Using Web Hook Box with AI Agents

Web Hook Box publishes everything an AI coding agent needs to use it without a human reading the documentation aloud: a machine-readable API contract, the documentation in markdown, and a Model Context Protocol server that turns the API into tools.

What is published

/openapi.json — the full API contract, OpenAPI 3.1. Also available as /openapi.yaml.
/llms.txt — an index of this site written for language models, and /llms-full.txt with every page inlined.
Every documentation page in markdown: append .md to its URL, or send Accept: text/markdown.
/mcp — the Model Context Protocol endpoint described below.

Connecting an agent over MCP

Generate an API token from your account page, then register the endpoint with your client. For Claude Code:

claude mcp add --transport http webhookbox https://webhook-box.com/mcp --header "Authorization: Bearer $WEBHOOKBOX_TOKEN"

Any client that speaks Streamable HTTP MCP works the same way: the endpoint is https://webhook-box.com/mcp and authentication is a bearer token.

Tools

Tool	What it does
`list_webhooks`	Lists the endpoints on the account.
`create_webhook`	Creates an endpoint and returns its receiving URL.
`get_webhook`	Reads one endpoint's configuration.
`update_webhook`	Changes description, active state, or forwarding.
`delete_webhook`	Deletes an endpoint and everything it captured. Irreversible.
`list_requests`	Lists the requests an endpoint captured.
`get_request`	Reads one captured request in full, body byte for byte.
`get_request_as_curl`	Renders a captured request as a runnable curl command.
`replay_request`	Sends a captured request again. Has real side effects.

Bodies are never sent to a model in full by default. list_requests summarises each captured body as {size, preview, truncated, encoding}; get_request returns the whole body as {content, encoding}. encoding is "utf8" or "base64" — a binary payload comes back base64-encoded rather than mangled, so the exact original bytes are still recoverable. Either shape is cut off past a byte limit, with a notice pointing back at the REST API for the untruncated value.

The documentation is also published to connected clients as MCP resources under webhookbox://docs/, so an agent can read these pages over the same connection.

delete_webhook and replay_request are annotated as destructive and side-effecting, so a well-behaved client asks before running them. The endpoint is limited to 60 calls a minute per token.

Without MCP

An agent with no MCP support can be pointed at the OpenAPI document and use the REST API directly. A prompt as short as this is usually enough:

The Web Hook Box API is described at https://webhook-box.com/openapi.json.
Authenticate with `Authorization: Bearer $WEBHOOKBOX_TOKEN`.
Create a webhook, tell me its URL, then poll its captured requests until one arrives.

Things worth asking an agent to do

Create a throwaway endpoint and hand back the URL to paste into a provider's dashboard.
Watch for the next captured request and report the headers and body it saw.
Compare two captured requests and describe what changed between them.
Turn a captured request into a curl command so it can be reproduced from a terminal.
Replay a captured request after a fix has been deployed.

Before you connect an agent

An agent holding your API token can read every request your webhooks have captured. Captured payloads routinely contain provider signatures, bearer tokens, and personal data, and whatever a tool returns lands in the model's context — and, depending on the client, in a model transcript and in logs outside this platform.

Connect an agent only to an account whose captured payloads you would accept appearing in a model transcript. For agent-driven testing against production-shaped traffic, use a separate account rather than your main one.

Read-only tokens and payload redaction are not implemented today. A token is a token: it grants everything the account can do, including deleting webhooks.

Documentation

Tutorials