Hooklistener

MCP setup · Grok

Hooklistener MCP server for Grok (xAI API)

Add an mcp tool to your xAI Responses API request with server_url set to https://app.hooklistener.com/api/mcp, a server_label, and your Hooklistener API key in headers. xAI connects to the server for you, and Grok can call Hooklistener's tools inside the request. xAI's remote MCP takes a token rather than an OAuth sign-in, so this is the one setup where you use an hklst_ API key.

Setup checked against xAI docs, September 2026

Terminal
curl https://api.x.ai/v1/responses \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $XAI_API_KEY" \
  -d '{
  "model": "grok-4.6",
  "input": [{ "role": "user", "content": "List my Hooklistener endpoints and the last request each one received." }],
  "tools": [{
    "type": "mcp",
    "server_url": "https://app.hooklistener.com/api/mcp",
    "server_label": "hooklistener",
    "headers": { "X-API-Key": "'"$HOOKLISTENER_API_KEY"'" }
  }]
}'
Endpoint
POST https://api.x.ai/v1/responses
Tool type
"type": "mcp"
Required
server_url, server_label
Auth
API key (no OAuth sign-in)
Read-only
allowed_tools with read tools only

Setup

Connect Grok step by step

  1. 01

    Create a Hooklistener API key

    In Hooklistener, open Organization Settings → API Keys and create a key. It starts with hklst_. Export it as HOOKLISTENER_API_KEY next to your XAI_API_KEY.

  2. 02

    Add the MCP tool to your request

    xAI supports remote MCP in its native SDK, the OpenAI-compatible Responses API and the Speech to Speech API. server_url and server_label are required. Hooklistener reads the key from the X-API-Key header, so pass it in headers (extra_headers in the xAI SDK).

    grok_hooklistener.py
    import os
from openai import OpenAI

client = OpenAI(api_key=os.getenv("XAI_API_KEY"), base_url="https://api.x.ai/v1")

response = client.responses.create(
    model="grok-4.6",
    input=[{"role": "user", "content": "Did my Stripe endpoint get any failed webhooks in the last hour?"}],
    tools=[{
        "type": "mcp",
        "server_url": "https://app.hooklistener.com/api/mcp",
        "server_label": "hooklistener",
        "server_description": "Webhook, email and real-time endpoint testing",
        "headers": {"X-API-Key": os.getenv("HOOKLISTENER_API_KEY")},
    }],
)
print(response)
  3. 03

    Check the tool calls

    The response lists the server-side MCP calls Grok made. If there are none, check the key and that your prompt asks for something Hooklistener can answer.

Read-only access

API keys always carry full access, and xAI doesn't support require_approval, so Grok calls tools without asking. Limit it with allowed_tools (allowed_tool_names in the xAI SDK): only the listed tools are exposed to the model, which also trims the context.

tools[0]
{
  "type": "mcp",
  "server_url": "https://app.hooklistener.com/api/mcp",
  "server_label": "hooklistener",
  "headers": { "X-API-Key": "hklst_..." },
  "allowed_tools": [
    "list_endpoints",
    "list_requests",
    "get_request",
    "diagnose_request",
    "list_endpoint_anomalies"
  ]
}

Try it

What to ask Grok

Plain-language requests work; Grok picks from Hooklistener's 67 tools. These are the ones each prompt usually calls.

Summarize webhook failures across all my endpoints from the last hour for the on-call channel.

A scheduled script can post Grok's summary wherever you like.

  • list_endpoints
  • list_requests
  • diagnose_request

What changed in the payloads Shopify sent us today?

Read-only and cheap: a good fit for an allowed_tools list.

  • list_endpoint_anomalies

Is api.example.com up, and how long was it down this week?

Uptime status as part of a larger Grok workflow.

  • list_monitors
  • get_monitor_status

Check the latest GitHub webhook's signature against our stored secret.

Runs on Hooklistener with a stored secret id; the secret never goes into the prompt.

  • verify_request_signature

Troubleshooting

When Grok doesn't connect

401 from Hooklistener
Send the key in headers as X-API-Key, which Hooklistener accepts. The docs only describe authorization as a token placed in the Authorization header, without saying whether a Bearer prefix is added, so the header route is the unambiguous one.
require_approval or connector_id is rejected
xAI doesn't support either parameter. Control risk with allowed_tools instead.
Grok can't replay to localhost
xAI calls Hooklistener from its servers, not your machine. Replays reach localhost only through the Hooklistener CLI listening on your side.

FAQ

Grok and Hooklistener: common questions

Does Grok support remote MCP servers?

Yes, through the xAI API. Add a tool with "type": "mcp", a server_url and a server_label to a Responses API request. Streaming HTTP and SSE servers are supported.

Does xAI's remote MCP support OAuth?

xAI's docs, as of September 2026, describe a token and extra headers, not an OAuth sign-in. Use a Hooklistener API key.

How do I stop Grok from changing anything?

List only read tools in allowed_tools. API keys have full access, so the allowlist is your guardrail.

Keep going

More on the MCP server

Server URL: https://app.hooklistener.com/api/mcp

Other clients

Set up Hooklistener in another tool

Give Grok a webhook URL it can watch

The free plan includes the MCP server, 1 debug endpoint, 1 email inbox and 1 uptime monitor. No credit card.

Start freeSee all MCP tools