The Hookbase MCP Server Is Now Hosted and Remote

Locked Behind a Local Process

Your AI assistant has been able to manage Hookbase for a while now. List sources, find a failure cluster, replay a broken delivery — all of it, driven from a chat window. But there was a catch: the MCP server ran as a local subprocess over stdio. You installed it with npx, wired it into Claude Desktop or Cursor, and it worked great — on your machine.

That left everyone else out. ChatGPT, Claude on the web, connector directories, a teammate who just wants to ask "why did the Stripe webhooks stop landing?" — none of them can spawn a local process. If the agent lived in a browser, it could not reach your webhooks.

Today that changes. The Hookbase MCP server is now a hosted, remote HTTP endpoint. No install, no subprocess, no per-user setup. Point any remote-capable MCP client at a URL, add your API key, and all 123 tools are live.

Before And After

The shape of the change is simple.

• Before — npx -y @hookbase/mcp-server, a local process, stdio transport, one developer's laptop.
• After — a URL, an Authorization header, and any client that speaks remote MCP.

The tools are identical across both. The hosted server and the local one import the same tool set, so nothing you learned locally changes. What changes is who can reach it: web clients and whole teams, not just the person who ran the install.

Connecting a Client

Grab an API key from the dashboard under Settings → API Keys — it starts with whr_. Then hand your client this config:

{
  "mcpServers": {
    "hookbase": {
      "url": "https://mcp.hookbase.app/mcp",
      "headers": { "Authorization": "Bearer whr_live_your_key_here" }
    }
  }
}

That is the whole setup. The organization is resolved from the key automatically — the server calls /api/auth/me on your first tool call and caches the result for the isolate's lifetime. If your key belongs to more than one org, add one header:

X-Hookbase-Org-Id: <org-id>

Skip it on a multi-org key and your first tool call comes back with an error that lists every org as name (id), so you can copy the right one in.

The 123 Tools

The endpoint exposes the full Hookbase API — the same surface you get locally.

• Inbound — hookbase_list_sources, hookbase_list_destinations, hookbase_list_routes, hookbase_list_events, hookbase_list_deliveries.
• Recovery — hookbase_list_delivery_clusters, hookbase_replay_delivery, hookbase_replay_with_edit, hookbase_replay_cluster, hookbase_bulk_replay.
• Outbound — applications, endpoints, subscriptions, event types, messages, and hookbase_replay_message.
• Operations — tunnels, cron jobs and groups, filters, transforms, schemas, alert rules, notification channels, analytics, API keys, audit logs, redaction policies, scheduled sends, and test bins.

A Concrete Run

Here is a real interaction, abbreviated. Deliveries to a destination started failing this morning and you want them recovered.

you: which deliveries failed in the last hour? → hookbase_list_deliveries → 41 failed, all to "billing-webhook" you: is this one cluster or scattered? → hookbase_list_delivery_clusters → 1 cluster: 400 from the endpoint, started 08:12, 41 deliveries you: they added a required "currency" field. edit one payload to add it and replay it to confirm before I touch the rest. → hookbase_replay_with_edit → 200 OK you: good. replay the whole cluster. → hookbase_replay_cluster → 41 re-sent, 41 delivered

No local process was involved in any step. The agent held only your API key and the URL.

How It Works

The endpoint is a single Cloudflare Worker, separate from the npm package but built from the same tool code.

• Transport — MCP Streamable HTTP, the JSON-response variant. Your client POSTs one JSON-RPC message and gets one back. No SSE stream, no session id to track.
• Stateless — every POST is self-contained, so there is nothing to keep alive between calls.
• Endpoints — POST https://mcp.hookbase.app/mcp is canonical; the root POST / works too. GET /health returns a plain ok. Only POST carries JSON-RPC; GET and DELETE return 405, and OPTIONS handles CORS preflight.
• CORS — fully open, with Authorization, Content-Type, X-Hookbase-Org-Id, and Mcp-Protocol-Version all allowed, so browser clients connect directly.
• Protocol versions — 2025-06-18 (default), 2025-03-26, and 2024-11-05 are all supported.

Org resolution is lazy on purpose. initialize, tools/list, and ping need no API round-trip — the /api/auth/me call only fires the first time you actually run a tool, so listing tools is instant.

You can sanity-check the endpoint before wiring up a client:

curl https://mcp.hookbase.app/health
→ ok

Security Model

Auth happens in two layers.

• Header validation, before any network call. The header must be Authorization: Bearer <key> and the key must start with whr_. A missing or malformed header returns a real HTTP 401 with a WWW-Authenticate: Bearer challenge — nothing reaches the Hookbase API.
• Org resolution, on the first tool call. A rejected key, a key with no organizations, an unknown X-Hookbase-Org-Id, or multi-org ambiguity all come back as a JSON-RPC error (code: -32602) inside a normal 200 response, with a message that says what to fix. initialize and tools/list never trigger it, so listing tools always works.

Your key carries the same permissions it always had. The MCP server is a transport, not a new privilege boundary — an agent can only do what the key behind it could already do.

Hosted Or Local

Both transports expose the same 123 tools. The only real difference is where the credential lives.

• Hosted — key goes in the Authorization: Bearer header; org override goes in the X-Hookbase-Org-Id header. Use it for clients that accept a remote MCP URL: ChatGPT, Claude on the web, connector directories, and any team where you would rather not have every person install a process.
• Local — key goes in the HOOKBASE_API_KEY env var; org override goes in HOOKBASE_ORG_ID. Install with npx -y @hookbase/mcp-server for clients that run a subprocess: Claude Desktop, Cursor, and similar.

If you are unsure, start hosted. There is nothing to install, the URL is stable, and you can move a whole team onto it by handing out one config block and a key each.

Where This Goes

Hookbase has been building toward agent-operable webhook infrastructure for a while — the recovery-loop tools, the 123-tool surface over the full API, and now a transport that meets the agent wherever it already lives. Making the server remote is the piece that turns "the developer who installed it" into "your whole team, from any client."

Drop the config above into your MCP client and start asking. Full setup lives at /docs/receive/mcp, the per-tool reference at /docs/receive/mcp/tools, and you can grab a key at /register.