# flurryport FlurryPORT CLI - forward webhook captures to your local machine - **Type:** MCP server - **Trust:** 60/100 (B), scored on the package rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 0.6.7 - **Author:** Unknown - **License:** MIT - **npm:** flurryport - **Source:** https://github.com/flurryport/cli - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 60/100 (B), scored on the package rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-09-01T10:02:46.880Z - **Version scanned:** 0.6.7 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `get_capture_url` — Return a capture URL the user pastes into their webhook provider (Stripe/GitHub/etc.), plus the web app - `start_echo_server` — Start or reuse a local echo receiver on the user's machine, so replay can be proven before their - `get_capture_digest` — Grouped digest of captures for a project: totals plus counts by endpoint, event type, provider, - `register_watch` — Register a standing watch on an endpoint: a JSONata predicate over $body, $headers, and $query, - `list_watches` — List the watches on an endpoint with their facts: enabled state, match count, last match time, and - `set_watch_enabled` — Enable or disable a watch by id (disable keeps its history and counters; there is no hard delete). - `list_captures` — Read an endpoint: the captures it holds, newest first, as summaries. Inputs: includeBody to - `wait_for_captures` — Block until a new capture lands on the endpoint or the timeout elapses, then return what is new - `get_capture` — Fetch one capture in full by id: headers, query string, and body. Inputs: captureId, with id - `create_collection` — Create a named collection from one or more captures, PINNING them: members become - `add_to_collection` — Append captures to an existing collection, PINNING them: the incremental half of - `remove_from_collection` — Take one capture out of a collection. Use it to retire a pin that no longer belongs; to swap one - `replace_collection_item` — Swap one capture for another in a collection, in one call: the replacement takes the slot the - `get_replay_target` — One replay target in detail, with its deliveryHeaders: the custom headers applied on top of the - `capture_count` — Cheap progress check: monthly quota usage, plus the accepted and rejected split, the latest - `send_test_event` — Send provider-shaped TEST webhooks to one of the user's capture endpoints, so they can exercise - `forward_to_localhost` — Forward captured webhooks to a URL on the user's OWN machine, such as - `replay_to_target` — Replay one capture to a registered replay target, server-side. Inputs: captureId, targetId from - `create_endpoint` — Create a capture endpoint on a project: a stable inbound URL a sender gets pointed at, and the - `create_transformation` — Create a named JSONata transformation on an endpoint: the reshape step that turns a capture into - `update_transformation` — Update an existing transformation's expression, name, or description instead of creating another. - `bind_transformation` — Arm a pipe: bind a transformation version to an endpoint and a replay target, so a capture - `request_secret_setup` — Ask FlurryPORT to email the endpoint owner a one-hour, single-use page where they paste the - `create_invite` — Mint an invite link so another PERSON and their agent can join an endpoint you own. NOT for - `mint_seat` — Mint a seat pairing code so ANOTHER AI agent can take a seat in a room on an endpoint you own. - `authorize_standing` — Chair gate (#409): authorize a handle's standing-credential slot on an endpoint you own. - `list_members` — List who holds access to an endpoint you own: accepted members with their participant name, role, - `revoke_invite` — Revoke an invite on an endpoint you own: a pending invite's link stops working, and a redeemed - `revoke_member` — Remove an accepted member from an endpoint you own: the membership row is deleted, their - `create_replay_target` — Register a delivery destination, a replay target, on an endpoint. ASK the user which project and - `update_replay_target` — Update a replay target in place, most importantly ARMING it with autoReplay true so standing - `set_target_headers` — Set the COMPLETE custom header set on a replay target. Full replace: include every header you - `set_endpoint_signing` — Set up or rotate signed-intent posting for an endpoint. Inputs: an optional header the signature - `record_recipe_install` — File the owner-side record of a recipe install, at the END of host setup, once the pipe is - `set_orientation` — Set the room map. Marks captureId as the endpoint's current ORIENTATION, the one - `list_sections` — Read the room state: the section map, each handle with what belongs there, the roster, each handle - `get_canon` — Read what currently stands in each section of the room: one ratified recap per section, derived - `post_intent` — Speak into an endpoint: fire a pipe, or say something in a room. Inputs: body (a JSON string), - `request_seat` — Ask for a seat in a room you are only watching. A monitor reads but cannot post, so this lands - `read_pipe_manifest` — Read .flurryport/pipes.json from the working directory: the committed record of the pipes this ## Install **Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for. **Cautions** (coverage gaps and advisories — never blocking) - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"flurryport\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"flurryport\"\n ]\n }\n }\n}" ``` ## Blast radius Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on your machine. - Floor 37, ceiling 61 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/flurryport - Install plan: https://forgeregistry.com/api/v1/packages/flurryport/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/flurryport - HTML page: https://forgeregistry.com/registry/flurryport - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.