net.anyhook/anyhook

Est-ce que net.anyhook/anyhook est sûr ?

Au dernier audit MCP Hub, le serveur MCP « net.anyhook/anyhook » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 16 outils

• anyhook_apps_create≈ 319 tokens

  Create a new app with a name, provider source, and (optionally) destinations. Returns the inbound URL. The app is active immediately. Created WITHOUT destinations it still receives and LOGS every event (inspect-only), it just delivers nowhere until a destination is added (PATCH /api/v1/apps/{slug} with {"destinations": [...]}).

  Paramètres, retour & exemple (4)

  Paramètres

  • name · string · requis
    Human-readable app name.
  • source · string · requis
    Provider name (stripe, github, shopify, ...). Used for signature auto-detection.
  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
  • destinations · array · optionnel
    Destination URLs that should receive forwarded events.

  Exemple d'appel

  {"name": "anyhook_apps_create", "arguments": {"name": "texte", "source": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_apps_list≈ 231 tokens

  List apps in your AnyHook account with inbound URLs, sources, and destination URLs. Check isActive: an inactive app's inbound URL answers setup handshakes but acknowledges and discards event POSTs (202, reason app_inactive) instead of relaying them. Destination signing secrets are redacted to has_signing_secret plus a 4-char hint; a new secret in plaintext comes only from rotating it. An app whose slug was changed lists its former URLs under legacyInboundUrls; those still route to it.

  Paramètres, retour & exemple (1)

  Paramètres

  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.

  Exemple d'appel

  {"name": "anyhook_apps_list", "arguments": {"api_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_code_deploy≈ 817 tokens

  Save a handler that runs on every event this app receives, in an isolated sandbox, with AnyHook's retries and replay around it: no server of your own. Each run's console output and return value are stored as that delivery's response (anyhook_inspect shows them). It can also run on a cron schedule. Pro and Scale; runs are capped per month with no overage, retries, test runs and schedule firings each count, and each run and package install is charged to the monthly compute allowance (anyhook_usage shows both). Test it with anyhook_code_test before real events arrive.

  Paramètres, retour & exemple (6)

  Paramètres

  • code · string · requis
    An ES module, run in a sandboxed Node.js on every event this app receives. Either `export default async function (event, { env }) {}` (event: { method, headers, body, raw_body, delivery_id, attempt }; method is always POST, and the query string, path and caller IP are not kept) or a Pipedream Node.js code step: `export default defineComponent({ async run({ steps, $ }) {} })`, where steps.trigger.event is that same event (a step reading query, path, url or client_ip needs changing) and $.export and $.flow.exit work. npm packages it imports are installed on deploy (pin as "pkg@1.2.3", like Pipedream; a new package list usually takes seconds, a large one a few minutes). @pipedream/platform is a stand-in. State between events: the app's store (store.get/set/has/delete/keys, set takes { ttl }); every data_store prop is that one store, an app prop's this.<prop>.$auth.<field> reads the secret <APP>_<FIELD>, any other prop the secret named after it (channelId → CHANNEL_ID). Throwing fails the delivery, which AnyHook retries. Templates for common actions (Slack, email, Google Sheets, Notion, Claude and more): https://anyhook.net/code-templates.md
  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
  • appSlug · string · requis
    The app whose events the code runs on.
  • enabled · boolean · optionnel
    Whether events run the code. false saves it switched off, so it runs only through anyhook_code_test. Omit: a first deploy goes live and later deploys keep the current state. Deploy off while another system still handles the same events, or both will act on each one.
  • secrets · object · optionnel
    Environment variables for the code, read as env.NAME or process.env.NAME. Merged into the saved ones; null removes a name.
  • schedule · string|null · optionnel
    Also run on a cron schedule: five fields, UTC unless prefixed CRON_TZ=Area/City, e.g. "*/15 * * * *". Each firing arrives as an anyhook.schedule event and counts as a run. null removes it; omit to keep it. Only on an app that does not verify a sender's signature.

  Exemple d'appel

  {"name": "anyhook_code_deploy", "arguments": {"code": "texte", "appSlug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_code_get≈ 182 tokens

  The code that runs on this app's events: its source, the names of its secrets (never the values), whether events are reaching it, and runs used this month against the plan's limit.

  Paramètres, retour & exemple (2)

  Paramètres

  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
  • appSlug · string · requis
    The app whose code handler to read.

  Exemple d'appel

  {"name": "anyhook_code_get", "arguments": {"appSlug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_code_test≈ 243 tokens

  Run the saved handler now and return its logs, return value and duration: on a stored event (the latest when event_id is omitted) or on a body you give. Counts as a run. Nothing is delivered, but whatever the code itself sends does happen.

  Paramètres, retour & exemple (4)

  Paramètres

  • body · ? · optionnel
    Run on this body instead of a stored event.
  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
  • appSlug · string · requis
  • event_id · string · optionnel
    Run on this stored event. Omit for the app's latest event.

  Exemple d'appel

  {"name": "anyhook_code_test", "arguments": {"appSlug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_connect≈ 468 tokens

  Wire a provider to AnyHook in one call: give a Stripe or GitHub key and AnyHook registers the app's inbound URL as a webhook at the provider, saves the signing secret it yields, and turns on signature verification at the edge. The provider is read from the key; the key is used once and not stored. Without appSlug a new app is created (and removed again if the provider refuses the key). Re-running replaces the registration instead of duplicating it. GitHub sends a signed ping immediately, so the first event appears within seconds. Add a destination afterwards (PATCH /api/v1/apps/{slug}) to forward events; until then they are received and logged.

  Paramètres, retour & exemple (4)

  Paramètres

  • target · string · optionnel
    GitHub only: "owner/repo", or an organization name for an org-wide hook. Optional when the token administers exactly one repository.
  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
  • appSlug · string · optionnel
    Connect this existing app. Omit to create a new app for the provider.
  • provider_key · string · requis
    A Stripe secret or restricted key (sk_… / rk_…) or a GitHub token (github_pat_… / ghp_…). The provider is read from the key. Used once to register the webhook at the provider; AnyHook does not store it. Least privilege: a Stripe restricted key with Webhook Endpoints = Write, or a fine-grained GitHub token with Webhooks = Read and write.

  Exemple d'appel

  {"name": "anyhook_connect", "arguments": {"provider_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_events≈ 287 tokens

  List webhook events, most recent first: id, app, type, status, attempt, destination status code, latency, timestamp. Summaries only, no request headers or body — call anyhook_inspect with an id from here to read one event's payload. Uses your AnyHook account when connected, otherwise the local in-memory store.

  Paramètres, retour & exemple (5)

  Paramètres

  • limit · integer · optionnel
  • source · string · optionnel
    Filter by provider source (local mode).
  • status · string · optionnel
    Filter by status. Account mode: queued|success|retrying|failed. Local mode: received|forwarded|failed|retrying.
  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
  • appSlug · string · optionnel
    Filter to a specific app slug (account mode).

  Exemple d'appel

  {"name": "anyhook_events", "arguments": {"limit": 1, "source": "texte", "status": "texte", "api_key": "texte", "appSlug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_inbox≈ 190 tokens

  Every AnyHook app is also an email inbox: mail sent to {user}.{app}@anyhook.net becomes an event (type email.received) you can read with anyhook_events. Returns the address and webhook URL for one of your apps.

  Paramètres, retour & exemple (2)

  Paramètres

  • app · string · optionnel
    App slug (from anyhook_apps_list). Defaults to your first app.
  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.

  Exemple d'appel

  {"name": "anyhook_inbox", "arguments": {"app": "texte", "api_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_inspect≈ 200 tokens

  Full detail for one event by id, including the inbound headers and body that anyhook_events omits, plus the destination's response. Payloads can be large and often contain personal data, so fetch one at a time, only when the body is needed. Account or local store.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
    Event ID returned by anyhook_events.
  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.

  Exemple d'appel

  {"name": "anyhook_inspect", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_mock≈ 273 tokens

  Generate a webhook request with a valid signature for Stripe, GitHub, or Slack. If targetUrl is provided, the request is POSTed there and the response is returned.

  Paramètres, retour & exemple (5)

  Paramètres

  • data · object · optionnel
    Optional fields to deep-merge into the fixture.
  • event · string · requis
    Event name (e.g. 'payment_intent.succeeded' for Stripe).
  • secret · string · optionnel
    Signing secret. Falls back to a deterministic default per provider.
  • provider · string · requis · stripe | github | slack
    Webhook provider to simulate.
  • targetUrl · string · optionnel
    If set, POST the generated request to this URL and return the response.

  Exemple d'appel

  {"name": "anyhook_mock", "arguments": {"event": "texte", "provider": "stripe"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_providers≈ 84 tokens

  List webhook providers AnyHook can mock, along with the event types available for each.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "anyhook_providers", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_replay≈ 252 tokens

  Re-send a stored event to its destinations. Replays sit outside the monthly event quota but within a daily replay limit per plan and the monthly compute allowance (anyhook_usage), and replaying an event that was held for quota bills it as a new event. The destination does run its handler again: a receiver that is not idempotent will process the event twice while debugging.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
    Event ID to replay. Replay does not consume event quota; it is charged to the compute allowance.
  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.

  Exemple d'appel

  {"name": "anyhook_replay", "arguments": {"id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_replay_failed≈ 184 tokens

  Re-send every failed event for the given app slug. Useful after fixing a downstream bug to recover queued work.

  Paramètres, retour & exemple (2)

  Paramètres

  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
  • appSlug · string · requis
    Bulk-replay every failed event for this app.

  Exemple d'appel

  {"name": "anyhook_replay_failed", "arguments": {"appSlug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_undelivered≈ 168 tokens

  Show events for the given app that have not successfully reached any destination (failed or still retrying).

  Paramètres, retour & exemple (3)

  Paramètres

  • limit · integer · optionnel
  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.
  • appSlug · string · requis

  Exemple d'appel

  {"name": "anyhook_undelivered", "arguments": {"appSlug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_usage≈ 237 tokens

  What the plan allows and what this account has used of each: events this month (per delivery, large events count per 64 KB), overage, the compute allowance and what used it (retries, replays, waiting on slow destinations, code runs, builds, schedules), API calls today (each tool call that reads or changes the account counts one), code runs and package snapshots, with when each resets. Call it when something answers with a limit, before bulk work such as replay_failed, or when the user asks what they are using.

  Paramètres, retour & exemple (1)

  Paramètres

  • api_key · string · optionnel
    API key (ahk_live_...) from anyhook_quickstart. Only needed over HTTP when no Authorization header is set; ignored over stdio.

  Exemple d'appel

  {"name": "anyhook_usage", "arguments": {"api_key": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• anyhook_verify≈ 260 tokens

  Verify a webhook signature against a secret, for every source the AnyHook edge verifies, including stripe, github, shopify, slack, line, discord, linear, vercel, paddle, hubspot, paypal and xero.

  Paramètres, retour & exemple (5)

  Paramètres

  • body · string · requis
    Raw request body.
  • secret · string · requis
    Signing secret to verify against.
  • headers · object · requis
    Request headers as a flat object.
  • provider · string · requis
    Provider name (e.g. 'stripe', 'github', 'slack', 'generic').
  • requestUrl · string · optionnel
    Original request URL (required for Twilio/HubSpot). Defaults to a placeholder.

  Exemple d'appel

  {"name": "anyhook_verify", "arguments": {"body": "texte", "secret": "texte", "headers": {}, "provider": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://anyhook.net/mcp