dev.pages.hookden/hookden

Est-ce que dev.pages.hookden/hookden est sûr ?

Au dernier audit MCP Hub, le serveur MCP « dev.pages.hookden/hookden » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 7 outils

• create_bin≈ 118 tokens

  Create a new webhook capture bin. Returns a public capture_url — point any webhook (Stripe, GitHub, Slack, your own service…) at it and every request sent there (any method, any subpath, headers + raw body) is stored. Then read what arrived with list_captures, get_capture, or wait_for_capture. Anonymous bins keep requests ~24h. No auth needed.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "create_bin", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_capture≈ 118 tokens

  Get one captured request in full: method, path, query, every header, and the body. Binary bodies are returned base64-encoded (up to 8KB, with a URL for the raw bytes).

  Paramètres, retour & exemple (2)

  Paramètres

  • id · integer · requis
    capture id from list_captures / wait_for_capture
  • bin · string · requis
    bin id or slug

  Exemple d'appel

  {"name": "get_capture", "arguments": {"id": 1, "bin": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_captures≈ 160 tokens

  List requests captured by a bin, oldest first. Compact summaries (id, method, path, time, content-type, body size, signature status). Use get_capture for full headers/body. Pass `after` (a capture id) to only see newer captures.

  Paramètres, retour & exemple (3)

  Paramètres

  • bin · string · requis
    bin id (or custom slug) from create_bin
  • after · integer · optionnel
    only captures with id greater than this (default 0)
  • limit · integer · optionnel
    max results, 1-50 (default 20)

  Exemple d'appel

  {"name": "list_captures", "arguments": {"bin": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• send_test_webhook≈ 228 tokens

  Simulate a webhook delivery into a bin — no external sender or HTTP client needed. Seeds one realistic, clearly-labeled sample capture (default: a GitHub push event) and returns it in full, so you can exercise the whole loop (create_bin → send_test_webhook → list_captures / get_capture) entirely from MCP. Pass `example` to pick a provider payload from the /examples library (e.g. "stripe-payment-intent-succeeded", "slack-event-callback", "shopify-order-created"). Sample captures are marked as simulated and never count as real webhook traffic.

  Paramètres, retour & exemple (2)

  Paramètres

  • bin · string · requis
    bin id (or custom slug) from create_bin
  • example · string · optionnel
    optional example payload slug from /examples (default: a GitHub push event)

  Exemple d'appel

  {"name": "send_test_webhook", "arguments": {"bin": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• set_response≈ 466 tokens

  Configure what a bin replies to webhook senders: HTTP status, content-type, body, custom response headers, optional delay. Body and header values support {{…}} templates rendered per-request from the INCOMING delivery — {{body.challenge}}, {{query.hub.challenge}}, {{header.x-hook-secret}}, {{hmac_sha256 body.plainToken YOUR_SECRET}} — so a bin can pass provider verification handshakes with zero code: Slack URL verification (body {{body.challenge}}), Zoom CRC (JSON with the hmac_sha256 helper), Meta/WhatsApp GET echo (text/plain {{query.hub.challenge}}), Strava (JSON {"hub.challenge":"{{query.hub.challenge}}"}), Asana (response header X-Hook-Secret: {{header.x-hook-secret}}). Only the fields you pass change; everything else keeps its current value. Works on bins created via create_bin by this same client; the incoming request is still captured in full either way.

  Paramètres, retour & exemple (6)

  Paramètres

  • bin · string · requis
    bin id (or custom slug) from create_bin
  • body · string · optionnel
    response body, max 10000 chars; {{…}} templates allowed
  • status · integer · optionnel
    HTTP status to respond with, 100-599 (bins default to 200)
  • headers · object · optionnel
    custom response headers as name→value (max 10; values may use {{…}} templates). Pass {} to clear. Hop-by-hop/security headers (set-cookie, location, strict-transport-security…) are rejected.
  • delay_ms · integer · optionnel
    artificial response delay in milliseconds, 0-10000 (for testing sender timeouts/retries)
  • content_type · string · optionnel
    Content-Type of the response (e.g. application/json, text/plain)

  Exemple d'appel

  {"name": "set_response", "arguments": {"bin": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_signature≈ 556 tokens

  Verify a webhook signature against a secret — 25 provider-exact schemes plus a generic HMAC mode, the same engine that computes ✓/✗ badges on captures. Covers HMAC-SHA256 (GitHub, Stripe, Svix/Standard Webhooks, Shopify-style base64, URL-signing Square/HubSpot/Trello…), ECDSA (SendGrid), RSA (Kick) and HMAC-MD5 (Patreon). Pass the scheme, the secret, the delivery's headers, and the BYTE-EXACT raw body (body_base64 for binary). The secret is used only for this one in-memory computation — never stored or logged. No bin needed. If verification fails, the #1 cause is a re-serialized body: point the real webhook at a capture bin (create_bin) to get the true raw bytes first.

  Paramètres, retour & exemple (8)

  Paramètres

  • url · string · optionnel
    full delivery URL — REQUIRED for square, hubspot and trello (the URL is part of the signed string)
  • body · string · optionnel
    raw request body, byte-exact as the provider sent it (not re-serialized!)
  • method · string · optionnel
    HTTP method of the delivery (hubspot v3 signs it; default POST)
  • scheme · string · requis · github | stripe | svix | calendly | mailchimp | mux | workos | paddle
    signature scheme (usually the provider name); "hmac" = generic HMAC over the raw body
  • secret · string · requis
    signing secret or key exactly as the provider shows it (sendgrid/kick: the PUBLIC verification key)
  • headers · object · optionnel
    the delivery's HTTP headers — at least the signature/timestamp headers; names are case-insensitive
  • body_base64 · string · optionnel
    alternative to `body` for binary payloads: base64 of the raw body bytes
  • signature_header · string · optionnel
    scheme "hmac" only: which header carries the signature (default x-signature)

  Exemple d'appel

  {"name": "verify_signature", "arguments": {"scheme": "github", "secret": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• wait_for_capture≈ 188 tokens

  Block until the next request arrives at a bin (or a timeout passes), then return it in full. Ideal flow: create_bin → configure the webhook sender → trigger it → wait_for_capture. If `after_id` is omitted, waits for the next capture after "now". Returns timed_out:true instead of erroring when nothing arrives.

  Paramètres, retour & exemple (3)

  Paramètres

  • bin · string · requis
    bin id or slug
  • after_id · integer · optionnel
    return the first capture with id greater than this; default = latest id at call time
  • timeout_seconds · integer · optionnel
    1-45 seconds to wait (default 20)

  Exemple d'appel

  {"name": "wait_for_capture", "arguments": {"bin": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://hookden.pages.dev/mcp