webhook-toolkit

Receive, forward, sign and verify webhooks from your terminal, your test suite and your AI agent. One package: a CLI (webhook-toolkit, alias whtk), a typed library and an MCP server, backed by webhook-toolkit.com.

Quick start

npx webhook-toolkit listen --forward http://localhost:3000/webhooks

That's it: no account, no config. You get a public URL; paste it into Stripe, GitHub, Shopify or any other sender, and every webhook shows up in your terminal and is re-sent to your local handler:

  webhook-toolkit · listening

  Webhook URL   https://webhook-toolkit.com/r/l90c9MKIdo0o
  Inspector     https://webhook-toolkit.com/e/l90c9MKIdo0o
  Forwarding    → http://localhost:3000/webhooks
  Expires       in 7 days (2026-09-25 15:42)
                Anonymous URL. Run `webhook-toolkit login` to get a permanent one.

  Waiting for webhooks. Ctrl+C to stop.

  15:42:11  POST   /stripe  stripe checkout.session.completed  248 B
            ↳ 200 OK · 3 ms
  15:42:11  POST   /github  github push  269 B
            ↳ 500 Internal Server Error · 1 ms  {"error":"handler crashed: cannot read properties of undefined"}

Every request is also kept in a web inspector (headers, raw body, replay), so nothing is lost when your handler crashes.

Contents

• CLI
• Test webhooks in your test suite
• Use it from AI agents (MCP)
• Signing and verifying
• Relay: a real tunnel (paid)
• Free vs paid
• How it compares
• Library reference
• Configuration

CLI

npm i -g webhook-toolkit     # or run any command with npx webhook-toolkit …

A few things worth knowing:

• Sub-paths and query strings are kept. A request to …/r/<token>/stripe?x=1 is forwarded to http://localhost:3000/webhooks/stripe?x=1, so one URL can feed several handlers.
• Headers are forwarded as received (minus hop-by-hop headers, host and content-length), so signature checks in your handler pass exactly as in production.
• --json prints NDJSON (listening, request, forward events) for scripting: whtk listen -f 3000 --json | jq .request.event.
• Colors follow NO_COLOR, FORCE_COLOR and are off when output is not a terminal.

Send a signed test event

# Prints the headers and a curl command, with a realistic sample event
whtk sign stripe --secret whsec_… --event checkout.session.completed

# Or send it straight to your

... [View full README on GitHub](https://github.com/the-kipdev/webhook-toolkit#readme)