# openwebhook Inspect webhooks on localhost without an account. Permanent slugs need OpenWebhook Pro. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the package rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.2.2 - **Author:** Unknown - **License:** MIT - **npm:** openwebhook - **Source:** https://github.com/davidlg/openwebhook - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 60/100 (B), scored on the package rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-14T06:13:49.779Z - **Version scanned:** 1.2.2 - **CVEs:** none found by OSV at scan time ## Tools 8 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `url.inspect` — Get the current anonymous HTTPS ingest URL for this process. Call this first, then watch.start with no slug. - `endpoint.list` — List permanent OpenWebhook slugs for the authenticated Pro account. Returns an empty list and a signup hint when no token is configured. - `endpoint.create` — Create a permanent OpenWebhook slug such as billing. Requires OPENWEBHOOK_TOKEN. Use endpoint.list afterward to confirm. - `endpoint.delete` — Delete a permanent OpenWebhook endpoint. Pass the UUID from endpoint.list. This cannot be undone. - `watch.start` — Start an in-memory SSE watch on the anonymous URL, or on a permanent slug with a Pro token. Call watch.wait next to receive the request. - `watch.stop` — Stop watching an endpoint and drop its local event buffer. Use after you are done inspecting, or before switching slugs. - `watch.wait` — Wait for the next HTTP request on a watch started with watch.start. Returns method, path, headers, and body from the local buffer only. - `watch.list` — List webhooks already stored in this process's ephemeral buffer. Call after watch.start; it does not wait for a new request. ## Install **Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for. **Cautions** (coverage gaps and advisories — never blocking) - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"openwebhook\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"openwebhook\"\n ],\n \"env\": {\n \"OPENWEBHOOK_TOKEN\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `OPENWEBHOOK_TOKEN` — Openwebhook Token (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Moderate blast radius — holds an api key; runs on your machine. - Floor 23, ceiling 23 (tier: moderate) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/openwebhook - Install plan: https://forgeregistry.com/api/v1/packages/openwebhook/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/openwebhook - HTML page: https://forgeregistry.com/registry/openwebhook - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.