meaning of the `validate` parameter, though the core behavior is clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences, front-loaded with the primary purpose, followed by the address template and usage/call-order guidance. Every sentence adds necessary context without padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity retrieval tool with an output schema, the description covers the key usage flow, alternatives, and next step. The main gap is the undocumented `validate` parameter, but overall it is sufficiently complete for an agent to correctly select and invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema documentation covers webhook_token but not validate (50% coverage). The description explains how webhook_token maps to the address and references create_webhook, but it never mentions the `validate` boolean parameter or its effect. The description compensates for webhook_token only, leaving validate undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Return the temp inbox') and clarifies the token-based address format. It distinguishes itself from siblings by explicitly naming create_webhook and wait_for_email as related tools with different functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use ('Use when the user already has a token') and directs to create_webhook if not, and wait_for_email after mail. This provides clear when-to-use and sequencing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_webhook_infoA

Show webhook settings, expiry, and how many requests it has received.

Use when the user asks if a token is still valid or how it is configured.

ParametersJSON Schema
NameRequiredDescriptionDefault
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full transparency burden. It conveys a read-only inspection behavior through 'Show' and the validity-check use case, but it does not disclose error behavior, permission requirements, or side-effect guarantees. This is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no filler: the first states what the tool shows, and the second gives the trigger scenario. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple one-parameter tool with an output schema, so the description does not need to enumerate return fields. It covers purpose, usage trigger, and the read-only nature, making it complete for tool selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the only parameter is already documented as the 'Webhook UUID returned by create_webhook.' The description adds no extra parameter-level meaning, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses a specific verb 'Show' and enumerates exactly what is returned: webhook settings, expiry, and request count. This clearly distinguishes the tool from sibling tools like get_webhook_requests, get_webhook_url, or create_webhook.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says 'Use when the user asks if a token is still valid or how it is configured,' providing clear trigger conditions. It does not mention exclusions or alternative tools, but the use case is concrete enough for an agent to select it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_webhook_requestsA

List captured HTTP, email, or DNS events for a webhook.

    Use to inspect what already arrived. Bodies are truncated and HTML is
    omitted; use export_webhook_data for the full dump. For the newest item
    use get_latest_request. To wait for something new use wait_for_request
    or wait_for_email. Filter emails with request_type='email'.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
request_typeNo
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses the truncated bodies and omitted HTML behavior, which is key for setting expectations. It doesn't mention pagination or the response structure, but the existence of an output schema likely covers return details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a compact paragraph with a clear first sentence and then usage notes. Each sentence adds value: it covers purpose, usage, alternatives, and filtering. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool is a list/fetch operation, the description covers the key points: what it lists, limitations (truncated, no HTML), alternatives for full dump, newest item, and waiting. The output schema presumably documents the return fields. With three parameters, two have defaults and enums in the schema, and the description clarifies usage. It is complete for this tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 33%: webhook_token is described as 'Webhook UUID returned by create_webhook', but limit and request_type lack description beyond defaults and enum values. The description adds context on how to use request_type to filter emails, and the default values are in the schema. It compensates somewhat, but could add more on limit behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool lists captured HTTP, email, or DNS events for a webhook, which is a specific verb+resource combination. It explicitly distinguishes itself from siblings like export_webhook_data, get_latest_request, and wait_for_request, making it clear this tool is for inspecting past events in a list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear guidance on when to use this tool: to inspect what already arrived, with explicit exclusions: bodies are truncated and HTML omitted, use export_webhook_data for full dump, use get_latest_request for newest item, and use wait_for_request or wait_for_email for waiting for new items. It also gives a filter example for emails.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_webhook_urlA

Return https://webhook.site/{token} for an existing webhook.

    Use when the user already has a token and needs the HTTP callback URL.
    For a new inbox, create_webhook already returns url.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
validateNo
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It doesn't explicitly state whether this is read-only or if it triggers any side effects, but given the tool is simple and returns a URL, the description's clarity contributes to behavioral transparency. It also mentions 'existing webhook' implying validation might occur, which is helpful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a short but complete paragraph, with the main sentence (returns URL) followed by a bolded 'Use when' line and a contrast with create_webhook. It's front-loaded and wastes no words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is an output schema (not shown but indicated as true), which likely describes the URL structure. The tool is simple, and the description covers the usage context well, referencing the alternative create_webhook for new inboxes. Could be a 5 but the 'validate' parameter unclear and no mention of error cases, though that might be outside scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: webhook_token has a description ('Webhook UUID returned by create_webhook'), while validate has no description. The description reinforces the purpose of webhook_token but doesn't explain 'validate'. The parameter meanings are mostly clear from the schema, and the description adds value by tying webhook_token to existing webhooks. However, the 'validate' parameter's semantics are ambiguous, so not a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns the HTTPS callback URL for an existing webhook given a token. It distinguishes itself from sibling tools by specifying that it's for existing webhooks and that create_webhook already returns the URL for new inboxes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool: when the user already has a token and needs the HTTP callback URL. It also provides a when-not-to-use by referencing create_webhook for new inboxes, though it doesn't name the exact alternative tool (it does: create_webhook).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_requestsA

Search captured events by method, body text, headers, type, or date.

    Use when the user asks to find POSTs, a keyword, or only emails/DNS.
    Examples: query='method:POST', query='content:verify', request_type='email'.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
queryNo
date_toNo
sortingNonewest
date_fromNo
request_typeNo
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries full disclosure burden. It does reveal meaningful behavior—the query syntax (method:, content:) and request_type values—but omits basic semantics like the meaning of limit, sorting values, or whether the search is scoped to a single webhook (only implied via webhook_token). It's not misleading, but it leaves the agent guessing on the output shape and filter semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences: one for purpose, one for when-to-use, one with concrete examples. Every line earns its place with zero filler. The example block is scannable and immediately illustrative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter search tool with a query language, the description covers the primary use cases (find by method, keyword, type, date) and introduces the query DSL. An output schema exists, so return values needn't be specified. The main gap is absence of date-format and pagination/limit semantics, but the tool remains usable with defaults.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only 14% schema description coverage, the description must compensate for 6 undocumented parameters. It helpfully decodes the query parameter syntax (method:, content:) and demonstrates request_type usage, but says nothing about date_from/date_to format, limit, or the sorting values beyond the 'newest' default. Partial compensation for a large documentation gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource: 'Search captured events by method, body text, headers, type, or date.' The concrete examples (query='method:POST', query='content:verify', request_type='email') remove any ambiguity about what fields are searchable, cleanly distinguishing this from sibling retrieval tools like get_latest_request.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to reach for this tool: 'Use when the user asks to find POSTs, a keyword, or only emails/DNS.' This is clear, actionable when-to-use context. It doesn't name exclusions or point to alternatives like get_webhook_requests, but the trigger conditions are specific enough that an agent would rarely misfire.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

send_multiple_requestsA

POST several sample JSON payloads to the webhook, optionally spaced out.

Use to load-test capture, not to wait for a real site or email.

ParametersJSON Schema
NameRequiredDescriptionDefault
delay_msNo
payloadsYes
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries the full burden. It states the core behavior (POSTing payloads, optional delay) but does not disclose side effects, error behavior, or any prerequisites (e.g., webhook must exist). For a write operation, this is minimal but not misleading; it adds the load-test intent. It is adequate for a simple tool but could mention that it generates network traffic and may be used for testing only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loaded with the main operation and immediately followed by a clear usage note. Every sentence adds value with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (3 params, no nested objects) and the existence of an output schema, the description covers the essential purpose and usage. It lacks explicit mention of the output/return value but that is handled by the schema. It could detail payload constraints (e.g., any JSON object) but is otherwise sufficient for a straightforward webhook sender.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is low (33%) with only webhook_token described. The description says 'optionally spaced out' which hints at delay_ms but doesn't clarify its unit or purpose beyond spacing. For payloads, 'sample JSON payloads' gives a hint but does not specify allowed structure or that any object is fine. Since coverage is low, the description should have compensated more, but it adds only minimal clarification, leaving the agent to guess about payload format and delay semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action: 'POST several sample JSON payloads to the webhook', which specifies the verb, resource, and scope. It also distinguishes itself from the sibling tool send_to_webhook by implying multiple requests vs single, and effectively differentiates its use case.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage guidance is given: 'Use to load-test capture, not to wait for a real site or email.' This tells the agent exactly when to invoke this tool and when not to, implying alternatives like wait_for_request or wait_for_email for real interactions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

send_to_webhookA

POST JSON to the webhook URL to test that capture works.

Use when the user wants to send a sample payload, not when they are waiting for a real site or email.

ParametersJSON Schema
NameRequiredDescriptionDefault
dataYes
headersNo
webhook_tokenYesWebhook UUID returned by create_webhook

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description must carry the behavioral transparency burden. It discloses that the tool POSTs JSON, but it does not explain side effects (e.g., whether a request record is created), authentication requirements, rate limits, or what the response contains. For a send/test mutation without annotations, this is too thin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the first sentence states the action, and the second gives practical usage guidance. Every sentence contributes value without unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has three parameters including a nested object and an output schema, but the description does not cover important operational details such as how headers are used, what the response represents, or the significance of webhook_token. It is adequate for a trivial test action but incomplete for a tool with this schema complexity and no annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 33%, and the description adds little beyond 'JSON'. It does not clarify the role of data, headers, or webhook_token, nor how they relate to the HTTP request. The schema helpfully describes webhook_token, but data and headers are left under-explained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'POST JSON to the webhook URL to test that capture works.' It also distinguishes this tool from related send/wait tools by mentioning 'sample payload' and contrasting with waiting for real sites or emails.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides a when-to-use ('when the user wants to send a sample payload') and a when-not-to-use ('not when they are waiting for a real site or email'). However, it does not name alternative sibling tools, such as send_multiple_requests or wait_for_request, so it stops short of fully explicit alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_webhookB

Change how an existing webhook responds (status, body, timeout, CORS).

    Use after create_webhook when the user wants a different canned reply.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
corsNo
timeoutNo
webhook_tokenYesWebhook UUID returned by create_webhook
default_statusNo
default_contentNo
default_content_typeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. The description only says 'Change how an existing webhook responds' which implies mutation but doesn't disclose whether updates are immediately effective, whether partial updates are possible (parameters are optional), what happens if invalid values are given, or if there are any side effects. Given that this is a mutation tool with zero annotation coverage, more detail is needed about behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, two sentences, front-loaded with the purpose. The first sentence covers the main action, the second gives usage guidance. No unnecessary fluff. Could be structured slightly better by mapping the listed aspects to parameter names, but it's passable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 6 parameters, low schema coverage, no annotations, and a complex mutation operation, the description is incomplete. It doesn't explain the semantics of parameters like default_status vs default_content, whether all parameters are optional (though the schema shows defaults null, so likely), what the output schema contains (though output schema exists, so that helps), or how updates are applied. Given the tool's complexity and lack of structured metadata, the description should provide more context. However, the output schema reduces some burden about return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 17% (only webhook_token has a description). The tool description adds a list of fields it can change: status, body, timeout, CORS. However, it doesn't map these to the actual parameter names (default_status, default_content, default_content_type, timeout, cors). The description uses generic terms that roughly correspond but cause ambiguity. With 6 parameters and low schema coverage, the description should do more to clarify each parameter's meaning. It's borderline minimum viable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool changes 'how an existing webhook responds' and lists the specific aspects: status, body, timeout, and CORS. This distinguishes it from sibling tools like create_webhook (creation) and send_to_webhook (sending requests). It could be more explicit about it being an update to a specific pre-created webhook, but the mention of 'existing webhook' and webhook_token clarify that.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use after create_webhook when the user wants a different canned reply.' This provides clear guidance on when to use the tool and implies a prerequisite (webhook must already exist). It doesn't explicitly exclude alternatives, but the context of sibling tools makes it obvious. The guidance could mention that other tools like get_webhook_info are for reading, not updating, but it's adequate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wait_for_emailA

Wait for a sign-up, verify, magic-link, or password-reset email (1-120s).

    Call this after the user (or you) submitted {token}@email.webhook.site
    on a website. Returns subject, a truncated text preview, extracted
    confirm / reset / login URLs, and verification_codes (OTP). Next:
    follow_email_link, or type the code. HTML is omitted; use
    export_webhook_data for the full message. Set return_existing=true if
    the email already arrived. If there is no token yet, create_webhook first.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
extract_linksNo
webhook_tokenYesWebhook UUID returned by create_webhook
return_existingNo
timeout_secondsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that HTML is omitted and directs to export_webhook_data, explains the return_existing flag for pre-arrived emails, and mentions the prerequisite of creating a webhook. It does not mention any potential side effects or rate limits, but the key behavioral facts are covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, three sentences, and front-loaded with the primary purpose. It includes important conditional guidance (when to use return_existing, when to create_webhook first) without excessive detail. A slight improvement could be to structure the return_existing and timeout info more prominently, but it's well-organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is moderately complex with 4 parameters and a return payload including URLs and OTP codes. The description covers the main usage flow, mentions the return data, and provides pointers for additional use cases (full HTML, following links). The output schema exists, so the description needn't detail the return structure. It doesn't mention edge cases like multiple emails or filtering, but for the core use case it is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 25% (only webhook_token has a description). The description adds meaning for the parameters: it explains return_existing (return_existing=true if email already arrived), timeout_seconds range (1-120s), and clarifies webhook_token format (UUID from create_webhook). This compensates for the low schema coverage, though extract_links is not explicitly explained in the description but is self-evident.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool waits for specific types of emails (sign-up, verify, magic-link, password-reset) with a timeout range. It specifies the output (subject, preview, URLs, verification codes) and names the sibling tool 'create_webhook' for prerequisite setup, distinguishing it from 'wait_for_request' and 'follow_email_link'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use the tool (after submitting a webhook email on a website) and mentions the alternative for full HTML (export_webhook_data) and the follow_email_link tool. However, it doesn't explicitly state when NOT to use this tool versus other similar tools like wait_for_request.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wait_for_requestA

Poll until a new HTTP (or DNS) callback hits the webhook (1-120s).

    Use after giving a site the webhook URL. Bodies are truncated and HTML
    is omitted; use export_webhook_data for the full dump. For verification
    / magic-link / password-reset mail, use wait_for_email instead. Set
    return_existing=true if the request may already be there.
    
ParametersJSON Schema
NameRequiredDescriptionDefault
request_typeNo
webhook_tokenYesWebhook UUID returned by create_webhook
return_existingNo
timeout_secondsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It discloses non-obvious behavior: polling waits, 1-120s request window, truncated bodies, omitted HTML, and the return_existing caveat. It does not fully explain consumption/ordering or timeout edge cases, but it provides meaningful transparency beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with the core purpose, and every sentence adds a distinct useful fact: timing, usage timing, data truncation, alternative tool, and existing-request handling. There is no fluff or tautology.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter polling tool with an output schema and no annotations, this is nearly complete. It covers when to use it, when not to use it, an alternative for full data, and the return_existing scenario. The main remaining gap is some ambiguity around the request_type parameter, especially its 'email' enum value, since the description directs email-specific cases to wait_for_email.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is low (25%), yet the description adds important parameter meaning: timeout is bounded to 1-120s, return_existing=true can be used when the request may already be there, and webhook_token is the UUID from create_webhook. The request_type parameter is only partially clarified by 'HTTP (or DNS)' and the explicit exclusion of email verification cases, so a small gap remains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Starts with a concrete verb and object: 'Poll until a new HTTP (or DNS) callback hits the webhook.' This clearly defines the tool's purpose and distinguishes it from sibling tools like wait_for_email, export_webhook_data, and get_webhook_requests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage context: 'Use after giving a site the webhook URL.' It names clear alternatives for overlapping cases: 'use export_webhook_data for the full dump' and 'use wait_for_email instead' for verification/magic-link/password-reset mail. This is strong sibling differentiation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 24 tool updatesv2.2.2
    • Changedcheck_for_callbacks11 fields changed
      • addedInput schema / properties / identifier / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / identifier / default
        Added value: +null
      • removedInput schema / properties / identifier / description
        Removed value: -"Filter for specific identifier in request URL/content"
      • addedInput schema / properties / identifier / title
        Added value: +"Identifier"
      • removedInput schema / properties / identifier / type
        Removed value: -"string"
      • removedInput schema / properties / since_minutes / description
        Removed value: -"Only check requests from the last N minutes (default: 60)"
      • addedInput schema / properties / since_minutes / title
        Added value: +"Since Minutes"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"check_for_callbacksArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "check_for_callbacksDictOutput",
        +  "type": "object"
        +}
    • Changedcreate_webhook3 fields changed
      • removedInput schema / required
        Removed value: -[]
      • addedInput schema / title
        Added value: +"create_webhookArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "create_webhookDictOutput",
        +  "type": "object"
        +}
    • Changedcreate_webhook_with_config38 fields changed
      • addedInput schema / properties / alias / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / alias / default
        Added value: +null
      • removedInput schema / properties / alias / description
        Removed value: -"Custom alias for the webhook URL (3-32 alphanumeric chars)"
      • addedInput schema / properties / alias / title
        Added value: +"Alias"
      • removedInput schema / properties / alias / type
        Removed value: -"string"
      • addedInput schema / properties / cors / anyOf
        Added value: +[
        +  {
        +    "type": "boolean"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / cors / default
        Previous value: -falseNew value: +null
      • removedInput schema / properties / cors / description
        Removed value: -"Enable CORS headers for cross-domain requests"
      • addedInput schema / properties / cors / title
        Added value: +"Cors"
      • removedInput schema / properties / cors / type
        Removed value: -"boolean"
      • addedInput schema / properties / default_content / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / default_content / default
        Previous value: -""New value: +null
      • removedInput schema / properties / default_content / description
        Removed value: -"Default response content/body"
      • addedInput schema / properties / default_content / title
        Added value: +"Default Content"
      • removedInput schema / properties / default_content / type
        Removed value: -"string"
      • addedInput schema / properties / default_content_type / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / default_content_type / default
        Previous value: -"text/html"New value: +null
      • removedInput schema / properties / default_content_type / description
        Removed value: -"Default response Content-Type header"
      • addedInput schema / properties / default_content_type / title
        Added value: +"Default Content Type"
      • removedInput schema / properties / default_content_type / type
        Removed value: -"string"
      • addedInput schema / properties / default_status / anyOf
        Added value: +[
        +  {
        +    "type": "integer"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / default_status / default
        Previous value: -200New value: +null
      • removedInput schema / properties / default_status / description
        Removed value: -"Default HTTP response status code (200-599)"
      • addedInput schema / properties / default_status / title
        Added value: +"Default Status"
      • removedInput schema / properties / default_status / type
        Removed value: -"integer"
      • addedInput schema / properties / expiry / anyOf
        Added value: +[
        +  {
        +    "type": "integer"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / expiry / default
        Added value: +null
      • removedInput schema / properties / expiry / description
        Removed value: -"Seconds until webhook auto-expires (max 604800 = 1 week)"
      • addedInput schema / properties / expiry / title
        Added value: +"Expiry"
      • removedInput schema / properties / expiry / type
        Removed value: -"integer"
      • addedInput schema / properties / timeout / anyOf
        Added value: +[
        +  {
        +    "type": "integer"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / timeout / default
        Previous value: -0New value: +null
      • removedInput schema / properties / timeout / description
        Removed value: -"Seconds to wait before returning response (0-30)"
      • addedInput schema / properties / timeout / title
        Added value: +"Timeout"
      • removedInput schema / properties / timeout / type
        Removed value: -"integer"
      • removedInput schema / required
        Removed value: -[]
      • addedInput schema / title
        Added value: +"create_webhook_with_configArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "create_webhook_with_configDictOutput",
        +  "type": "object"
        +}
    • Changeddelete_all_requests19 fields changed
      • addedInput schema / properties / date_from / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / date_from / default
        Added value: +null
      • removedInput schema / properties / date_from / description
        Removed value: -"Delete requests from this date (format: yyyy-MM-dd HH:mm:ss or 'now-7d')"
      • addedInput schema / properties / date_from / title
        Added value: +"Date From"
      • removedInput schema / properties / date_from / type
        Removed value: -"string"
      • addedInput schema / properties / date_to / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / date_to / default
        Added value: +null
      • removedInput schema / properties / date_to / description
        Removed value: -"Delete requests until this date (format: yyyy-MM-dd HH:mm:ss or 'now-7d')"
      • addedInput schema / properties / date_to / title
        Added value: +"Date To"
      • removedInput schema / properties / date_to / type
        Removed value: -"string"
      • addedInput schema / properties / query / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / query / default
        Added value: +null
      • removedInput schema / properties / query / description
        Removed value: -"Delete only requests matching this search query"
      • addedInput schema / properties / query / title
        Added value: +"Query"
      • removedInput schema / properties / query / type
        Removed value: -"string"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"delete_all_requestsArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "delete_all_requestsDictOutput",
        +  "type": "object"
        +}
    • Changeddelete_request6 fields changed
      • removedInput schema / properties / request_id / description
        Removed value: -"The request UUID to delete"
      • addedInput schema / properties / request_id / title
        Added value: +"Request Id"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"delete_requestArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "delete_requestDictOutput",
        +  "type": "object"
        +}
    • Changeddelete_webhook4 fields changed
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"delete_webhookArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "delete_webhookDictOutput",
        +  "type": "object"
        +}
    • Changedexport_webhook_data6 fields changed
      • removedInput schema / properties / limit / description
        Removed value: -"Maximum number of requests to export (default: 100)"
      • addedInput schema / properties / limit / title
        Added value: +"Limit"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"export_webhook_dataArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "export_webhook_dataDictOutput",
        +  "type": "object"
        +}
    • Changedextract_links_from_request14 fields changed
      • addedInput schema / properties / filter_domain / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / filter_domain / default
        Added value: +null
      • removedInput schema / properties / filter_domain / description
        Removed value: -"Only return links matching this domain"
      • addedInput schema / properties / filter_domain / title
        Added value: +"Filter Domain"
      • removedInput schema / properties / filter_domain / type
        Removed value: -"string"
      • addedInput schema / properties / request_id / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / request_id / default
        Added value: +null
      • removedInput schema / properties / request_id / description
        Removed value: -"Specific request UUID to analyze (optional, defaults to latest)"
      • addedInput schema / properties / request_id / title
        Added value: +"Request Id"
      • removedInput schema / properties / request_id / type
        Removed value: -"string"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"extract_links_from_requestArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "extract_links_from_requestDictOutput",
        +  "type": "object"
        +}
    • Addedfollow_email_link
    • Changedgenerate_canary_token11 fields changed
      • addedInput schema / properties / identifier / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / identifier / default
        Added value: +null
      • removedInput schema / properties / identifier / description
        Removed value: -"Custom identifier for the canary (e.g., 'confidential-doc', 'admin-panel')"
      • addedInput schema / properties / identifier / title
        Added value: +"Identifier"
      • removedInput schema / properties / identifier / type
        Removed value: -"string"
      • removedInput schema / properties / token_type / description
        Removed value: -"Type of canary token: 'url' (web link), 'dns' (DNS lookup), 'email' (email tracker)"
      • addedInput schema / properties / token_type / title
        Added value: +"Token Type"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"generate_canary_tokenArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "generate_canary_tokenDictOutput",
        +  "type": "object"
        +}
    • Changedgenerate_ssrf_payload13 fields changed
      • addedInput schema / properties / identifier / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / identifier / default
        Added value: +null
      • removedInput schema / properties / identifier / description
        Removed value: -"Custom identifier to include in payload (e.g., 'param1', 'header-injection')"
      • addedInput schema / properties / identifier / title
        Added value: +"Identifier"
      • removedInput schema / properties / identifier / type
        Removed value: -"string"
      • removedInput schema / properties / include_dns / description
        Removed value: -"Include DNS-based payload for blind SSRF detection (default: true)"
      • addedInput schema / properties / include_dns / title
        Added value: +"Include Dns"
      • removedInput schema / properties / include_ip / description
        Removed value: -"Include IP-based payloads to bypass domain filters (default: true)"
      • addedInput schema / properties / include_ip / title
        Added value: +"Include Ip"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"generate_ssrf_payloadArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "generate_ssrf_payloadDictOutput",
        +  "type": "object"
        +}
    • Changedgenerate_xss_callback13 fields changed
      • addedInput schema / properties / identifier / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / identifier / default
        Added value: +null
      • removedInput schema / properties / identifier / description
        Removed value: -"Custom identifier to track which injection point triggered (e.g., 'comment-field', 'profile-name')"
      • addedInput schema / properties / identifier / title
        Added value: +"Identifier"
      • removedInput schema / properties / identifier / type
        Removed value: -"string"
      • removedInput schema / properties / include_cookies / description
        Removed value: -"Include payload that exfiltrates cookies (default: true)"
      • addedInput schema / properties / include_cookies / title
        Added value: +"Include Cookies"
      • removedInput schema / properties / include_dom / description
        Removed value: -"Include payload that captures DOM info like URL and referrer (default: true)"
      • addedInput schema / properties / include_dom / title
        Added value: +"Include Dom"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"generate_xss_callbackArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "generate_xss_callbackDictOutput",
        +  "type": "object"
        +}
    • Changedget_latest_request4 fields changed
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"get_latest_requestArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "get_latest_requestDictOutput",
        +  "type": "object"
        +}
    • Changedget_webhook_dns6 fields changed
      • removedInput schema / properties / validate / description
        Removed value: -"If true, verify the token exists via API call before returning DNS domain"
      • addedInput schema / properties / validate / title
        Added value: +"Validate"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"get_webhook_dnsArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "get_webhook_dnsDictOutput",
        +  "type": "object"
        +}
    • Changedget_webhook_email6 fields changed
      • removedInput schema / properties / validate / description
        Removed value: -"If true, verify the token exists via API call before returning email"
      • addedInput schema / properties / validate / title
        Added value: +"Validate"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"get_webhook_emailArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "get_webhook_emailDictOutput",
        +  "type": "object"
        +}
    • Changedget_webhook_info4 fields changed
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"get_webhook_infoArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "get_webhook_infoDictOutput",
        +  "type": "object"
        +}
    • Changedget_webhook_requests12 fields changed
      • removedInput schema / properties / limit / description
        Removed value: -"Maximum number of requests to retrieve (default: 10)"
      • addedInput schema / properties / limit / title
        Added value: +"Limit"
      • addedInput schema / properties / request_type / anyOf
        Added value: +[
        +  {
        +    "enum": [
        +      "web",
        +      "email",
        +      "dns"
        +    ],
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / request_type / default
        Added value: +null
      • removedInput schema / properties / request_type / description
        Removed value: -"Filter by request type: 'web' (HTTP requests), 'email', or 'dns'"
      • removedInput schema / properties / request_type / enum
        Removed value: -[
        -  "web",
        -  "email",
        -  "dns"
        -]
      • addedInput schema / properties / request_type / title
        Added value: +"Request Type"
      • removedInput schema / properties / request_type / type
        Removed value: -"string"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"get_webhook_requestsArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "get_webhook_requestsDictOutput",
        +  "type": "object"
        +}
    • Changedget_webhook_url6 fields changed
      • removedInput schema / properties / validate / description
        Removed value: -"If true, verify the token exists via API call before returning URL"
      • addedInput schema / properties / validate / title
        Added value: +"Validate"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"get_webhook_urlArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "get_webhook_urlDictOutput",
        +  "type": "object"
        +}
    • Changedsearch_requests29 fields changed
      • addedInput schema / properties / date_from / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / date_from / default
        Added value: +null
      • removedInput schema / properties / date_from / description
        Removed value: -"Filter from date (format: yyyy-MM-dd HH:mm:ss)"
      • addedInput schema / properties / date_from / title
        Added value: +"Date From"
      • removedInput schema / properties / date_from / type
        Removed value: -"string"
      • addedInput schema / properties / date_to / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / date_to / default
        Added value: +null
      • removedInput schema / properties / date_to / description
        Removed value: -"Filter to date (format: yyyy-MM-dd HH:mm:ss)"
      • addedInput schema / properties / date_to / title
        Added value: +"Date To"
      • removedInput schema / properties / date_to / type
        Removed value: -"string"
      • removedInput schema / properties / limit / description
        Removed value: -"Maximum number of requests to retrieve"
      • addedInput schema / properties / limit / title
        Added value: +"Limit"
      • addedInput schema / properties / query / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / query / default
        Added value: +null
      • removedInput schema / properties / query / description
        Removed value: -"Additional search query (e.g., 'method:POST', 'content:foobar', 'headers.user-agent:Mozilla')"
      • addedInput schema / properties / query / title
        Added value: +"Query"
      • removedInput schema / properties / query / type
        Removed value: -"string"
      • addedInput schema / properties / request_type / anyOf
        Added value: +[
        +  {
        +    "enum": [
        +      "web",
        +      "email",
        +      "dns"
        +    ],
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / request_type / default
        Added value: +null
      • removedInput schema / properties / request_type / description
        Removed value: -"Filter by request type: 'web' (HTTP requests), 'email', or 'dns'"
      • removedInput schema / properties / request_type / enum
        Removed value: -[
        -  "web",
        -  "email",
        -  "dns"
        -]
      • addedInput schema / properties / request_type / title
        Added value: +"Request Type"
      • removedInput schema / properties / request_type / type
        Removed value: -"string"
      • removedInput schema / properties / sorting / description
        Removed value: -"Sort order: 'newest' or 'oldest'"
      • addedInput schema / properties / sorting / title
        Added value: +"Sorting"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"search_requestsArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "search_requestsDictOutput",
        +  "type": "object"
        +}
    • Changedsend_multiple_requests9 fields changed
      • removedInput schema / properties / delay_ms / description
        Removed value: -"Delay between requests in milliseconds (default: 0)"
      • addedInput schema / properties / delay_ms / title
        Added value: +"Delay Ms"
      • removedInput schema / properties / payloads / description
        Removed value: -"Array of JSON payloads to send to the webhook"
      • addedInput schema / properties / payloads / items / additionalProperties
        Added value: +true
      • addedInput schema / properties / payloads / title
        Added value: +"Payloads"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"send_multiple_requestsArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "send_multiple_requestsDictOutput",
        +  "type": "object"
        +}
    • Changedsend_to_webhook12 fields changed
      • addedInput schema / properties / data / additionalProperties
        Added value: +true
      • removedInput schema / properties / data / description
        Removed value: -"JSON data to send to the webhook"
      • addedInput schema / properties / data / title
        Added value: +"Data"
      • addedInput schema / properties / headers / anyOf
        Added value: +[
        +  {
        +    "additionalProperties": {
        +      "type": "string"
        +    },
        +    "type": "object"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • changedInput schema / properties / headers / default
        Previous value: -{}New value: +null
      • removedInput schema / properties / headers / description
        Removed value: -"Optional custom headers to include in the request"
      • addedInput schema / properties / headers / title
        Added value: +"Headers"
      • removedInput schema / properties / headers / type
        Removed value: -"object"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"send_to_webhookArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "send_to_webhookDictOutput",
        +  "type": "object"
        +}
    • Changedupdate_webhook29 fields changed
      • addedInput schema / properties / cors / anyOf
        Added value: +[
        +  {
        +    "type": "boolean"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / cors / default
        Added value: +null
      • removedInput schema / properties / cors / description
        Removed value: -"Enable CORS headers for cross-domain requests"
      • addedInput schema / properties / cors / title
        Added value: +"Cors"
      • removedInput schema / properties / cors / type
        Removed value: -"boolean"
      • addedInput schema / properties / default_content / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / default_content / default
        Added value: +null
      • removedInput schema / properties / default_content / description
        Removed value: -"Default response content/body"
      • addedInput schema / properties / default_content / title
        Added value: +"Default Content"
      • removedInput schema / properties / default_content / type
        Removed value: -"string"
      • addedInput schema / properties / default_content_type / anyOf
        Added value: +[
        +  {
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / default_content_type / default
        Added value: +null
      • removedInput schema / properties / default_content_type / description
        Removed value: -"Default response Content-Type header"
      • addedInput schema / properties / default_content_type / title
        Added value: +"Default Content Type"
      • removedInput schema / properties / default_content_type / type
        Removed value: -"string"
      • addedInput schema / properties / default_status / anyOf
        Added value: +[
        +  {
        +    "type": "integer"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / default_status / default
        Added value: +null
      • removedInput schema / properties / default_status / description
        Removed value: -"Default HTTP response status code (200-599)"
      • addedInput schema / properties / default_status / title
        Added value: +"Default Status"
      • removedInput schema / properties / default_status / type
        Removed value: -"integer"
      • addedInput schema / properties / timeout / anyOf
        Added value: +[
        +  {
        +    "type": "integer"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / timeout / default
        Added value: +null
      • removedInput schema / properties / timeout / description
        Removed value: -"Seconds to wait before returning response (0-30)"
      • addedInput schema / properties / timeout / title
        Added value: +"Timeout"
      • removedInput schema / properties / timeout / type
        Removed value: -"integer"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"update_webhookArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "update_webhookDictOutput",
        +  "type": "object"
        +}
    • Changedwait_for_email9 fields changed
      • removedInput schema / properties / extract_links / description
        Removed value: -"Whether to extract all URLs from the email body (default: true)"
      • addedInput schema / properties / extract_links / title
        Added value: +"Extract Links"
      • addedInput schema / properties / return_existing
        Added value: +{
        +  "default": false,
        +  "title": "Return Existing",
        +  "type": "boolean"
        +}
      • removedInput schema / properties / timeout_seconds / description
        Removed value: -"Maximum time to wait in seconds (default: 60)"
      • addedInput schema / properties / timeout_seconds / title
        Added value: +"Timeout Seconds"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"wait_for_emailArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "wait_for_emailDictOutput",
        +  "type": "object"
        +}
    • Changedwait_for_request13 fields changed
      • addedInput schema / properties / request_type / anyOf
        Added value: +[
        +  {
        +    "enum": [
        +      "web",
        +      "email",
        +      "dns"
        +    ],
        +    "type": "string"
        +  },
        +  {
        +    "type": "null"
        +  }
        +]
      • addedInput schema / properties / request_type / default
        Added value: +null
      • removedInput schema / properties / request_type / description
        Removed value: -"Filter by request type: 'web' (HTTP requests), 'email', or 'dns'. Leave empty for any type."
      • removedInput schema / properties / request_type / enum
        Removed value: -[
        -  "web",
        -  "email",
        -  "dns"
        -]
      • addedInput schema / properties / request_type / title
        Added value: +"Request Type"
      • removedInput schema / properties / request_type / type
        Removed value: -"string"
      • addedInput schema / properties / return_existing
        Added value: +{
        +  "default": false,
        +  "title": "Return Existing",
        +  "type": "boolean"
        +}
      • removedInput schema / properties / timeout_seconds / description
        Removed value: -"Maximum time to wait in seconds (default: 60)"
      • addedInput schema / properties / timeout_seconds / title
        Added value: +"Timeout Seconds"
      • changedInput schema / properties / webhook_token / description
        Previous value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook"
      • addedInput schema / properties / webhook_token / title
        Added value: +"Webhook Token"
      • addedInput schema / title
        Added value: +"wait_for_requestArguments"
      • changedOutput schema / (root)
        Previous value: -nullNew value: +{
        +  "additionalProperties": true,
        +  "title": "wait_for_requestDictOutput",
        +  "type": "object"
        +}
  2. 23 tool updatesv2.0.3
    • Addedcheck_for_callbacks
    • Addedcreate_webhook
    • Addedcreate_webhook_with_config
    • Addeddelete_all_requests
    • Addeddelete_request
    • Addeddelete_webhook
    • Addedexport_webhook_data
    • Addedextract_links_from_request
    • Addedgenerate_canary_token
    • Addedgenerate_ssrf_payload
    • Addedgenerate_xss_callback
    • Addedget_latest_request
    • Addedget_webhook_dns
    • Addedget_webhook_email
    • Addedget_webhook_info
    • Addedget_webhook_requests
    • Addedget_webhook_url
    • Addedsearch_requests
    • Addedsend_multiple_requests
    • Addedsend_to_webhook
    • Addedupdate_webhook
    • Addedwait_for_email
    • Addedwait_for_request
  3. 23 tool updatesv2.0.0
    • Removedcheck_for_callbacks
    • Removedcreate_webhook
    • Removedcreate_webhook_with_config
    • Removeddelete_all_requests
    • Removeddelete_request
    • Removeddelete_webhook
    • Removedexport_webhook_data
    • Removedextract_links_from_request
    • Removedgenerate_canary_token
    • Removedgenerate_ssrf_payload
    • Removedgenerate_xss_callback
    • Removedget_latest_request
    • Removedget_webhook_dns
    • Removedget_webhook_email
    • Removedget_webhook_info
    • Removedget_webhook_requests
    • Removedget_webhook_url
    • Removedsearch_requests
    • Removedsend_multiple_requests
    • Removedsend_to_webhook
    • Removedupdate_webhook
    • Removedwait_for_email
    • Removedwait_for_request
  4. 23 tool updatesv2.1.3
    • First observedcheck_for_callbacks
    • First observedcreate_webhook
    • First observedcreate_webhook_with_config
    • First observeddelete_all_requests
    • First observeddelete_request
    • First observeddelete_webhook
    • First observedexport_webhook_data
    • First observedextract_links_from_request
    • First observedgenerate_canary_token
    • First observedgenerate_ssrf_payload
    • First observedgenerate_xss_callback
    • First observedget_latest_request
    • First observedget_webhook_dns
    • First observedget_webhook_email
    • First observedget_webhook_info
    • First observedget_webhook_requests
    • First observedget_webhook_url
    • First observedsearch_requests
    • First observedsend_multiple_requests
    • First observedsend_to_webhook
    • First observedupdate_webhook
    • First observedwait_for_email
    • First observedwait_for_request

TDQS

A4/5.0
Disambiguation5/5

Every tool has a clearly defined purpose with explicit guidance on when to use it. Overlaps like get_latest_request vs get_webhook_requests are disambiguated in descriptions, and security tools are separate from email/webhook tools.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern in snake_case (e.g., create_webhook, delete_request, wait_for_email). Security payload generators use generate_ prefix, and check_for_callbacks fits the pattern. No mixed conventions.

Tool Count4/5

24 tools is on the higher side but justified by the broad scope: webhook lifecycle, email capture, DNS, request management, and security testing. Each tool earns its place, though some could theoretically be merged without much loss.

Completeness5/5

The surface covers the full lifecycle: create, configure, send, retrieve, wait, export, update, delete, search, and security payload generation. No obvious gaps for the stated purpose of webhook testing and temporary inbox functionality.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Enables AI agents to create disposable webhook URLs, capture incoming HTTP requests, inspect headers and bodies, and replay them against local or remote endpoints, streamlining the webhook handler development loop.
    5
    15
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables management and inspection of webhook tokens (URLs) and incoming requests via webhook-test.com, allowing users to create, list, fetch details, fetch payloads, and delete webhooks without custom API integrations.
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/zebbern/webhook-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server