Summary

`wait_for_callback` is the point of the server: it turns an asynchronous job into a call the agent can wait on.

The loop the tools describe has no polling in it — create the endpoint, hand its URL to the job as a callback target, then block until the result lands, already signature-verified and decrypted. `list_callbacks` supplies the `received_at` to pass as `after`, so a second wait does not re-read the delivery you already handled. Before designing around signature checking, note that `verify_signature` needs a secret configured on the endpoint and a paid plan; `replay_callback` is its debugging counterpart, re-sending a captured delivery at your handler without touching the upstream system at all.

What it is

A webhook capture service exposing 8 tools: create a callback endpoint, wait for the next delivery instead of polling, read the decrypted body, check its HMAC signature, and replay it against your own handler.

What you get

A callback target you can hand out: `create_callback_endpoint` returns a URL for a `slug`, usable as the callback for an asynchronous job or another agent, or as a plain capture URL for a provider such as Stripe or GitHub.
Waiting rather than polling: `wait_for_callback` blocks until the next delivery arrives at an endpoint and returns it, taking `after` to skip anything already seen and `timeoutMs` to bound the wait.
The payload as it was sent: `get_callback_payload` returns one delivery with its full headers, decrypted body and metadata, while `list_callbacks` returns method, status, provider and `received_at` summaries, newest first.
Authenticity settled before the agent acts: `verify_signature` compares the HMAC against the endpoint's configured secret for Stripe, GitHub, Shopify or a custom provider, using a timing-safe comparison.
Re-driving a handler without the upstream event: `replay_callback` re-sends a stored delivery's original headers and body unchanged to a `targetUrl`.
An inventory of what is already listening: `list_endpoints` returns every endpoint the token owns with its slug, `created_at` and request counts, and `get_endpoint` returns one endpoint's full URL, signature provider configuration and custom response settings.

Requirements

A HookSense token, supplied as HOOKSENSE_TOKEN. `verify_signature` additionally needs a webhook secret configured on the endpoint and a paid plan.

Setup effort

One command plus a key — npx -y @hooksense/mcp, then supply credentials