80trust / 100

AnyHook

by anyhook.net in Security & trust

MCP serverPassing, checked 7 h ago

A webhook inbox for agents: one call returns a live URL. Mock, verify, inspect and replay.

https://anyhook.net/mcp

Last 30 days

All checks passedSome failedAll failedNot checked
Uptime
100%
Response time
1.2 s typical, 1.2 s slowest 5%
Last check
7 h ago
Next check
any minute now

How to call it

Add it to any MCP client that supports remote servers.

{
  "mcpServers": {
    "anyhook": {
      "type": "http",
      "url": "https://anyhook.net/mcp"
    }
  }
}

12 tools

  • anyhook_mock

    Generate a webhook request with a valid signature for Stripe, GitHub, or Slack. If targetUrl is provided, the request is POSTed there and the response is returned.

  • anyhook_verify

    Verify a webhook signature against a secret. Supports 20 providers including stripe, github, shopify, slack, line, discord, linear, vercel, paddle, hubspot, and paypal.

  • anyhook_providers

    List webhook providers AnyHook can mock, along with the event types available for each.

  • anyhook_apps_list

    List apps in your AnyHook account with inbound URLs, sources, and destination URLs. Check isActive: an inactive app's inbound URL answers setup handshakes but acknowledges and discards event POSTs (202, reason app_inactive) instead of relaying them. Destination signing secrets ar

  • anyhook_inbox

    Every AnyHook app is also an email inbox: mail sent to {user}.{app}@anyhook.net becomes an event (type email.received) you can read with anyhook_events. Returns the address and webhook URL for one of your apps.

  • anyhook_apps_create

    Create a new app with a name, provider source, and (optionally) destinations. Returns the inbound URL. The app is active immediately. Created WITHOUT destinations it still receives and LOGS every event (inspect-only), it just delivers nowhere until a destination is added (PATCH /

  • anyhook_connect

    Wire a provider to AnyHook in one call: give a Stripe or GitHub key and AnyHook registers the app's inbound URL as a webhook at the provider, saves the signing secret it yields, and turns on signature verification at the edge. The provider is read from the key; the key is used on

  • anyhook_replay

    Re-send a stored event to its destinations. Replays sit outside the monthly event quota but within a daily replay limit per plan, and replaying an event that was held for quota bills it as a new event. The destination does run its handler again: a receiver that is not idempotent

  • anyhook_undelivered

    Show events for the given app that have not successfully reached any destination (failed or still retrying).

  • anyhook_replay_failed

    Re-send every failed event for the given app slug. Useful after fixing a downstream bug to recover queued work.

  • anyhook_events

    List webhook events, most recent first: id, app, type, status, attempt, destination status code, latency, timestamp. Summaries only, no request headers or body — call anyhook_inspect with an id from here to read one event's payload. Uses your AnyHook account when connected, other

  • anyhook_inspect

    Full detail for one event by id, including the inbound headers and body that anyhook_events omits, plus the destination's response. Payloads can be large and often contain personal data, so fetch one at a time, only when the body is needed. Account or local store.

Security scan

  • No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks

WhenResultHTTPTime
7 h agoPassed2001.2 s
17 h agoPassed2001.4 s
26 h agoPassed2001.2 s