A webhook inbox for agents: one call returns a live URL. Mock, verify, inspect and replay.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Create a new app with a name, provider source, and (optionally) destinations. Returns the inbound URL. The app is active immediately. Created WITHOUT destinations it still receives and LOGS every event (inspect-only), it just delivers nowhere until a destination is added (PATCH /api/v1/apps/{slug} with {"destinations": [...]}).
Human-readable app name.
Provider name (stripe, github, shopify, ...). Used for signature auto-detection.
Destination URLs that should receive forwarded events.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Create a new app with a name, provider source, and (optionally) destinations. Returns the inbound URL. The app is active immediately. Created WITHOUT destinations it still receives and LOGS every event (inspect-only), it just delivers nowhere until a destination is added (PATCH /api/v1/apps/{slug} with {"destinations": [...]}).
| Argument | Type | Description |
|---|---|---|
| name* | string | Human-readable app name. |
| source* | string | Provider name (stripe, github, shopify, ...). Used for signature auto-detection. |
| destinations | array | Destination URLs that should receive forwarded events. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"name",
"source"
],
"properties": {
"name": {
"type": "string",
"description": "Human-readable app name."
},
"source": {
"type": "string",
"description": "Provider name (stripe, github, shopify, ...). Used for signature auto-detection."
},
"destinations": {
"type": "array",
"items": {
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"format": "uri"
}
},
"additionalProperties": false
},
"description": "Destination URLs that should receive forwarded events."
}
},
"additionalProperties": false
}List apps in your AnyHook account with inbound URLs, sources, and destination URLs. Check isActive: an inactive app's inbound URL answers setup handshakes but acknowledges and discards event POSTs (202, reason app_inactive) instead of relaying them. Destination signing secrets are redacted to has_signing_secret plus a 4-char hint; a new secret in plaintext comes only from rotating it. An app whose slug was changed lists its former URLs under legacyInboundUrls; those still route to it.
No arguments.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {}
}Save a handler that runs on every event this app receives, in an isolated sandbox, with AnyHook's retries and replay around it: no server of your own. Each run's console output and return value are stored as that delivery's response (anyhook_inspect shows them). It can also run on a cron schedule. Pro and Scale; runs are capped per month with no overage, retries, test runs and schedule firings each count, and each run and package install is charged to the monthly compute allowance (anyhook_usage shows both). Test it with anyhook_code_test before real events arrive.
| Argument | Type | Description |
|---|---|---|
| code* | string | An ES module, run in a sandboxed Node.js on every event this app receives. Either `export default async function (event, { env }) {}` (event: { method, headers, body, raw_body, delivery_id, attempt }; method is always POST, and the query string, path and caller IP are not kept) or a Pipedream Node.js code step: `export default defineComponent({ async run({ steps, $ }) {} })`, where steps.trigger.event is that same event (a step reading query, path, url or client_ip needs changing) and $.export and $.flow.exit work. npm packages it imports are installed on deploy (pin as "[email protected]", like Pipedream; a new package list usually takes seconds, a large one a few minutes). @pipedream/platform is a stand-in. State between events: the app's store (store.get/set/has/delete/keys, set takes { ttl }); every data_store prop is that one store, an app prop's this.<prop>.$auth.<field> reads the secret <APP>_<FIELD>, any other prop the secret named after it (channelId → CHANNEL_ID). Throwing fails the delivery, which AnyHook retries. Templates for common actions (Slack, email, Google Sheets, Notion, Claude and more): https://anyhook.net/code-templates.md |
| appSlug* | string | The app whose events the code runs on. |
The code that runs on this app's events: its source, the names of its secrets (never the values), whether events are reaching it, and runs used this month against the plan's limit.
| Argument | Type | Description |
|---|---|---|
| appSlug* | string | The app whose code handler to read. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appSlug"
],
"properties": {
"appSlug": {
"type": "string",
"description": "The app whose code handler to read."
}
},
"additionalProperties": false
}Run the saved handler now and return its logs, return value and duration: on a stored event (the latest when event_id is omitted) or on a body you give. Counts as a run. Nothing is delivered, but whatever the code itself sends does happen.
| Argument | Type | Description |
|---|---|---|
| body | any | Run on this body instead of a stored event. |
| appSlug* | string | |
| event_id | string | Run on this stored event. Omit for the app's latest event. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appSlug"
],
"properties": {
"body": {
"description": "Run on this body instead of a stored event."
},
"appSlug": {
"type": "string"
},
"event_id": {
"type": "string",
"description": "Run on this stored event. Omit for the app's latest event."
}
},
"additionalProperties": false
}Wire a provider to AnyHook in one call: give a Stripe or GitHub key and AnyHook registers the app's inbound URL as a webhook at the provider, saves the signing secret it yields, and turns on signature verification at the edge. The provider is read from the key; the key is used once and not stored. Without appSlug a new app is created (and removed again if the provider refuses the key). Re-running replaces the registration instead of duplicating it. GitHub sends a signed ping immediately, so the first event appears within seconds. Add a destination afterwards (PATCH /api/v1/apps/{slug}) to forward events; until then they are received and logged.
| Argument | Type | Description |
|---|---|---|
| target | string | GitHub only: "owner/repo", or an organization name for an org-wide hook. Optional when the token administers exactly one repository. |
| appSlug | string | Connect this existing app. Omit to create a new app for the provider. |
| provider_key* | string | A Stripe secret or restricted key (sk_… / rk_…) or a GitHub token (github_pat_… / ghp_…). The provider is read from the key. Used once to register the webhook at the provider; AnyHook does not store it. Least privilege: a Stripe restricted key with Webhook Endpoints = Write, or a fine-grained GitHub token with Webhooks = Read and write. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"provider_key"
],
"properties": {
"target": {
"type": "string",
"description": "GitHub only: \"owner/repo\", or an organization name for an org-wide hook. Optional when the token administers exactly one repository."
},
"appSlug": {
"type": "string",
"description": "Connect this existing app. Omit to create a new app for the provider."
},
"provider_key": {
"type": "string",
"description": "A Stripe secret or restricted key (sk_… / rk_…) or a GitHub token (github_pat_… / ghp_…). The provider is read from the key. Used once to register the webhook at the provider; AnyHook does not store it. Least privilege: a Stripe restricted key with Webhook Endpoints = Write, or a fine-grained GitHub token with Webhooks = Read and write."
}
},
"additionalProperties": false
}List webhook events, most recent first: id, app, type, status, attempt, destination status code, latency, timestamp. Summaries only, no request headers or body — call anyhook_inspect with an id from here to read one event's payload. Uses your AnyHook account when connected, otherwise the local in-memory store.
| Argument | Type | Description |
|---|---|---|
| limit | integer | |
| status | string | Filter by status. Account mode: queued|success|retrying|failed|rejected|circuit_open|quota_exceeded. Local mode: received|forwarded|failed|retrying. |
| appSlug | string | Filter to a specific app slug (account mode). |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"limit": {
"type": "integer",
"maximum": 200,
"minimum": 1
},
"status": {
"type": "string",
"description": "Filter by status. Account mode: queued|success|retrying|failed|rejected|circuit_open|quota_exceeded. Local mode: received|forwarded|failed|retrying."
},
"appSlug": {
"type": "string",
"description": "Filter to a specific app slug (account mode)."
}
},
"additionalProperties": false
}Every AnyHook app is also an email inbox: mail sent to {user}.{app}@anyhook.net becomes an event (type email.received) you can read with anyhook_events. Returns the address and webhook URL for one of your apps.
| Argument | Type | Description |
|---|---|---|
| app | string | App slug (from anyhook_apps_list). Defaults to your first app. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"app": {
"type": "string",
"description": "App slug (from anyhook_apps_list). Defaults to your first app."
}
},
"additionalProperties": false
}Full detail for one event by id, including the inbound headers and body that anyhook_events omits, plus the destination's response. Payloads can be large and often contain personal data, so fetch one at a time, only when the body is needed. Account or local store.
| Argument | Type | Description |
|---|---|---|
| id* | string | Event ID returned by anyhook_events. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Event ID returned by anyhook_events."
}
},
"additionalProperties": false
}Generate a webhook request with a valid signature for Stripe, GitHub, or Slack. If targetUrl is provided, the request is POSTed there and the response is returned.
| Argument | Type | Description |
|---|---|---|
| data | object | Optional fields to deep-merge into the fixture. |
| event* | string | Event name (e.g. 'payment_intent.succeeded' for Stripe). |
| secret | string | Signing secret. Falls back to a deterministic default per provider. |
| provider* | string | Webhook provider to simulate. |
| targetUrl | string | If set, POST the generated request to this URL and return the response. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"provider",
"event"
],
"properties": {
"data": {
"type": "object",
"description": "Optional fields to deep-merge into the fixture.",
"additionalProperties": {}
},
"event": {
"type": "string",
"description": "Event name (e.g. 'payment_intent.succeeded' for Stripe)."
},
"secret": {
"type": "string",
"description": "Signing secret. Falls back to a deterministic default per provider."
},
"provider": {
"enum": [
"stripe",
"github",
"slack"
],
"type": "string",
"description": "Webhook provider to simulate."
},
"targetUrl": {
"type": "string",
"format": "uri",
"description": "If set, POST the generated request to this URL and return the response."
}
},
"additionalProperties": false
}List webhook providers AnyHook can mock, along with the event types available for each.
No arguments.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {}
}Re-send a stored event to its destinations. Replays sit outside the monthly event quota but within a daily replay limit per plan and the monthly compute allowance (anyhook_usage), and replaying an event that was held for quota bills it as a new event. The destination does run its handler again: a receiver that is not idempotent will process the event twice while debugging.
| Argument | Type | Description |
|---|---|---|
| id* | string | Event ID to replay. Replay does not consume event quota; it is charged to the compute allowance. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Event ID to replay. Replay does not consume event quota; it is charged to the compute allowance."
}
},
"additionalProperties": false
}Re-send every failed event for the given app slug. Useful after fixing a downstream bug to recover queued work.
| Argument | Type | Description |
|---|---|---|
| appSlug* | string | Bulk-replay every failed event for this app. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appSlug"
],
"properties": {
"appSlug": {
"type": "string",
"description": "Bulk-replay every failed event for this app."
}
},
"additionalProperties": false
}Show events for the given app that have not successfully reached any destination (failed or still retrying).
| Argument | Type | Description |
|---|---|---|
| limit | integer | |
| appSlug* | string |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appSlug"
],
"properties": {
"limit": {
"type": "integer",
"maximum": 200,
"minimum": 1
},
"appSlug": {
"type": "string"
}
},
"additionalProperties": false
}What the plan allows and what this account has used of each: events this month (per delivery, large events count per 64 KB), overage, the compute allowance and what used it (retries, replays, waiting on slow destinations, code runs, builds, schedules), API calls today (each tool call that reads or changes the account counts one), code runs and package snapshots, with when each resets. Call it when something answers with a limit, before bulk work such as replay_failed, or when the user asks what they are using.
No arguments.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {}
}Verify a webhook signature against a secret, for every source the AnyHook edge verifies, including stripe, github, shopify, slack, line, discord, linear, vercel, paddle, hubspot, paypal and xero.
| Argument | Type | Description |
|---|---|---|
| body* | string | Raw request body. |
| secret* | string | Signing secret to verify against. |
| headers* | object | Request headers as a flat object. |
| provider* | string | Provider name (e.g. 'stripe', 'github', 'slack', 'generic'). |
| requestUrl | string | Original request URL (required for Twilio/HubSpot). Defaults to a placeholder. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"provider",
"headers",
"body",
"secret"
],
"properties": {
"body": {
"type": "string",
"description": "Raw request body."
},
"secret": {
"type": "string",
"description": "Signing secret to verify against."
},
"headers": {
"type": "object",
"description": "Request headers as a flat object.",
"additionalProperties": {
"type": "string"
}
},
"provider": {
"type": "string",
"description": "Provider name (e.g. 'stripe', 'github', 'slack', 'generic')."
},
"requestUrl": {
"type": "string",
"format": "uri",
"description": "Original request URL (required for Twilio/HubSpot). Defaults to a placeholder."
}
},
"additionalProperties": false
}| enabled |
| boolean |
| Whether events run the code. false saves it switched off, so it runs only through anyhook_code_test. Omit: a first deploy goes live and later deploys keep the current state. Deploy off while another system still handles the same events, or both will act on each one. |
| secrets | object | Environment variables for the code, read as env.NAME or process.env.NAME. Merged into the saved ones; null removes a name. |
| schedule | string | null | Also run on a cron schedule: five fields, UTC unless prefixed CRON_TZ=Area/City, e.g. "*/15 * * * *". Each firing arrives as an anyhook.schedule event and counts as a run. null removes it; omit to keep it. Only on an app that does not verify a sender's signature. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"appSlug",
"code"
],
"properties": {
"code": {
"type": "string",
"description": "An ES module, run in a sandboxed Node.js on every event this app receives. Either `export default async function (event, { env }) {}` (event: { method, headers, body, raw_body, delivery_id, attempt }; method is always POST, and the query string, path and caller IP are not kept) or a Pipedream Node.js code step: `export default defineComponent({ async run({ steps, $ }) {} })`, where steps.trigger.event is that same event (a step reading query, path, url or client_ip needs changing) and $.export and $.flow.exit work. npm packages it imports are installed on deploy (pin as \"[email protected]\", like Pipedream; a new package list usually takes seconds, a large one a few minutes). @pipedream/platform is a stand-in. State between events: the app's store (store.get/set/has/delete/keys, set takes { ttl }); every data_store prop is that one store, an app prop's this.<prop>.$auth.<field> reads the secret <APP>_<FIELD>, any other prop the secret named after it (channelId → CHANNEL_ID). Throwing fails the delivery, which AnyHook retries. Templates for common actions (Slack, email, Google Sheets, Notion, Claude and more): https://anyhook.net/code-templates.md"
},
"appSlug": {
"type": "string",
"description": "The app whose events the code runs on."
},
"enabled": {
"type": "boolean",
"description": "Whether events run the code. false saves it switched off, so it runs only through anyhook_code_test. Omit: a first deploy goes live and later deploys keep the current state. Deploy off while another system still handles the same events, or both will act on each one."
},
"secrets": {
"type": "object",
"description": "Environment variables for the code, read as env.NAME or process.env.NAME. Merged into the saved ones; null removes a name.",
"additionalProperties": {
"type": [
"string",
"null"
]
}
},
"schedule": {
"type": [
"string",
"null"
],
"description": "Also run on a cron schedule: five fields, UTC unless prefixed CRON_TZ=Area/City, e.g. \"*/15 * * * *\". Each firing arrives as an anyhook.schedule event and counts as a run. null removes it; omit to keep it. Only on an app that does not verify a sender's signature."
}
},
"additionalProperties": false
}