Webhook.site MCP Server
Сервер MCP для Webhook.site
Сервер Model Context Protocol (MCP) для webhook.site — мгновенно перехватывайте HTTP-запросы, электронные письма и DNS-запросы. Идеально подходит для тестирования вебхуков, отладки API-колбэков, проверки безопасности и охоты за багами.
Инструменты безопасности (SSRF, XSS, canary-токены) предназначены только для авторизованного тестирования — систем, которыми вы владеете или на тестирование которых у вас есть явное разрешение.
Содержание
Related MCP server: hookray-mcp
Быстрый старт
Установка
# Using uvx (recommended - no install needed)
uvx webhook-mcp-server==2.2.2
# Or install via pip
pip install webhook-mcp-server==2.2.2Используйте версию 2.2.2 или новее. 2.1.3 не запускается на MCP 2.0.
VS Code / GitHub Copilot
Добавьте в .vscode/mcp.json:
{
"servers": {
"webhook-mcp-server": {
"type": "stdio",
"command": "uvx",
"args": ["webhook-mcp-server==2.2.2"]
}
}
}Cursor
Добавьте в .cursor/mcp.json (проект) или в пользовательскую MCP-конфигурацию:
{
"mcpServers": {
"webhook-mcp-server": {
"command": "uvx",
"args": ["webhook-mcp-server==2.2.2"]
}
}
}Claude Desktop
Добавьте в claude_desktop_config.json:
{
"mcpServers": {
"webhook-mcp-server": {
"command": "uvx",
"args": ["webhook-mcp-server==2.2.2"]
}
}
}Что вы можете делать?
Перехват вебхуков
"Create a webhook and show me the URL"
"What requests have been sent to my webhook?"
"Wait for a request to come in"Безопасность / Bug Bounty:
"Generate an SSRF payload to test for blind vulnerabilities"
"Create XSS callback payloads to detect blind XSS attacks"
"Make me a canary token to detect if someone accesses a URL"Автоматизация электронной почты:
"Create a temp email and wait for a password reset link"
"Monitor this webhook for emails and extract all links from them"
"Give me 3 temporary emails at once" (batch creation)Тестирование API:
"Create a webhook that returns a 404 error with a custom message"
"Make a webhook with CORS enabled that waits 5 seconds before responding"
"Send 10 different test requests to a webhook and show me all the captured data"Мониторинг в реальном времени:
"Create a webhook and wait for any HTTP request to arrive"
"Monitor for DNS lookups to detect if a server is making DNS queries"
"Search all requests for ones containing 'password' in the body"Анализ данных:
"Export all captured webhook requests to JSON format"
"Show me statistics on requests received in the last hour"
"Filter and show only POST requests with specific headers"Творческие/практические сценарии:
"Create a webhook that pretends to be a Stripe payment API"
"Make a fake login endpoint that captures credentials (for pentesting)"
"Set up an email inbox that auto-extracts verification codes"Canary-токены
"Create a canary URL to track document access"
"Generate a DNS canary for the config file"
"Set up an email tracker pixel"Справочник инструментов
Управление вебхуками
Инструмент | Описание |
| Начните здесь: одноразовый URL, временная почта и DNS для регистрации или колбэков |
| Создание с пользовательским ответом, статусом, CORS, таймаутом |
| Получить полный URL для токена вебхука |
| Временный почтовый ящик |
| Получить DNS-поддомен для вебхука |
| Получить настройки и статистику вебхука |
| Изменить конфигурацию вебхука |
| Удалить конечную точку вебхука |
Обработка запросов
Инструмент | Описание |
| Отправить JSON-данные на вебхук |
| Список всех перехваченных запросов |
| Поиск с фильтрами (метод, содержимое, дата) |
| Получить самый последний перехваченный запрос |
| Удалить конкретный запрос |
| Массовое удаление с фильтрами |
Ожидание в реальном времени
Инструмент | Описание |
| Ожидание нового HTTP-запроса (опрос, 1–120 с). Установите |
| После регистрации: ожидание письма со ссылкой для проверки / magic-link / сброса и OTP-кодами |
| Открыть перехваченный URL из письма (проверка / magic / сброс) и вернуть содержимое страницы |
Безопасность / Bug Bounty
Инструмент | Описание |
| Создание SSRF-тестовых нагрузок (HTTP, DNS, на основе IP) |
| Создание XSS-колбэков с перехватом cookie/DOM |
| Создание отслеживаемых URL, DNS или email-канареек |
| Быстрая проверка OOB-колбэков |
| Извлечение ссылок подтверждения / сброса / magic-link из письма или HTTP-запроса |
Пакетные и вспомогательные операции
Инструмент | Описание |
| Отправка пакета запросов для нагрузочного теста |
| Экспорт всех запросов в JSON |
Примеры
Регистрация на сайте
create_webhook— получитеemail({token}@email.webhook.site)Используйте этот адрес на сайте (регистрация, проверка, magic link или сброс пароля)
wait_for_email— получите письмо, ссылки для подтверждения / входа / сброса и любой OTPfollow_email_link, чтобы открыть ссылку для проверки, или введитеverification_codesна сайте
Если у вас уже есть токен, get_webhook_email вернёт тот же почтовый ящик.
Создание вебхука
// Response from create_webhook
{
"token": "abc123-def456-...",
"url": "https://webhook.site/abc123-def456-...",
"email": "abc123-def456-...@email.webhook.site",
"dns": "abc123-def456-....dnshook.site"
}Ожидание письма со сбросом пароля
// Response from wait_for_email
{
"email_received": true,
"subject": "Password Reset Request",
"from": "noreply@example.com",
"auth_links": ["https://example.com/reset?token=xyz789"],
"verification_codes": ["847291"]
}SSRF-тестовая нагрузка
// Response from generate_ssrf_payload
{
"payloads": {
"http": "https://webhook.site/token?id=ssrf-test",
"dns": "ssrf-test.token.dnshook.site",
"ip_decimal": "http://2130706433/token",
"ip_hex": "http://0x7f000001/token"
}
}Что предоставляет каждый вебхук-токен
Конечная точка | Формат | Вариант использования |
HTTP URL |
| Перехват HTTP/HTTPS-запросов |
Поддомен |
| Альтернативный формат URL |
| Перехват входящих писем | |
DNS |
| Перехват DNS-запросов |
Архитектура
webhook-mcp-server/
├── server.py # MCPServer entry point + lifespan
├── handlers/ # Typed @mcp.tool() registrations
├── services/ # Business logic
│ ├── webhook_service.py # Webhook CRUD
│ ├── request_service.py # Request management
│ └── bugbounty_service.py # Security payloads
├── models/ # Config / filter / result types
└── utils/ # HTTP client, logging, validationКлючевые особенности
Асинхронная архитектура — неблокирующий ввод-вывод для оптимальной производительности
Логика повторов — экспоненциальная задержка при временных сбоях
Проверка входных данных — валидация UUID, санитизация параметров
Структурированное логирование — JSON-логи для отладки и мониторинга
Типобезопасность — полные аннотации типов по всему коду
Разработка
Настройка
git clone https://github.com/zebbern/webhook-mcp-server.git
cd webhook-mcp-server
pip install -e ".[dev]"Запуск тестов
# Offline unit tests (default for CI)
pytest -m "not live" -v
# Live webhook.site tests
pytest -m live -vЛокальный запуск
python server.pyТребования
Python 3.10+
mcp >= 2.0.0httpx >= 0.25.0
Журнал изменений
Историю версий см. в CHANGELOG.md.
Вклад в проект
Вклад приветствуется! Вот как вы можете помочь:
Сообщить об ошибках — откройте issue с описанием проблемы
Предложить функции — откройте issue со своей идеей
Отправить PR — сделайте форк репозитория и отправьте pull request
Настройка среды разработки
git clone https://github.com/zebbern/webhook-mcp-server.git
cd webhook-mcp-server
pip install -e ".[dev]"
pytest -m "not live" -vРекомендации
Следуйте существующему стилю кода
Добавляйте тесты для новых функций
Обновляйте документацию по мере необходимости
Держите PR сфокусированными на одном изменении
Благодарности
Этот проект не связан с webhook.site и не одобрен им.
Ссылки
🌐 webhook.site — сервис, который оборачивает этот MCP
📖 Model Context Protocol — спецификация MCP
Сделано с ❤️ для MCP-сообщества
Available Tools
24 toolscheck_for_callbacksA
See if SSRF, XSS, or canary callbacks arrived in the last N minutes.
Use after generate_ssrf_payload / generate_xss_callback / generate_canary_token.
For a website verification email, use wait_for_email.
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | No | ||
| since_minutes | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description is the sole source of behavioral context. It clearly implies a non-destructive check via 'See if ... arrived' and scopes it to callback types and a time window, but it does not explicitly state whether callbacks are consumed or whether this is a blocking vs. one-shot poll.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences place the primary behavior first, then usage context and an alternative. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The existence of an output schema means return values do not need to be restated. The description gives workflow and alternative context, but the undeclared identifier semantics and low schema coverage leave a real gap for a 3-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only webhook_token has a schema description, so the description must compensate. It indirectly documents since_minutes ('last N minutes') but gives no meaning to the nullable identifier filter, which remains ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('See if') and resource ('SSRF, XSS, or canary callbacks'), while time-window scoping differentiates it from generic request/email waiters. This is a distinct purpose among siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly instructs to use after the three generate_* tools and names wait_for_email as the correct alternative for website verification emails. This is concrete when-to-use guidance with an exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_webhookA
Create a disposable inbox to sign up on a website: HTTP URL, temp email, DNS.
Use this first when the user wants to sign up, receive a verification /
magic-link / password-reset email, catch a webhook callback, or get a
one-off URL. Returns token, url, email ({token}@email.webhook.site),
and dns. Next: give the email or URL to the site, then wait_for_email,
then follow_email_link or use the OTP.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the transparency burden. It discloses that the tool creates a disposable inbox and returns token, URL, email, and DNS, and it outlines the intended workflow. It omits persistence/cleanup details, but the core creation and return behavior are clearly conveyed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: the first sentence defines the tool, the second states when to use it, and the third gives the downstream workflow. Every sentence earns its place, with no filler or redundant schema repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter creation tool with an output schema, the description provides complete operational context: purpose, trigger conditions, returned values, and recommended next steps. An agent can determine when to invoke create_webhook and how to proceed afterward without additional information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so there is no parameter-level semantics for the description to add. The description contributes value by explaining the returned fields (token, url, email, dns), which satisfies the baseline for a parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Create') and resource ('disposable inbox'), and enumerates concrete capabilities: HTTP URL, temp email, and DNS. It clearly establishes that this is the default first step for sign-up/verification workflows, distinguishing it from more specialized siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly lists when to use the tool: signing up, receiving verification/magic-link/password-reset emails, catching webhook callbacks, or getting a one-off URL. It also provides the recommended follow-on sequence (wait_for_email, follow_email_link/OTP), but it does not explicitly contrast it with create_webhook_with_config or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_webhook_with_configA
Create a webhook that returns a custom status, body, timeout, CORS, or alias.
Use when the user wants the endpoint to pretend to be an API (404, delay,
JSON body) instead of a default 200. For a normal sign-up inbox, use
create_webhook.
| Name | Required | Description | Default |
|---|---|---|---|
| cors | No | ||
| alias | No | ||
| expiry | No | ||
| timeout | No | ||
| default_status | No | ||
| default_content | No | ||
| default_content_type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden for behavioral disclosure. It conveys that the tool creates a webhook with customizable response behavior, but does not detail side effects, potential errors, or the impact of omitted parameters (e.g., defaults beyond the implied 200). It adds some context but not comprehensive transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, both front-loaded and relevant. The first sentence states the core function, the second provides usage guidance with an alternative. No filler or redundancies.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is moderately complex with seven optional parameters and an output schema (not shown). The description covers the primary use case but does not explain default behavior when no config is given, interactions between parameters, or how expiry works. It suffices for choosing the tool but not for fully predicting behavior without further schema info.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain all seven parameters. It only names five (status, body, timeout, CORS, alias) and does not elaborate on units, constraints, or the remaining params (expiry, default_content_type). The mapping is shallow and leaves significant gaps in understanding the parameters' meanings and valid values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a webhook with custom status, body, timeout, CORS, or alias, and explicitly contrasts it with the simpler create_webhook for normal use cases. This distinguishes it from siblings and names the specific resources being configured.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance: use this tool when the endpoint should mimic an API (e.g., 404, delay, JSON body) rather than a default 200, and directs users to create_webhook for a standard sign-up inbox. This is strong when/when-not guidance with a named alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_all_requestsB
Clear captured events on a webhook, optionally by date or search query.
Use to reset an inbox before a new sign-up or test run.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | ||
| date_to | No | ||
| date_from | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. While 'Clear captured events' implies deletion, it does not mention that the action is irreversible, the full scope (all matching requests), or any confirmations/undo options. The description's 'reset an inbox' metaphor is helpful but insufficient for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally concise: two sentences that quickly convey the action and a primary use case. Every word earns its place with no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema and four parameters, the description lacks key details for a destructive operation: it does not state that the deletion is permanent, that it applies to all captured events for the webhook, or any safety mechanisms. The use-case sentence helps but is not enough to fully understand the tool's impact.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema only documents 'webhook_token' (25% coverage). The description adds that clearing can be optionally filtered 'by date or search query', which partially explains the purpose of 'query', 'date_from', and 'date_to'. However, it does not specify the date format, query syntax, or how these parameters interact, leaving significant ambiguity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Clear captured events on a webhook') and the optional scoping by date or search query, which makes the core purpose obvious. However, it does not explicitly differentiate from the sibling tool 'delete_request' (singular) or mention 'all', relying on the tool name to imply bulk deletion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides a clear use case: 'Use to reset an inbox before a new sign-up or test run.' This gives strong contextual guidance for when to invoke the tool, though it does not mention when not to use it or name alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_requestA
Delete one captured HTTP, email, or DNS event by request id.
| Name | Required | Description | Default |
|---|---|---|---|
| request_id | Yes | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the destructive action and target scope, but does not disclose whether deletion is permanent, whether webhook ownership is required, or any side effects or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single 13-word sentence, front-loaded with the verb and target, with no redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter delete tool with an output schema, the description is largely adequate, but it lacks usage boundaries and permanence/authorization details, leaving the agent to infer important operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes webhook_token as a UUID from create_webhook. The description adds that request_id identifies the event to delete, but does not provide its format, where to obtain it, or any additional context to compensate for the undocumented request_id parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Delete' and names the exact resource: 'one captured HTTP, email, or DNS event by request id.' This clearly distinguishes it from sibling tools like delete_webhook and delete_all_requests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'one...by request id' implies the tool is for deleting a single captured event, which provides some usage context. However, it does not explicitly state when not to use it or name alternatives such as delete_all_requests for bulk deletion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_webhookA
Permanently delete a webhook and every captured request/email.
Use when the user is done with a temp inbox or wants to clean up.
| Name | Required | Description | Default |
|---|---|---|---|
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It states the action is 'Permanently delete' and that it deletes 'every captured request/email', which conveys irreversibility and scope. However, it does not mention any permissions, side effects, or error conditions. The description adds some value beyond the schema but could be more explicit about the destructive nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded. The first sentence states the core action, and the second sentence provides usage context. No wasted words; every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no nested objects, output schema present), the description is fairly complete. It explains the destructive scope and usage context. It could mention that the action is irreversible, but the word 'Permanently' already implies that. The output schema exists, so return values need not be described.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100% (the only parameter, webhook_token, is described as 'Webhook UUID returned by create_webhook'). The description does not add additional parameter semantics beyond what the schema provides. Baseline 3 is appropriate since the schema already documents the parameter well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Permanently delete a webhook and every captured request/email.' It uses a specific verb (delete) and resource (webhook), and distinguishes it from sibling tools like delete_request and delete_all_requests by specifying it deletes the webhook itself along with all captured data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: 'Use when the user is done with a temp inbox or wants to clean up.' It implies when to use this tool, but does not explicitly mention alternatives or when not to use it. However, the context is clear enough for an agent to select it appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
export_webhook_dataA
Full dump of captured HTTP/email/DNS events, including HTML and untruncated bodies.
Use this when list/wait tools omitted HTML or truncated a body.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility. While the tool appears to be a read-only data export (no side effects implied), the description does not explicitly state that it is non-destructive or mention any rate limits or permissions. It is adequate but could be more explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and to the point, with no unnecessary words. It efficiently conveys the tool's function and when to use it.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description mentions the output includes 'HTML and untruncated bodies' which gives some context, but it does not explain the limit parameter or how pagination or data volume is handled. Since an output schema exists (as indicated), the return format need not be detailed, but the missing limit explanation leaves a slight gap in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The webhook_token parameter is well described as 'Webhook UUID returned by create_webhook', but the limit parameter has no description in the schema nor in the tool description. With only one of two parameters documented, the schema coverage is low, and the description does not compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Full dump of captured HTTP/email/DNS events, including HTML and untruncated bodies.' It also distinguishes itself from siblings with the explicit note 'Use this when list/wait tools omitted HTML or truncated a body.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool versus alternatives: 'Use this when list/wait tools omitted HTML or truncated a body.' This directly addresses the decision point among the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
extract_links_from_requestA
Pull confirm, reset, magic-link, and other URLs from a captured email or HTTP body.
Use after wait_for_email or get_webhook_requests when the user needs
the verification / login / password-reset link or OTP. Defaults to the
latest event. wait_for_email already extracts links and codes.
| Name | Required | Description | Default |
|---|---|---|---|
| request_id | No | ||
| filter_domain | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must bear the burden of explaining behavior. It mentions defaulting to the latest event and the relationship with wait_for_email, but it does not clarify the roles of request_id and filter_domain, nor does it address potential side effects or error conditions. Thus, behavior is only partially transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is relatively brief—four sentences—and conveys essential usage information without excessive verbosity. However, the sentence about wait_for_email already extracting links could be seen as slightly redundant, but it does help distinguish the tool, so it is not wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides enough context for when to use the tool and mentions the default behavior, but it omits explanations for two parameters and does not describe the output format. Given that an output schema exists, the lack of return-value detail is acceptable, but the incomplete parameter context reduces completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has three parameters, but only webhook_token has a description. request_id and filter_domain lack any description, and the tool description does not compensate for this gap—it only hints at 'defaults to the latest event' without explaining request_id's effect. With only 33% schema coverage and no meaningful explanation, parameter semantics are weak.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the function: pulling confirm, reset, magic-link, and other URLs from a captured email or HTTP body. It also distinguishes this tool from siblings by noting that wait_for_email already extracts links and codes, implying this tool serves a different or more specific purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use the tool: after wait_for_email or get_webhook_requests when the user needs verification, login, or password-reset links or OTPs. It also mentions the default behavior of using the latest event, providing clear usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
follow_email_linkA
Open the verify / magic-link / reset URL from a captured sign-up email.
Use after wait_for_email. Only follows http(s) links already in that
inbox. Returns status, final URL, and a short page preview. For OTP
codes, read verification_codes from wait_for_email instead.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | ||
| request_id | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the burden. It discloses that only http(s) links from the inbox are followed and mentions the return values (status, final URL, short preview). It does not mention potential side effects, but the described behavior is reasonably transparent for a link-following tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences, each adding essential information without redundancy. It is well-structured with a clear action, usage context, and contrast.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides necessary context: it references wait_for_email, specifies return outputs, and clarifies limitations. It does not cover error handling or edge cases, but for a simple link-following tool, the information is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (webhook_token) has a schema description, and the tool description adds minimal clarity. 'url' and 'request_id' are not explained, nor is their relationship to the email capture or usage after wait_for_email. Schema coverage is low, and the description fails to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: opening a verify/magic-link/reset URL from a captured sign-up email. It distinguishes from OTP-code retrieval, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs to use after wait_for_email, limits to http(s) links from that inbox, and directs OTP-code extraction to a different tool. Provides clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_canary_tokenA
Make a canary URL, DNS name, or email that alerts when someone opens it.
Use to mark your own files or systems. token_type='email' is a tripwire,
not a sign-up inbox — use create_webhook + wait_for_email for that.
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | No | ||
| token_type | No | url | |
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It transparently states that the token 'alerts when someone opens it' and clarifies that email tokens are tripwires, not inboxes. However, it does not explicitly mention that alerts are sent via the required webhook_token, though this is implied by the parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, consisting of two sentences that directly address purpose and usage caveats without unnecessary fluff. It is well-structured and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool, the description covers its core purpose, usage, and a key behavioral note. It does not describe the return value, but that is not critical for this type of tool, and the output schema is not provided for evaluation. Overall, it is sufficiently complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explains token_type options by mentioning URL, DNS, and email, and the schema describes webhook_token. However, the identifier parameter is not explained at all, leaving some ambiguity about its purpose. Schema coverage is incomplete, so the description adds partial meaning but not full clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Make a canary URL, DNS, or email that alerts when someone opens it.' It uses a specific verb and resource, and distinguishes it from sibling tools like create_webhook and wait_for_email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit usage guidance: 'Use to mark your own files or systems.' It also warns against misuse for email ('not a sign-up inbox') and points to an alternative approach (create_webhook + wait_for_email), which clarifies when to use this tool versus others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_ssrf_payloadB
Build authorized SSRF callback URLs that ping this webhook.
Use only on systems you are allowed to test — not for sign-up email.
Confirm hits with check_for_callbacks. local_bypass_examples cannot
be confirmed here.
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | No | ||
| include_ip | No | ||
| include_dns | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses authorized use and that local_bypass_examples cannot be confirmed, but it doesn't describe the output structure, whether the tool creates a webhook if none exists, or any side effects like logging or rate limits. This is a security-sensitive tool, so more behavioral context is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded with the main action. The multi-line structure with bullet points is clear. No wasted words, but the paragraph break after the first sentence is odd. Still, it's concise and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is an output schema, so return format is covered. The tool has 4 parameters, 4 siblings, and no annotations. The description explains the core purpose, acceptable use, and a key limitation (local_bypass_examples not confirmable). However, it lacks context on how to use the generated URLs (e.g., where to insert them) and what the output looks like without an example, but that is mitigated by the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is low (25%), with only webhook_token having a description. The description mentions 'local_bypass_examples' which is not a parameter, but it doesn't explain identifier, include_ip, or include_dns beyond their names. Includes that they are booleans controlling IP/DNS payloads is inferrable but not explicit. However, the description does indicate that include_ip and include_dns relate to payload construction, so partial value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool generates SSRF callback URLs that ping a webhook. It distinguishes from siblings by naming check_for_callbacks as a companion for confirming hits, and noting local_bypass_examples cannot be confirmed, but it doesn't explicitly contrast with other generation tools like generate_xss_callback.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear usage guidance: use only on authorized systems, not for sign-up email, and confirms hits with check_for_callbacks. It doesn't mention what to do if not authorized or alternatives like generate_xss_callback, but the primary conditions are well stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_xss_callbackA
Build authorized XSS payloads that ping this webhook when they run.
Use only on systems you are allowed to test. Confirm with check_for_callbacks.
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | No | ||
| include_dom | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook | |
| include_cookies | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It mentions 'authorized' and that payloads ping the webhook, but does not disclose side effects (e.g., that the payload may collect cookies or DOM data) or security considerations beyond authorization. The phrase 'authorized XSS payloads' is slightly misleading since the tool itself doesn't authorize; it generates payloads for authorized use. This is adequate but not detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences total, zero waste. Effectively front-loaded with purpose and a usage caution. The description is concise and gets straight to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 4 parameters (one required) and an output schema, but the description is minimal. It doesn't explain output content, parameter roles, or how the payload integrates with the webhook. Given low schema coverage and no annotations, this falls short of what a complex security tool needs. It's missing essential details for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 25% (webhook_token has a description). The description does not explain any parameters, such as identifier, include_dom, or include_cookies. With low schema coverage, the description should compensate, but it doesn't address parameter meaning or defaults, leaving the agent to infer from names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool builds authorized XSS payloads that ping a webhook when executed. This is specific (verb 'build', resource 'XSS payloads', purpose 'ping webhook') and distinguishes it from sibling tools like generate_ssrf_payload or create_webhook.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides usage context: 'Use only on systems you are allowed to test' and suggests confirming via check_for_callbacks. This gives clear authorization guidance, but does not explicitly compare to alternatives or state when not to use it; still, it's sufficient for indicating appropriate scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_latest_requestA
Return only the newest captured event (HTTP, email, or DNS).
Use for a quick peek. Prefer wait_for_email after a sign-up, or
get_webhook_requests to see history.
| Name | Required | Description | Default |
|---|---|---|---|
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the burden. It implies a read-only operation via the word 'get' and the phrase 'quick peek', but does not disclose edge cases, permissions, or side effects. Some context is added but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with the main purpose, followed by practical usage guidance. No redundant or filler content; every sentence contributes value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and the simplicity of the tool (one parameter, getter), the description provides sufficient context. It mentions event types and usage scenarios, though it omits details like behavior with no events, which are likely covered by the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of the parameter with a description: 'Webhook UUID returned by create_webhook'. The tool description adds no additional meaning beyond what the schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Return only the newest captured event' with specific resource types (HTTP, email, DNS). It distinguishes from siblings by explicitly naming alternatives like wait_for_email and get_webhook_requests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance: 'Use for a quick peek. Prefer wait_for_email after a sign-up, or get_webhook_requests to see history.' This tells when to use this tool and when to choose alternatives, fully meeting the criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_webhook_dnsA
Return the DNSHook domain for an existing webhook.
Use for out-of-band DNS callbacks, not for sign-up email. create_webhook
already returns dns.
| Name | Required | Description | Default |
|---|---|---|---|
| validate | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It implies a read-only operation ('Return') and mentions 'existing webhook,' but does not disclose potential errors, side effects, or authentication requirements. It is not misleading, but it is minimal; for a simple getter this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences with the main purpose first. Every sentence adds value, clearly distinguishing usage and providing an alternative. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple getter with an output schema, the description covers the essential purpose, usage, and alternative. It does not mention the validate parameter, but that is a minor gap given the tool's simplicity. Overall, it is adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% (webhook_token is described, validate is not). The description does not elaborate on either parameter, leaving validate's purpose unclear. Since coverage is low, the description should compensate, but it does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: 'Return the DNSHook domain for an existing webhook.' It explicitly distinguishes itself from related tools like get_webhook_email and notes that create_webhook already returns dns, providing a clear scope and purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage guidance: 'Use for out-of-band DNS callbacks, not for sign-up email.' It also points to an alternative (create_webhook already returns dns), making it clear when to use this tool versus others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_webhook_emailA
Return the temp inbox to sign up, verify, magic-link, or reset a password.
Address is {token}@email.webhook.site. Use when the user already has a
token. If they do not, call create_webhook first — it also returns
email. After the site sends mail, call wait_for_email.
| Name | Required | Description | Default |
|---|---|---|---|
| validate | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the address pattern, that this only returns the inbox (not creates a token or waits for mail), which is useful behavioral context. However, it does not explicitly state read-only nature, error cases, or the meaning of the `validate` parameter, though the core behavior is clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences, front-loaded with the primary purpose, followed by the address template and usage/call-order guidance. Every sentence adds necessary context without padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity retrieval tool with an output schema, the description covers the key usage flow, alternatives, and next step. The main gap is the undocumented `validate` parameter, but overall it is sufficiently complete for an agent to correctly select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema documentation covers webhook_token but not validate (50% coverage). The description explains how webhook_token maps to the address and references create_webhook, but it never mentions the `validate` boolean parameter or its effect. The description compensates for webhook_token only, leaving validate undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('Return the temp inbox') and clarifies the token-based address format. It distinguishes itself from siblings by explicitly naming create_webhook and wait_for_email as related tools with different functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use ('Use when the user already has a token') and directs to create_webhook if not, and wait_for_email after mail. This provides clear when-to-use and sequencing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_webhook_infoA
Show webhook settings, expiry, and how many requests it has received.
Use when the user asks if a token is still valid or how it is configured.
| Name | Required | Description | Default |
|---|---|---|---|
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full transparency burden. It conveys a read-only inspection behavior through 'Show' and the validity-check use case, but it does not disclose error behavior, permission requirements, or side-effect guarantees. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no filler: the first states what the tool shows, and the second gives the trigger scenario. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple one-parameter tool with an output schema, so the description does not need to enumerate return fields. It covers purpose, usage trigger, and the read-only nature, making it complete for tool selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the only parameter is already documented as the 'Webhook UUID returned by create_webhook.' The description adds no extra parameter-level meaning, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb 'Show' and enumerates exactly what is returned: webhook settings, expiry, and request count. This clearly distinguishes the tool from sibling tools like get_webhook_requests, get_webhook_url, or create_webhook.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says 'Use when the user asks if a token is still valid or how it is configured,' providing clear trigger conditions. It does not mention exclusions or alternative tools, but the use case is concrete enough for an agent to select it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_webhook_requestsA
List captured HTTP, email, or DNS events for a webhook.
Use to inspect what already arrived. Bodies are truncated and HTML is
omitted; use export_webhook_data for the full dump. For the newest item
use get_latest_request. To wait for something new use wait_for_request
or wait_for_email. Filter emails with request_type='email'.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| request_type | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses the truncated bodies and omitted HTML behavior, which is key for setting expectations. It doesn't mention pagination or the response structure, but the existence of an output schema likely covers return details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a compact paragraph with a clear first sentence and then usage notes. Each sentence adds value: it covers purpose, usage, alternatives, and filtering. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is a list/fetch operation, the description covers the key points: what it lists, limitations (truncated, no HTML), alternatives for full dump, newest item, and waiting. The output schema presumably documents the return fields. With three parameters, two have defaults and enums in the schema, and the description clarifies usage. It is complete for this tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33%: webhook_token is described as 'Webhook UUID returned by create_webhook', but limit and request_type lack description beyond defaults and enum values. The description adds context on how to use request_type to filter emails, and the default values are in the schema. It compensates somewhat, but could add more on limit behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool lists captured HTTP, email, or DNS events for a webhook, which is a specific verb+resource combination. It explicitly distinguishes itself from siblings like export_webhook_data, get_latest_request, and wait_for_request, making it clear this tool is for inspecting past events in a list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear guidance on when to use this tool: to inspect what already arrived, with explicit exclusions: bodies are truncated and HTML omitted, use export_webhook_data for full dump, use get_latest_request for newest item, and use wait_for_request or wait_for_email for waiting for new items. It also gives a filter example for emails.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_webhook_urlA
Return https://webhook.site/{token} for an existing webhook.
Use when the user already has a token and needs the HTTP callback URL.
For a new inbox, create_webhook already returns url.
| Name | Required | Description | Default |
|---|---|---|---|
| validate | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It doesn't explicitly state whether this is read-only or if it triggers any side effects, but given the tool is simple and returns a URL, the description's clarity contributes to behavioral transparency. It also mentions 'existing webhook' implying validation might occur, which is helpful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a short but complete paragraph, with the main sentence (returns URL) followed by a bolded 'Use when' line and a contrast with create_webhook. It's front-loaded and wastes no words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is an output schema (not shown but indicated as true), which likely describes the URL structure. The tool is simple, and the description covers the usage context well, referencing the alternative create_webhook for new inboxes. Could be a 5 but the 'validate' parameter unclear and no mention of error cases, though that might be outside scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: webhook_token has a description ('Webhook UUID returned by create_webhook'), while validate has no description. The description reinforces the purpose of webhook_token but doesn't explain 'validate'. The parameter meanings are mostly clear from the schema, and the description adds value by tying webhook_token to existing webhooks. However, the 'validate' parameter's semantics are ambiguous, so not a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns the HTTPS callback URL for an existing webhook given a token. It distinguishes itself from sibling tools by specifying that it's for existing webhooks and that create_webhook already returns the URL for new inboxes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool: when the user already has a token and needs the HTTP callback URL. It also provides a when-not-to-use by referencing create_webhook for new inboxes, though it doesn't name the exact alternative tool (it does: create_webhook).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_requestsA
Search captured events by method, body text, headers, type, or date.
Use when the user asks to find POSTs, a keyword, or only emails/DNS.
Examples: query='method:POST', query='content:verify', request_type='email'.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No | ||
| date_to | No | ||
| sorting | No | newest | |
| date_from | No | ||
| request_type | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full disclosure burden. It does reveal meaningful behavior—the query syntax (method:, content:) and request_type values—but omits basic semantics like the meaning of limit, sorting values, or whether the search is scoped to a single webhook (only implied via webhook_token). It's not misleading, but it leaves the agent guessing on the output shape and filter semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: one for purpose, one for when-to-use, one with concrete examples. Every line earns its place with zero filler. The example block is scannable and immediately illustrative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter search tool with a query language, the description covers the primary use cases (find by method, keyword, type, date) and introduces the query DSL. An output schema exists, so return values needn't be specified. The main gap is absence of date-format and pagination/limit semantics, but the tool remains usable with defaults.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 14% schema description coverage, the description must compensate for 6 undocumented parameters. It helpfully decodes the query parameter syntax (method:, content:) and demonstrates request_type usage, but says nothing about date_from/date_to format, limit, or the sorting values beyond the 'newest' default. Partial compensation for a large documentation gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource: 'Search captured events by method, body text, headers, type, or date.' The concrete examples (query='method:POST', query='content:verify', request_type='email') remove any ambiguity about what fields are searchable, cleanly distinguishing this from sibling retrieval tools like get_latest_request.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to reach for this tool: 'Use when the user asks to find POSTs, a keyword, or only emails/DNS.' This is clear, actionable when-to-use context. It doesn't name exclusions or point to alternatives like get_webhook_requests, but the trigger conditions are specific enough that an agent would rarely misfire.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_multiple_requestsA
POST several sample JSON payloads to the webhook, optionally spaced out.
Use to load-test capture, not to wait for a real site or email.
| Name | Required | Description | Default |
|---|---|---|---|
| delay_ms | No | ||
| payloads | Yes | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It states the core behavior (POSTing payloads, optional delay) but does not disclose side effects, error behavior, or any prerequisites (e.g., webhook must exist). For a write operation, this is minimal but not misleading; it adds the load-test intent. It is adequate for a simple tool but could mention that it generates network traffic and may be used for testing only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loaded with the main operation and immediately followed by a clear usage note. Every sentence adds value with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 params, no nested objects) and the existence of an output schema, the description covers the essential purpose and usage. It lacks explicit mention of the output/return value but that is handled by the schema. It could detail payload constraints (e.g., any JSON object) but is otherwise sufficient for a straightforward webhook sender.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is low (33%) with only webhook_token described. The description says 'optionally spaced out' which hints at delay_ms but doesn't clarify its unit or purpose beyond spacing. For payloads, 'sample JSON payloads' gives a hint but does not specify allowed structure or that any object is fine. Since coverage is low, the description should have compensated more, but it adds only minimal clarification, leaving the agent to guess about payload format and delay semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action: 'POST several sample JSON payloads to the webhook', which specifies the verb, resource, and scope. It also distinguishes itself from the sibling tool send_to_webhook by implying multiple requests vs single, and effectively differentiates its use case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit usage guidance is given: 'Use to load-test capture, not to wait for a real site or email.' This tells the agent exactly when to invoke this tool and when not to, implying alternatives like wait_for_request or wait_for_email for real interactions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_to_webhookA
POST JSON to the webhook URL to test that capture works.
Use when the user wants to send a sample payload, not when they are waiting for a real site or email.
| Name | Required | Description | Default |
|---|---|---|---|
| data | Yes | ||
| headers | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description must carry the behavioral transparency burden. It discloses that the tool POSTs JSON, but it does not explain side effects (e.g., whether a request record is created), authentication requirements, rate limits, or what the response contains. For a send/test mutation without annotations, this is too thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the first sentence states the action, and the second gives practical usage guidance. Every sentence contributes value without unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has three parameters including a nested object and an output schema, but the description does not cover important operational details such as how headers are used, what the response represents, or the significance of webhook_token. It is adequate for a trivial test action but incomplete for a tool with this schema complexity and no annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%, and the description adds little beyond 'JSON'. It does not clarify the role of data, headers, or webhook_token, nor how they relate to the HTTP request. The schema helpfully describes webhook_token, but data and headers are left under-explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'POST JSON to the webhook URL to test that capture works.' It also distinguishes this tool from related send/wait tools by mentioning 'sample payload' and contrasting with waiting for real sites or emails.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides a when-to-use ('when the user wants to send a sample payload') and a when-not-to-use ('not when they are waiting for a real site or email'). However, it does not name alternative sibling tools, such as send_multiple_requests or wait_for_request, so it stops short of fully explicit alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_webhookB
Change how an existing webhook responds (status, body, timeout, CORS).
Use after create_webhook when the user wants a different canned reply.
| Name | Required | Description | Default |
|---|---|---|---|
| cors | No | ||
| timeout | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook | |
| default_status | No | ||
| default_content | No | ||
| default_content_type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. The description only says 'Change how an existing webhook responds' which implies mutation but doesn't disclose whether updates are immediately effective, whether partial updates are possible (parameters are optional), what happens if invalid values are given, or if there are any side effects. Given that this is a mutation tool with zero annotation coverage, more detail is needed about behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, two sentences, front-loaded with the purpose. The first sentence covers the main action, the second gives usage guidance. No unnecessary fluff. Could be structured slightly better by mapping the listed aspects to parameter names, but it's passable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 6 parameters, low schema coverage, no annotations, and a complex mutation operation, the description is incomplete. It doesn't explain the semantics of parameters like default_status vs default_content, whether all parameters are optional (though the schema shows defaults null, so likely), what the output schema contains (though output schema exists, so that helps), or how updates are applied. Given the tool's complexity and lack of structured metadata, the description should provide more context. However, the output schema reduces some burden about return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 17% (only webhook_token has a description). The tool description adds a list of fields it can change: status, body, timeout, CORS. However, it doesn't map these to the actual parameter names (default_status, default_content, default_content_type, timeout, cors). The description uses generic terms that roughly correspond but cause ambiguity. With 6 parameters and low schema coverage, the description should do more to clarify each parameter's meaning. It's borderline minimum viable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool changes 'how an existing webhook responds' and lists the specific aspects: status, body, timeout, and CORS. This distinguishes it from sibling tools like create_webhook (creation) and send_to_webhook (sending requests). It could be more explicit about it being an update to a specific pre-created webhook, but the mention of 'existing webhook' and webhook_token clarify that.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use after create_webhook when the user wants a different canned reply.' This provides clear guidance on when to use the tool and implies a prerequisite (webhook must already exist). It doesn't explicitly exclude alternatives, but the context of sibling tools makes it obvious. The guidance could mention that other tools like get_webhook_info are for reading, not updating, but it's adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wait_for_emailA
Wait for a sign-up, verify, magic-link, or password-reset email (1-120s).
Call this after the user (or you) submitted {token}@email.webhook.site
on a website. Returns subject, a truncated text preview, extracted
confirm / reset / login URLs, and verification_codes (OTP). Next:
follow_email_link, or type the code. HTML is omitted; use
export_webhook_data for the full message. Set return_existing=true if
the email already arrived. If there is no token yet, create_webhook first.
| Name | Required | Description | Default |
|---|---|---|---|
| extract_links | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook | |
| return_existing | No | ||
| timeout_seconds | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that HTML is omitted and directs to export_webhook_data, explains the return_existing flag for pre-arrived emails, and mentions the prerequisite of creating a webhook. It does not mention any potential side effects or rate limits, but the key behavioral facts are covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, three sentences, and front-loaded with the primary purpose. It includes important conditional guidance (when to use return_existing, when to create_webhook first) without excessive detail. A slight improvement could be to structure the return_existing and timeout info more prominently, but it's well-organized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is moderately complex with 4 parameters and a return payload including URLs and OTP codes. The description covers the main usage flow, mentions the return data, and provides pointers for additional use cases (full HTML, following links). The output schema exists, so the description needn't detail the return structure. It doesn't mention edge cases like multiple emails or filtering, but for the core use case it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 25% (only webhook_token has a description). The description adds meaning for the parameters: it explains return_existing (return_existing=true if email already arrived), timeout_seconds range (1-120s), and clarifies webhook_token format (UUID from create_webhook). This compensates for the low schema coverage, though extract_links is not explicitly explained in the description but is self-evident.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool waits for specific types of emails (sign-up, verify, magic-link, password-reset) with a timeout range. It specifies the output (subject, preview, URLs, verification codes) and names the sibling tool 'create_webhook' for prerequisite setup, distinguishing it from 'wait_for_request' and 'follow_email_link'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool (after submitting a webhook email on a website) and mentions the alternative for full HTML (export_webhook_data) and the follow_email_link tool. However, it doesn't explicitly state when NOT to use this tool versus other similar tools like wait_for_request.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wait_for_requestA
Poll until a new HTTP (or DNS) callback hits the webhook (1-120s).
Use after giving a site the webhook URL. Bodies are truncated and HTML
is omitted; use export_webhook_data for the full dump. For verification
/ magic-link / password-reset mail, use wait_for_email instead. Set
return_existing=true if the request may already be there.
| Name | Required | Description | Default |
|---|---|---|---|
| request_type | No | ||
| webhook_token | Yes | Webhook UUID returned by create_webhook | |
| return_existing | No | ||
| timeout_seconds | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It discloses non-obvious behavior: polling waits, 1-120s request window, truncated bodies, omitted HTML, and the return_existing caveat. It does not fully explain consumption/ordering or timeout edge cases, but it provides meaningful transparency beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the core purpose, and every sentence adds a distinct useful fact: timing, usage timing, data truncation, alternative tool, and existing-request handling. There is no fluff or tautology.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter polling tool with an output schema and no annotations, this is nearly complete. It covers when to use it, when not to use it, an alternative for full data, and the return_existing scenario. The main remaining gap is some ambiguity around the request_type parameter, especially its 'email' enum value, since the description directs email-specific cases to wait_for_email.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is low (25%), yet the description adds important parameter meaning: timeout is bounded to 1-120s, return_existing=true can be used when the request may already be there, and webhook_token is the UUID from create_webhook. The request_type parameter is only partially clarified by 'HTTP (or DNS)' and the explicit exclusion of email verification cases, so a small gap remains.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Starts with a concrete verb and object: 'Poll until a new HTTP (or DNS) callback hits the webhook.' This clearly defines the tool's purpose and distinguishes it from sibling tools like wait_for_email, export_webhook_data, and get_webhook_requests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage context: 'Use after giving a site the webhook URL.' It names clear alternatives for overlapping cases: 'use export_webhook_data for the full dump' and 'use wait_for_email instead' for verification/magic-link/password-reset mail. This is strong sibling differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
24 tool updates
v2.2.2- Changed
check_for_callbacks11 fields changed- added
Input schema / properties / identifier / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / identifier / defaultAdded value: +null - removed
Input schema / properties / identifier / descriptionRemoved value: -"Filter for specific identifier in request URL/content" - added
Input schema / properties / identifier / titleAdded value: +"Identifier" - removed
Input schema / properties / identifier / typeRemoved value: -"string" - removed
Input schema / properties / since_minutes / descriptionRemoved value: -"Only check requests from the last N minutes (default: 60)" - added
Input schema / properties / since_minutes / titleAdded value: +"Since Minutes" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"check_for_callbacksArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "check_for_callbacksDictOutput", + "type": "object" +}
- Changed
create_webhook3 fields changed- removed
Input schema / requiredRemoved value: -[] - added
Input schema / titleAdded value: +"create_webhookArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "create_webhookDictOutput", + "type": "object" +}
- Changed
create_webhook_with_config38 fields changed- added
Input schema / properties / alias / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / alias / defaultAdded value: +null - removed
Input schema / properties / alias / descriptionRemoved value: -"Custom alias for the webhook URL (3-32 alphanumeric chars)" - added
Input schema / properties / alias / titleAdded value: +"Alias" - removed
Input schema / properties / alias / typeRemoved value: -"string" - added
Input schema / properties / cors / anyOfAdded value: +[ + { + "type": "boolean" + }, + { + "type": "null" + } +] - changed
Input schema / properties / cors / defaultPrevious value: -falseNew value: +null - removed
Input schema / properties / cors / descriptionRemoved value: -"Enable CORS headers for cross-domain requests" - added
Input schema / properties / cors / titleAdded value: +"Cors" - removed
Input schema / properties / cors / typeRemoved value: -"boolean" - added
Input schema / properties / default_content / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / default_content / defaultPrevious value: -""New value: +null - removed
Input schema / properties / default_content / descriptionRemoved value: -"Default response content/body" - added
Input schema / properties / default_content / titleAdded value: +"Default Content" - removed
Input schema / properties / default_content / typeRemoved value: -"string" - added
Input schema / properties / default_content_type / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / default_content_type / defaultPrevious value: -"text/html"New value: +null - removed
Input schema / properties / default_content_type / descriptionRemoved value: -"Default response Content-Type header" - added
Input schema / properties / default_content_type / titleAdded value: +"Default Content Type" - removed
Input schema / properties / default_content_type / typeRemoved value: -"string" - added
Input schema / properties / default_status / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / default_status / defaultPrevious value: -200New value: +null - removed
Input schema / properties / default_status / descriptionRemoved value: -"Default HTTP response status code (200-599)" - added
Input schema / properties / default_status / titleAdded value: +"Default Status" - removed
Input schema / properties / default_status / typeRemoved value: -"integer" - added
Input schema / properties / expiry / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - added
Input schema / properties / expiry / defaultAdded value: +null - removed
Input schema / properties / expiry / descriptionRemoved value: -"Seconds until webhook auto-expires (max 604800 = 1 week)" - added
Input schema / properties / expiry / titleAdded value: +"Expiry" - removed
Input schema / properties / expiry / typeRemoved value: -"integer" - added
Input schema / properties / timeout / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / timeout / defaultPrevious value: -0New value: +null - removed
Input schema / properties / timeout / descriptionRemoved value: -"Seconds to wait before returning response (0-30)" - added
Input schema / properties / timeout / titleAdded value: +"Timeout" - removed
Input schema / properties / timeout / typeRemoved value: -"integer" - removed
Input schema / requiredRemoved value: -[] - added
Input schema / titleAdded value: +"create_webhook_with_configArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "create_webhook_with_configDictOutput", + "type": "object" +}
- Changed
delete_all_requests19 fields changed- added
Input schema / properties / date_from / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / date_from / defaultAdded value: +null - removed
Input schema / properties / date_from / descriptionRemoved value: -"Delete requests from this date (format: yyyy-MM-dd HH:mm:ss or 'now-7d')" - added
Input schema / properties / date_from / titleAdded value: +"Date From" - removed
Input schema / properties / date_from / typeRemoved value: -"string" - added
Input schema / properties / date_to / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / date_to / defaultAdded value: +null - removed
Input schema / properties / date_to / descriptionRemoved value: -"Delete requests until this date (format: yyyy-MM-dd HH:mm:ss or 'now-7d')" - added
Input schema / properties / date_to / titleAdded value: +"Date To" - removed
Input schema / properties / date_to / typeRemoved value: -"string" - added
Input schema / properties / query / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / query / defaultAdded value: +null - removed
Input schema / properties / query / descriptionRemoved value: -"Delete only requests matching this search query" - added
Input schema / properties / query / titleAdded value: +"Query" - removed
Input schema / properties / query / typeRemoved value: -"string" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"delete_all_requestsArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "delete_all_requestsDictOutput", + "type": "object" +}
- Changed
delete_request6 fields changed- removed
Input schema / properties / request_id / descriptionRemoved value: -"The request UUID to delete" - added
Input schema / properties / request_id / titleAdded value: +"Request Id" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"delete_requestArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "delete_requestDictOutput", + "type": "object" +}
- Changed
delete_webhook4 fields changed- changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"delete_webhookArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "delete_webhookDictOutput", + "type": "object" +}
- Changed
export_webhook_data6 fields changed- removed
Input schema / properties / limit / descriptionRemoved value: -"Maximum number of requests to export (default: 100)" - added
Input schema / properties / limit / titleAdded value: +"Limit" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"export_webhook_dataArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "export_webhook_dataDictOutput", + "type": "object" +}
- Changed
extract_links_from_request14 fields changed- added
Input schema / properties / filter_domain / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / filter_domain / defaultAdded value: +null - removed
Input schema / properties / filter_domain / descriptionRemoved value: -"Only return links matching this domain" - added
Input schema / properties / filter_domain / titleAdded value: +"Filter Domain" - removed
Input schema / properties / filter_domain / typeRemoved value: -"string" - added
Input schema / properties / request_id / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / request_id / defaultAdded value: +null - removed
Input schema / properties / request_id / descriptionRemoved value: -"Specific request UUID to analyze (optional, defaults to latest)" - added
Input schema / properties / request_id / titleAdded value: +"Request Id" - removed
Input schema / properties / request_id / typeRemoved value: -"string" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"extract_links_from_requestArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "extract_links_from_requestDictOutput", + "type": "object" +}
- Added
follow_email_link - Changed
generate_canary_token11 fields changed- added
Input schema / properties / identifier / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / identifier / defaultAdded value: +null - removed
Input schema / properties / identifier / descriptionRemoved value: -"Custom identifier for the canary (e.g., 'confidential-doc', 'admin-panel')" - added
Input schema / properties / identifier / titleAdded value: +"Identifier" - removed
Input schema / properties / identifier / typeRemoved value: -"string" - removed
Input schema / properties / token_type / descriptionRemoved value: -"Type of canary token: 'url' (web link), 'dns' (DNS lookup), 'email' (email tracker)" - added
Input schema / properties / token_type / titleAdded value: +"Token Type" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"generate_canary_tokenArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "generate_canary_tokenDictOutput", + "type": "object" +}
- Changed
generate_ssrf_payload13 fields changed- added
Input schema / properties / identifier / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / identifier / defaultAdded value: +null - removed
Input schema / properties / identifier / descriptionRemoved value: -"Custom identifier to include in payload (e.g., 'param1', 'header-injection')" - added
Input schema / properties / identifier / titleAdded value: +"Identifier" - removed
Input schema / properties / identifier / typeRemoved value: -"string" - removed
Input schema / properties / include_dns / descriptionRemoved value: -"Include DNS-based payload for blind SSRF detection (default: true)" - added
Input schema / properties / include_dns / titleAdded value: +"Include Dns" - removed
Input schema / properties / include_ip / descriptionRemoved value: -"Include IP-based payloads to bypass domain filters (default: true)" - added
Input schema / properties / include_ip / titleAdded value: +"Include Ip" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"generate_ssrf_payloadArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "generate_ssrf_payloadDictOutput", + "type": "object" +}
- Changed
generate_xss_callback13 fields changed- added
Input schema / properties / identifier / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / identifier / defaultAdded value: +null - removed
Input schema / properties / identifier / descriptionRemoved value: -"Custom identifier to track which injection point triggered (e.g., 'comment-field', 'profile-name')" - added
Input schema / properties / identifier / titleAdded value: +"Identifier" - removed
Input schema / properties / identifier / typeRemoved value: -"string" - removed
Input schema / properties / include_cookies / descriptionRemoved value: -"Include payload that exfiltrates cookies (default: true)" - added
Input schema / properties / include_cookies / titleAdded value: +"Include Cookies" - removed
Input schema / properties / include_dom / descriptionRemoved value: -"Include payload that captures DOM info like URL and referrer (default: true)" - added
Input schema / properties / include_dom / titleAdded value: +"Include Dom" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"generate_xss_callbackArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "generate_xss_callbackDictOutput", + "type": "object" +}
- Changed
get_latest_request4 fields changed- changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"get_latest_requestArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "get_latest_requestDictOutput", + "type": "object" +}
- Changed
get_webhook_dns6 fields changed- removed
Input schema / properties / validate / descriptionRemoved value: -"If true, verify the token exists via API call before returning DNS domain" - added
Input schema / properties / validate / titleAdded value: +"Validate" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"get_webhook_dnsArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "get_webhook_dnsDictOutput", + "type": "object" +}
- Changed
get_webhook_email6 fields changed- removed
Input schema / properties / validate / descriptionRemoved value: -"If true, verify the token exists via API call before returning email" - added
Input schema / properties / validate / titleAdded value: +"Validate" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"get_webhook_emailArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "get_webhook_emailDictOutput", + "type": "object" +}
- Changed
get_webhook_info4 fields changed- changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"get_webhook_infoArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "get_webhook_infoDictOutput", + "type": "object" +}
- Changed
get_webhook_requests12 fields changed- removed
Input schema / properties / limit / descriptionRemoved value: -"Maximum number of requests to retrieve (default: 10)" - added
Input schema / properties / limit / titleAdded value: +"Limit" - added
Input schema / properties / request_type / anyOfAdded value: +[ + { + "enum": [ + "web", + "email", + "dns" + ], + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / request_type / defaultAdded value: +null - removed
Input schema / properties / request_type / descriptionRemoved value: -"Filter by request type: 'web' (HTTP requests), 'email', or 'dns'" - removed
Input schema / properties / request_type / enumRemoved value: -[ - "web", - "email", - "dns" -] - added
Input schema / properties / request_type / titleAdded value: +"Request Type" - removed
Input schema / properties / request_type / typeRemoved value: -"string" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"get_webhook_requestsArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "get_webhook_requestsDictOutput", + "type": "object" +}
- Changed
get_webhook_url6 fields changed- removed
Input schema / properties / validate / descriptionRemoved value: -"If true, verify the token exists via API call before returning URL" - added
Input schema / properties / validate / titleAdded value: +"Validate" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"get_webhook_urlArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "get_webhook_urlDictOutput", + "type": "object" +}
- Changed
search_requests29 fields changed- added
Input schema / properties / date_from / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / date_from / defaultAdded value: +null - removed
Input schema / properties / date_from / descriptionRemoved value: -"Filter from date (format: yyyy-MM-dd HH:mm:ss)" - added
Input schema / properties / date_from / titleAdded value: +"Date From" - removed
Input schema / properties / date_from / typeRemoved value: -"string" - added
Input schema / properties / date_to / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / date_to / defaultAdded value: +null - removed
Input schema / properties / date_to / descriptionRemoved value: -"Filter to date (format: yyyy-MM-dd HH:mm:ss)" - added
Input schema / properties / date_to / titleAdded value: +"Date To" - removed
Input schema / properties / date_to / typeRemoved value: -"string" - removed
Input schema / properties / limit / descriptionRemoved value: -"Maximum number of requests to retrieve" - added
Input schema / properties / limit / titleAdded value: +"Limit" - added
Input schema / properties / query / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / query / defaultAdded value: +null - removed
Input schema / properties / query / descriptionRemoved value: -"Additional search query (e.g., 'method:POST', 'content:foobar', 'headers.user-agent:Mozilla')" - added
Input schema / properties / query / titleAdded value: +"Query" - removed
Input schema / properties / query / typeRemoved value: -"string" - added
Input schema / properties / request_type / anyOfAdded value: +[ + { + "enum": [ + "web", + "email", + "dns" + ], + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / request_type / defaultAdded value: +null - removed
Input schema / properties / request_type / descriptionRemoved value: -"Filter by request type: 'web' (HTTP requests), 'email', or 'dns'" - removed
Input schema / properties / request_type / enumRemoved value: -[ - "web", - "email", - "dns" -] - added
Input schema / properties / request_type / titleAdded value: +"Request Type" - removed
Input schema / properties / request_type / typeRemoved value: -"string" - removed
Input schema / properties / sorting / descriptionRemoved value: -"Sort order: 'newest' or 'oldest'" - added
Input schema / properties / sorting / titleAdded value: +"Sorting" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"search_requestsArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "search_requestsDictOutput", + "type": "object" +}
- Changed
send_multiple_requests9 fields changed- removed
Input schema / properties / delay_ms / descriptionRemoved value: -"Delay between requests in milliseconds (default: 0)" - added
Input schema / properties / delay_ms / titleAdded value: +"Delay Ms" - removed
Input schema / properties / payloads / descriptionRemoved value: -"Array of JSON payloads to send to the webhook" - added
Input schema / properties / payloads / items / additionalPropertiesAdded value: +true - added
Input schema / properties / payloads / titleAdded value: +"Payloads" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"send_multiple_requestsArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "send_multiple_requestsDictOutput", + "type": "object" +}
- Changed
send_to_webhook12 fields changed- added
Input schema / properties / data / additionalPropertiesAdded value: +true - removed
Input schema / properties / data / descriptionRemoved value: -"JSON data to send to the webhook" - added
Input schema / properties / data / titleAdded value: +"Data" - added
Input schema / properties / headers / anyOfAdded value: +[ + { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + { + "type": "null" + } +] - changed
Input schema / properties / headers / defaultPrevious value: -{}New value: +null - removed
Input schema / properties / headers / descriptionRemoved value: -"Optional custom headers to include in the request" - added
Input schema / properties / headers / titleAdded value: +"Headers" - removed
Input schema / properties / headers / typeRemoved value: -"object" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"send_to_webhookArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "send_to_webhookDictOutput", + "type": "object" +}
- Changed
update_webhook29 fields changed- added
Input schema / properties / cors / anyOfAdded value: +[ + { + "type": "boolean" + }, + { + "type": "null" + } +] - added
Input schema / properties / cors / defaultAdded value: +null - removed
Input schema / properties / cors / descriptionRemoved value: -"Enable CORS headers for cross-domain requests" - added
Input schema / properties / cors / titleAdded value: +"Cors" - removed
Input schema / properties / cors / typeRemoved value: -"boolean" - added
Input schema / properties / default_content / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / default_content / defaultAdded value: +null - removed
Input schema / properties / default_content / descriptionRemoved value: -"Default response content/body" - added
Input schema / properties / default_content / titleAdded value: +"Default Content" - removed
Input schema / properties / default_content / typeRemoved value: -"string" - added
Input schema / properties / default_content_type / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / default_content_type / defaultAdded value: +null - removed
Input schema / properties / default_content_type / descriptionRemoved value: -"Default response Content-Type header" - added
Input schema / properties / default_content_type / titleAdded value: +"Default Content Type" - removed
Input schema / properties / default_content_type / typeRemoved value: -"string" - added
Input schema / properties / default_status / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - added
Input schema / properties / default_status / defaultAdded value: +null - removed
Input schema / properties / default_status / descriptionRemoved value: -"Default HTTP response status code (200-599)" - added
Input schema / properties / default_status / titleAdded value: +"Default Status" - removed
Input schema / properties / default_status / typeRemoved value: -"integer" - added
Input schema / properties / timeout / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - added
Input schema / properties / timeout / defaultAdded value: +null - removed
Input schema / properties / timeout / descriptionRemoved value: -"Seconds to wait before returning response (0-30)" - added
Input schema / properties / timeout / titleAdded value: +"Timeout" - removed
Input schema / properties / timeout / typeRemoved value: -"integer" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"update_webhookArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "update_webhookDictOutput", + "type": "object" +}
- Changed
wait_for_email9 fields changed- removed
Input schema / properties / extract_links / descriptionRemoved value: -"Whether to extract all URLs from the email body (default: true)" - added
Input schema / properties / extract_links / titleAdded value: +"Extract Links" - added
Input schema / properties / return_existingAdded value: +{ + "default": false, + "title": "Return Existing", + "type": "boolean" +} - removed
Input schema / properties / timeout_seconds / descriptionRemoved value: -"Maximum time to wait in seconds (default: 60)" - added
Input schema / properties / timeout_seconds / titleAdded value: +"Timeout Seconds" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"wait_for_emailArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "wait_for_emailDictOutput", + "type": "object" +}
- Changed
wait_for_request13 fields changed- added
Input schema / properties / request_type / anyOfAdded value: +[ + { + "enum": [ + "web", + "email", + "dns" + ], + "type": "string" + }, + { + "type": "null" + } +] - added
Input schema / properties / request_type / defaultAdded value: +null - removed
Input schema / properties / request_type / descriptionRemoved value: -"Filter by request type: 'web' (HTTP requests), 'email', or 'dns'. Leave empty for any type." - removed
Input schema / properties / request_type / enumRemoved value: -[ - "web", - "email", - "dns" -] - added
Input schema / properties / request_type / titleAdded value: +"Request Type" - removed
Input schema / properties / request_type / typeRemoved value: -"string" - added
Input schema / properties / return_existingAdded value: +{ + "default": false, + "title": "Return Existing", + "type": "boolean" +} - removed
Input schema / properties / timeout_seconds / descriptionRemoved value: -"Maximum time to wait in seconds (default: 60)" - added
Input schema / properties / timeout_seconds / titleAdded value: +"Timeout Seconds" - changed
Input schema / properties / webhook_token / descriptionPrevious value: -"The webhook token (UUID) from webhook.site"New value: +"Webhook UUID returned by create_webhook" - added
Input schema / properties / webhook_token / titleAdded value: +"Webhook Token" - added
Input schema / titleAdded value: +"wait_for_requestArguments" - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "title": "wait_for_requestDictOutput", + "type": "object" +}
23 tool updates
v2.0.3- Added
check_for_callbacks - Added
create_webhook - Added
create_webhook_with_config - Added
delete_all_requests - Added
delete_request - Added
delete_webhook - Added
export_webhook_data - Added
extract_links_from_request - Added
generate_canary_token - Added
generate_ssrf_payload - Added
generate_xss_callback - Added
get_latest_request - Added
get_webhook_dns - Added
get_webhook_email - Added
get_webhook_info - Added
get_webhook_requests - Added
get_webhook_url - Added
search_requests - Added
send_multiple_requests - Added
send_to_webhook - Added
update_webhook - Added
wait_for_email - Added
wait_for_request
23 tool updates
v2.0.0- Removed
check_for_callbacks - Removed
create_webhook - Removed
create_webhook_with_config - Removed
delete_all_requests - Removed
delete_request - Removed
delete_webhook - Removed
export_webhook_data - Removed
extract_links_from_request - Removed
generate_canary_token - Removed
generate_ssrf_payload - Removed
generate_xss_callback - Removed
get_latest_request - Removed
get_webhook_dns - Removed
get_webhook_email - Removed
get_webhook_info - Removed
get_webhook_requests - Removed
get_webhook_url - Removed
search_requests - Removed
send_multiple_requests - Removed
send_to_webhook - Removed
update_webhook - Removed
wait_for_email - Removed
wait_for_request
23 tool updates
v2.1.3- First observed
check_for_callbacks - First observed
create_webhook - First observed
create_webhook_with_config - First observed
delete_all_requests - First observed
delete_request - First observed
delete_webhook - First observed
export_webhook_data - First observed
extract_links_from_request - First observed
generate_canary_token - First observed
generate_ssrf_payload - First observed
generate_xss_callback - First observed
get_latest_request - First observed
get_webhook_dns - First observed
get_webhook_email - First observed
get_webhook_info - First observed
get_webhook_requests - First observed
get_webhook_url - First observed
search_requests - First observed
send_multiple_requests - First observed
send_to_webhook - First observed
update_webhook - First observed
wait_for_email - First observed
wait_for_request
TDQS
Every tool has a clearly defined purpose with explicit guidance on when to use it. Overlaps like get_latest_request vs get_webhook_requests are disambiguated in descriptions, and security tools are separate from email/webhook tools.
All tools follow a consistent verb_noun pattern in snake_case (e.g., create_webhook, delete_request, wait_for_email). Security payload generators use generate_ prefix, and check_for_callbacks fits the pattern. No mixed conventions.
24 tools is on the higher side but justified by the broad scope: webhook lifecycle, email capture, DNS, request management, and security testing. Each tool earns its place, though some could theoretically be merged without much loss.
The surface covers the full lifecycle: create, configure, send, retrieve, wait, export, update, delete, search, and security payload generation. No obvious gaps for the stated purpose of webhook testing and temporary inbox functionality.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Instant no-signup webhook & HTTP-request inspector for testing webhooks and agent tool-callbacks.
A webhook inbox for agents: one call returns a live URL. Mock, verify, inspect and replay.
- webhook.coOAuthco.webhook
Receive, inspect, replay and deliver webhooks — with signature verification and agent triggers.
Anonymous webhook capture, inspection, waiting, and response configuration for AI agents.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables generating webhook endpoints for testing, inspecting and comparing HTTP request payloads, replaying requests from history, and forwarding requests to localhost.2MIT
- AlicenseAqualityDmaintenanceEnables AI agents to create disposable webhook URLs, capture incoming HTTP requests, inspect headers and bodies, and replay them against local or remote endpoints, streamlining the webhook handler development loop.515MIT
- AlicenseAqualityDmaintenanceWebhook management and testing tools for AI agents. Provides tools for sending, validating, generating, and debugging webhooks.553MIT
- FlicenseNot gradedqualityDmaintenanceEnables management and inspection of webhook tokens (URLs) and incoming requests via webhook-test.com, allowing users to create, list, fetch details, fetch payloads, and delete webhooks without custom API integrations.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/zebbern/webhook-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server