Checked September 2026 · 10 servers

Webhook MCP servers compared (2026): testing webhooks with AI coding agents

The webhook MCP servers an AI coding agent can use in 2026 are Hooklistener, Hookdeck's CLI MCP, requestbin.net, webhooks.cc, Beeceptor, Webhook Relay, Svix's Dashboard MCP, plus Pinggy for tunnels; ngrok's MCP only searches its docs and webhook.site has no official server. The difference that matters is whether the agent can get a public URL, wait for the webhook to arrive, check its signature and replay it to localhost from one server. Hooklistener is the only one that is hosted with OAuth and also covers email inboxes, WebSocket/MQTT endpoints and tunnels.

We make Hooklistener, so read this with that in mind. Every competitor cell below comes from the vendor's own docs, README, npm or pricing page, linked in the sources. Where a vendor does not document something, the table says so instead of guessing.

Webhook MCP servers at a glance

What each MCP server can do, as documented by the vendor. Checked September 2026. Scroll sideways on small screens.

Comparison of webhook MCP servers by transport, auth, wait tool, replay, signature verification, email testing, WebSocket and MQTT, tunnels, free tier and source, checked September 2026
ServerHosted or localAuthWait for a webhookReplay / re-signSignature checkEmail testingWebSocket / MQTTTunnelsFree tierSource
Hooklistener67 tools, 26 listed by defaultHosted, Streamable HTTP at app.hooklistener.com/api/mcp. Nothing to install.OAuth (PKCE, dynamic client registration) with full_access or read_only scope; hklst_ API key as Bearer for clients without OAuth.Yes. wait_for_request matches method, path, event type, headers or body; returns a durable task by default, or blocks up to 60 s with blocking: true. Also wait_for_email and wait_for_realtime_message.Yes. replay_request with edited headers/body, optional Stripe, GitHub or Slack re-signing, to a public URL or your CLI listener on localhost. Dry run first, idempotency key required.Yes. verify_request_signature for Stripe, GitHub and Slack against a stored secret (secrets are on paid plans).Yes. create_inbox, wait_for_email, get_email.Yes. WebSocket, Socket.IO, MQTT-over-WebSocket and SSE sink endpoints with wait and send tools.Yes. CLI tunnels (Pro and up); MCP tunnel tools need a scoped grant.1 endpoint, 50 stored requests, 1-day history, 1 inbox. MCP on every plan.
HookdeckCLI MCP, betaLocal stdio: hookdeck gateway mcp, run by your MCP client. No URL or port.hookdeck login (browser) or HOOKDECK_API_KEY; a hookdeck_login tool appears until you sign in.No tool listed. Tools list and get requests, events and attempts.Retry of events and requests with --allow-write. Read-only by default.Not documented as an MCP tool.Not documented.Not documented.hookdeck listen in the CLI forwards to localhost; not an MCP tool.Developer plan: 10,000 events/month, 3-day retention, 1 user.
requestbin.net8 bin tools + 5 mock toolsLocal: npm @requestbin/mcp-server, run with npx.API key (REQUESTBIN_API_KEY).No tool listed. list_interactions reads captured requests.replay_request sends a request to any URL, executed server-side; get_replay_status. Re-signing not documented.Not documented.Not documented.Not documented.Not documented.3 bins, 500 requests/bin/day, last 100 requests kept per bin.
webhooks.cc25 toolsLocal stdio: npx -y @webhooks-cc/mcp.API key (WHK_API_KEY).Yes. wait_for_request and wait_for_requests (polling).replay_request to a target URL; send_webhook and send_to send provider-signed test webhooks.Yes. verify_signature for its provider templates.No tool listed.No tool listed.whk tunnel in the CLI; not an MCP tool.50 requests per 24 h, 7-day retention, unlimited endpoints.
BeeceptorMock-server focusedHosted at mcp.beeceptor.com/mcp (Claude Desktop bridges with mcp-remote).OAuth.Not documented. Request history search is documented.Not documented.Not documented.Not documented.Not documented.Local tunnel on the platform (ephemeral on Free); not documented as an MCP tool.50 requests/day per endpoint, 3 mock rules.
Webhook RelayForwarding and transformsHosted at my.webhookrelay.com/v1/mcp.OAuth when added as a Claude.ai connector; Bearer token otherwise.Partly. wait_for_webhook_log waits up to 60 s for a known delivery to settle, typically after send_webhook.retry_webhook resends a logged webhook. Re-signing not documented.Not documented as an MCP tool.Not documented.Not documented.Bidirectional tunnels on paid plans (0 on Free); not MCP tools.150 webhooks/month, 2 destinations.
PinggyTunnel MCP, experimentalLocal stdio: uvx pinggy-mcp (Python 3.10+). Tunnels live inside the MCP process.OAuth device flow, or anonymous.No tool listed.No tool listed.No tool listed.No tool listed.No tool listed.Yes. start_tunnel (HTTP, TCP, TLS, UDP), stop_tunnel, list_tunnels, get_tunnel_info.Tunnels time out after 60 minutes; new URL each time.
ngrokDocs-only MCPHosted docs MCP at ngrok.com/docs/mcp.Not documented (it serves public docs).No. Tools only search the docs.No.No.No.No.Through the ngrok agent CLI, not through MCP.$5 one-time credit, up to 3 endpoints, 20k HTTP requests, 1 GB transfer.
webhook.siteNo official MCPNo official server. A community server (zebbern/webhook-mcp-server) runs locally over stdio (Python).Community server: optional WEBHOOK_SITE_API_KEY.Community server only: wait_for_request (1–120 s).Not documented.Not documented.Platform gives each URL an email address; community server has wait_for_email.Not documented.Not documented.URL stops after 100 requests or emails; removed after 7 days.
SvixDashboard MCP for IngestHosted at mcp.us.svix.com/dashboard.Bearer token generated in the Svix dashboard.Not documented. Lists and reads received webhooks.Yes. Resend a webhook or replay missed deliveries.Fetches or rotates endpoint signing secrets; a verify tool is not documented.Not documented.Not documented.Not documented.Free plan with 30-day retention, includes Ingest.

"No tool listed" means the vendor publishes a complete tool list and it has no such tool. "Not documented" means we could not find it in the vendor's docs; it may exist. Platform features that are not exposed as MCP tools are noted as such. Vendors change fast: if a cell is out of date, tell us at support@hooklistener.com.

How to choose

Pick by what the agent has to do

Most of these servers cover one job well. Start from the job, not the tool count.

  1. Build or fix a webhook handler with Claude Code, Cursor or Codex

    Hooklistener, or webhooks.cc if you prefer a local npx server

    Both have a wait tool, signature checks and replay. Hooklistener is hosted with OAuth, so there is no API key in a config file, and it re-signs edited payloads.

  2. Investigate production events already flowing through Hookdeck

    Hookdeck's CLI MCP

    It reads your Event Gateway requests, events, attempts, issues and metrics directly, and pairs with Hookdeck's agent skills. Moving production traffic elsewhere just to debug it makes little sense.

  3. Receive webhooks through Svix Ingest

    Svix Dashboard MCP

    It sets up sources, reads what providers sent, and resends deliveries inside the Svix account you already use.

  4. Mock an HTTP API the agent's code calls

    Beeceptor or requestbin.net

    Their MCP tools centre on mock rules and responses. Hooklistener has response rules too, but mocking is Beeceptor's core product.

  5. Just expose localhost from the agent

    Pinggy's MCP, or ngrok's agent CLI

    If you only need a tunnel, a tunnel tool is enough. Pinggy's MCP starts and stops tunnels; ngrok's MCP only searches ngrok's docs, so the agent runs the ngrok CLI instead.

  6. Test sign-up, magic-link or WebSocket flows as well as webhooks

    Hooklistener

    The same server has email inboxes with wait_for_email and WebSocket, Socket.IO, MQTT and SSE endpoints with wait and send tools. None of the other servers here documents either.

Checklist

What an agent actually needs from a webhook MCP server

Six things decide whether an agent can close the loop on its own or has to stop and ask you.

A public URL in one call
The agent should get a URL it can paste into Stripe or GitHub without asking you to open a dashboard or start a tunnel first. Hosted servers do this in one tool call; a local stdio server can only do it if it also talks to a hosted receiver.
A wait tool
Webhooks arrive seconds after the action that triggers them. Without a wait tool, the agent polls a list tool in a loop and burns context. Hooklistener and webhooks.cc document one; most others do not.
Signature verification
A 400 from your handler is usually a signature problem: wrong secret, parsed body, or an old timestamp. A tool that checks the captured bytes against the secret tells the agent which one, without the agent ever seeing the secret.
Replay to localhost
Once the handler is fixed, the agent needs to send the same payload again. Replaying from a hosted service can only reach public URLs, so the replay has to go through a tunnel or CLI listener on your machine. If you edit the body, the payload has to be re-signed or verification fails.
A read-only mode
Most debugging sessions only read. A read-only scope (Hooklistener) or read-only default (Hookdeck) means you can hand the agent production traffic without handing it the delete button.
Safe deletes and replays
Agents retry. Deletes should need a preview and an explicit confirmation, and replays should take an idempotency key so a retried call does not fire the webhook twice.
Worked example

A Stripe webhook, end to end, from the agent

You ask the agent to fix your checkout.session.completed handler. With Hooklistener connected, it makes five kinds of tool call and never leaves the chat.

wait_for_request holds the call open for up to 60 seconds and returns the matching request, so the agent does not poll. Without blocking: true it returns a task receipt instead; a timeout of 0 only checks what has already arrived.

verify_request_signature and re-signing take a secret_id, never the secret itself. Secrets are on paid plans; the rest of this flow works on Free.

With a read_only grant the agent can still wait, search, diff, validate and verify signatures, but creating, replaying and deleting are refused.

connect
# Claude Code: add the hosted server, then run /mcp to sign in
claude mcp add --transport http hooklistener https://app.hooklistener.com/api/mcp

# Keep a CLI listener running so replays with target "cli" reach localhost
hooklistener listen stripe-checkout-x7kq --target http://localhost:3000/webhooks/stripe
tool calls
// 1. Get a public URL
create_endpoint({ "name": "Stripe checkout test" })
// -> { "id": "ep_…", "slug": "stripe-checkout-x7kq", "webhook_url": "https://…" }
//    Paste the URL into Stripe (test mode), then run:
//    stripe trigger checkout.session.completed

// 2. Hold the call open until the webhook lands (max 60 s)
wait_for_request({
  "endpoint_id": "ep_…",
  "event_type": "checkout.session.completed",
  "timeout": 60,
  "blocking": true
})

// 3. Check the signature against a stored secret (never the plaintext)
verify_request_signature({
  "endpoint_id": "ep_…",
  "request_id": "req_…",
  "provider": "stripe",
  "secret_id": "sec_…"
})

// 4. Replay to your local handler with an edited body, re-signed.
//    Preview first, then run with an idempotency key.
replay_request({
  "endpoint_id": "ep_…",
  "request_id": "req_…",
  "target": "cli",
  "body_patch_json": "{\"data\":{\"object\":{\"amount_total\":0}}}",
  "signing_provider": "stripe",
  "signing_secret_id": "sec_…",
  "dry_run": true
})

// 5. Clean up: preview, then confirm
delete_endpoint({ "endpoint_id": "ep_…", "dry_run": true })
delete_endpoint({ "endpoint_id": "ep_…", "confirmed": true })
Fair's fair

Where other tools are stronger

Hooklistener is a debugging tool with 67 MCP tools in 7 toolsets. It is not the right answer for every job.

Hookdeck
Hookdeck is a production event gateway with retries, filters and transformations, and it publishes a large set of agent skills for provider signature checks (hookdeck/webhook-skills). If your webhooks already run through Hookdeck in production, its MCP sees that traffic and Hooklistener does not.
Mailtrap
Hooklistener inboxes receive email. If your agent needs to send transactional email or inspect spam scores and HTML client compatibility, Mailtrap's official MCP server covers sending and its Email Sandbox.
ngrok and Pinggy
For general-purpose tunnelling (TCP, UDP, TLS, custom domains), a tunnel product is the better tool. Hooklistener's tunnels are built for webhook and API development.
webhooks.cc
webhooks.cc ships signed test templates for about 30 providers and can send them straight to localhost with send_to. Hooklistener verifies and re-signs Stripe, GitHub and Slack only.
Webhook Relay
Webhook Relay's MCP can write and attach JavaScript or Lua transform functions and connect cloud services such as SQS and Pub/Sub. Hooklistener has no transform functions.
Corrections

About other 2026 roundups

requestbin.net's best webhook testing tools for AI coding agents (2026) lists Hookdeck, Beeceptor and ngrok as having no MCP server. As of September 2026, Hookdeck ships a beta stdio MCP in its CLI, Beeceptor runs a hosted OAuth MCP, and ngrok has a docs-search MCP (though not one that controls tunnels). The post does not cover Hooklistener, webhooks.cc, Webhook Relay or Svix.

The community webhook.site server is capable (it can wait for requests and emails), but it is a third-party Python package that says it is not affiliated with webhook.site, and AgentSeal's automated scan lists it at 19/100 ("Dangerous", scanned March 2026). Check any MCP server's permissions before you give it an API key.

FAQ

What is a webhook MCP server?
It is an MCP server that gives an AI coding agent tools for webhooks: create a public URL, wait for a request to land on it, read the headers and body, check the signature and replay it to your code. MCP calls go from the agent to the server, so the server is what receives the webhook; the agent asks it what arrived.
How do I use webhooks with MCP tools?
Connect a webhook MCP server to your agent, then let the agent call it in order: create an endpoint to get a URL, point the provider at that URL, call a wait tool until the webhook arrives, inspect or verify it, and replay it to your local handler. With Hooklistener that is create_endpoint, wait_for_request, verify_request_signature and replay_request, from one hosted server.
Does webhook.site have an MCP server?
Not an official one, as of September 2026. The best-known community server, zebbern/webhook-mcp-server, says it is not affiliated with webhook.site, runs locally in Python, and is listed at 19/100 (Dangerous) by AgentSeal's scanner. Hooklistener's server is hosted and first-party, with OAuth and a read-only scope.
Does Hookdeck have an MCP server?
Yes. The Hookdeck CLI runs a local stdio MCP server with hookdeck gateway mcp. It is in beta, scoped to your Event Gateway projects, and read-only unless you pass --allow-write. It is built for investigating production event traffic rather than catching a test webhook and waiting for it.
Which webhook MCP server can wait for a webhook to arrive?
Hooklistener (wait_for_request, up to 60 s per call with blocking: true, plus wait_for_email and wait_for_realtime_message) and webhooks.cc (wait_for_request, polling) have documented wait tools. Webhook Relay's wait_for_webhook_log waits for a known delivery to settle. The community webhook.site server has one too. Hookdeck, requestbin.net, Pinggy and ngrok list no wait tool.
Is there a free webhook MCP server?
Several. Hooklistener includes the MCP server on its Free plan (1 endpoint, 50 stored requests, 1-day history). requestbin.net, webhooks.cc and Webhook Relay also list MCP access on their free plans; limits are in the table above.

Give your agent a webhook URL it can wait on

One hosted MCP server for webhooks, email, WebSocket and MQTT endpoints, tunnels and monitors. OAuth sign-in, read-only scope available, free plan included.