Inspect webhooks on localhost without an account. Permanent slugs need OpenWebhook Pro.
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
OPENWEBHOOK_TOKENAPI keyoptionalOptional Pro token for permanent slugs. Leave empty for an anonymous inspect URL.
Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
url.inspectGet the current anonymous HTTPS ingest URL for this process. Call this first, then watch.start with no slug.Get the current anonymous HTTPS ingest URL for this process. Call this first, then watch.start with no slug.
No input schema was published for this tool.
endpoint.listList permanent OpenWebhook slugs for the authenticated Pro account. Returns an empty list and a signup hint when no token is configured.List permanent OpenWebhook slugs for the authenticated Pro account. Returns an empty list and a signup hint when no token is configured.
No input schema was published for this tool.
endpoint.createCreate a permanent OpenWebhook slug such as billing. Requires OPENWEBHOOK_TOKEN. Use endpoint.list afterward to confirm.Create a permanent OpenWebhook slug such as billing. Requires OPENWEBHOOK_TOKEN. Use endpoint.list afterward to confirm.
No input schema was published for this tool.
endpoint.deleteDelete a permanent OpenWebhook endpoint. Pass the UUID from endpoint.list. This cannot be undone.Delete a permanent OpenWebhook endpoint. Pass the UUID from endpoint.list. This cannot be undone.
No input schema was published for this tool.
watch.startStart an in-memory SSE watch on the anonymous URL, or on a permanent slug with a Pro token. Call watch.wait next to receive the request.Start an in-memory SSE watch on the anonymous URL, or on a permanent slug with a Pro token. Call watch.wait next to receive the request.
No input schema was published for this tool.
watch.stopStop watching an endpoint and drop its local event buffer. Use after you are done inspecting, or before switching slugs.Stop watching an endpoint and drop its local event buffer. Use after you are done inspecting, or before switching slugs.
No input schema was published for this tool.
watch.waitWait for the next HTTP request on a watch started with watch.start. Returns method, path, headers, and body from the local buffer only.Wait for the next HTTP request on a watch started with watch.start. Returns method, path, headers, and body from the local buffer only.
No input schema was published for this tool.
watch.listList webhooks already stored in this process's ephemeral buffer. Call after watch.start; it does not wait for a new request.List webhooks already stored in this process's ephemeral buffer. Call after watch.start; it does not wait for a new request.
No input schema was published for this tool.
8 of 8 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Inspect webhooks on localhost without an account. Permanent slugs need OpenWebhook Pro.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the depth-4 limit. Anything below that level was never resolved.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
53 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+41 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.