Browse / MCP servers
petroladkin/hookwitness
Self-hosted webhook catcher with verdicts: signature and JSON Schema checks, fault scenarios, live UI, reports, REST API and MCP.
- MCP
- local-first
Works.Tested on 2026-10-27. From the README alone, on Linux with Haiku.
What we checked
Does it run from the README?Yes. Running in 9:05 on a clean Linux box.The run
Does it do what the README says?1 of 1 claims held up.Evidence
“Hookwitness is an MCP server: an agent can list its endpoints through the MCP bridge to the running server”
Expected the endpoint list includes /stripe/webhooks. Got /stripe/webhooks.
Which setups did we try?Works with Haiku.Setups
Linux / Haiku: works, Oct 27, rev f28a12f.
Needs keys, a login or a browser?No.Details
None seen
Is it safe to run?No unexpected network or file activity found in these checksWhat we saw
No problems traced to this repository code in these checks; a short run cannot prove safety. 48 listed items (named-host connections, static matches, dependency advisories) are below and do not change this verdict. 2 static matches retained as context.
Gitleaks found a possible hardcoded secret; value withheld. 7 distinct locations. 19 findings.
OSV reports a known vulnerability in this dependency version. golang.org/x/net 5 findings.
Reviewed as expected for a test run: attempted writes that failed, so nothing was written.
Full event, path and process lists for each observed setup:
A quiet run is not a safety guarantee.
Is it maintained?Maintained · 354 commits in 90 days · 47 merged PRs in 90 days · 0 open issues · 1 open PRsActivity
actively maintained: last commit 5 days ago; 354 commits and 47 merged PRs in 90 days; 0 open issues, 1 open PRs; latest release 2026-10-21
Can I show this on my README?Copy the badge.Badge
The run
Oct 27 · rev f28a12fIndependent test, not endorsed by the project.