@webhooks-cc/mcp 1.12.0 → 1.13.0

package/README.md

@@ -11,6 +11,16 @@ The server reads `WHK_API_KEY` from the environment. It also supports:
 - `WHK_BASE_URL` for a custom API base URL
 - `WHK_WEBHOOK_URL` for a custom receiver base URL
 
+### Claude Code plugin
+
+The plugin installs the server together with a webhook testing skill that tells Claude when to use it:
+
+```text
+/plugin install webhooks-cc --marketplace kroqdotdev/webhooks-cc
+```
+
+For other agents, `npx skills add kroqdotdev/webhooks-cc` installs the same skill. See [Agent skill](https://webhooks.cc/docs/mcp/skills).
+
 ### One-click
 
 - **Cursor**: [Add to Cursor](https://cursor.com/en/install-mcp?name=webhooks-cc&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkB3ZWJob29rcy1jYy9tY3AiXSwiZW52Ijp7IldIS19BUElfS0VZIjoid2hjY18uLi4ifX0=)
@@ -54,11 +64,11 @@ npx @webhooks-cc/mcp setup claude-desktop --api-key whcc_...
 }
 ```
 
-Get your API key at [webhooks.cc/account](https://webhooks.cc/account).
+Get your API key at [webhooks.cc/account/api-keys](https://webhooks.cc/account/api-keys).
 
 ## What it exposes
 
-The server exposes `38` tools, `3` prompts, and `3` resource surfaces with an API key, and `10` sandbox tools without one.
+The server exposes `39` tools, `3` prompts, and `3` resource surfaces with an API key, and `11` sandbox tools without one.
 
 ### Endpoint tools
 
@@ -80,6 +90,7 @@ The server exposes `38` tools, `3` prompts, and `3` resource surfaces with an AP
 - `wait_for_requests`
 - `replay_request`
 - `compare_requests`
+- `generate_payload_schema` (TypeScript, Zod, Pydantic, or JSON Schema from captured bodies)
 - `extract_from_request`
 - `verify_signature`
 - `clear_requests`
@@ -132,7 +143,7 @@ Endpoints shared with you already appear in `list_endpoints` (with `fromTeam`) a
 
 Started without `WHK_API_KEY`, the server registers sandbox tools instead ([auth.md](https://webhooks.cc/auth.md)):
 
-- `create_endpoint`, `list_endpoints`, `get_endpoint`, `delete_endpoint`, `list_requests`, `get_request`, `wait_for_request`: the same names and arguments as the full tools, in a sandbox of up to 3 endpoints, 25 captured requests each and 100 in all, for 24 hours. The first `create_endpoint` registers it (a few seconds of proof of work).
+- `create_endpoint`, `list_endpoints`, `get_endpoint`, `delete_endpoint`, `list_requests`, `get_request`, `wait_for_request`, `generate_payload_schema`: the same names and arguments as the full tools, in a sandbox of up to 3 endpoints, 25 captured requests each and 100 in all, for 24 hours. The first `create_endpoint` registers it (a few seconds of proof of work).
 - `connect_account`: returns a link and a 6-digit code for a human to connect the agent to their account.
 - `wait_for_connection`: waits for the human, then replaces the sandbox tools with the full tools for that account (`notifications/tools/list_changed`).
 - `about_sandbox`: the limits and how to connect, without a network call.

package/dist/bin/mcp.js

@@ -76,6 +76,7 @@ function registerPrompts(server) {
                 "If a target URL is provided, use preview_webhook before send_to so the request shape is visible.",
                 targetUrl ? `Target URL: ${targetUrl}.` : null,
                 "Send a realistic provider webhook, wait for capture, and verify the signature if a secret is available.",
+                "Once real deliveries are captured, use generate_payload_schema to write the payload types for the handler.",
                 "Return the endpoint URL, the exact tools used, and the next step for the developer."
               ].filter(Boolean).join(" ")
             }
@@ -157,6 +158,13 @@ function omitHeaders(holder) {
   holder.headers = {};
   holder.headersOmitted = `${count} headers left out to fit the output`;
 }
+function trimSpam(holder) {
+  const spam = holder.spam;
+  if (spam && typeof spam === "object" && !Array.isArray(spam)) {
+    const { score, required, action, error } = spam;
+    holder.spam = { score, required, action, error };
+  }
+}
 function capExtracts(holder) {
   if (Array.isArray(holder.codes) && holder.codes.length > MAX_EXTRACTS) {
     holder.codes = holder.codes.slice(0, MAX_EXTRACTS);
@@ -221,7 +229,8 @@ var ESSENTIAL_EMAIL_FIELDS = [
   "date",
   "text",
   "textTruncated",
-  "htmlSize"
+  "htmlSize",
+  "spam"
 ];
 function compactRequest(request) {
   if (request.kind !== "email") return request;
@@ -248,6 +257,7 @@ function compactRequest(request) {
   const budget = MAX_OUTPUT - 128;
   shrinkToFit(root, budget, [
     () => omitHeaders(compact),
+    () => trimSpam(email),
     () => capLists(email),
     () => cutStringToFit(root, email, "text", "textTruncated", budget, TEXT_FLOOR),
     // Down to the essentials there may be room for more of the text again.
@@ -484,6 +494,67 @@ var waitForRequestShape = {
   timeout: durationOrTimestampSchema.default("30s").describe('How long to wait, for example "30s"'),
   pollInterval: durationOrTimestampSchema.optional().describe('Interval between polls, for example "500ms" or "1s"')
 };
+var payloadSchemaShape = {
+  endpointSlug: import_zod2.z.string().describe("The endpoint slug"),
+  format: import_zod2.z.enum(import_sdk.PAYLOAD_SCHEMA_FORMATS).default("typescript").describe(
+    'Output: "typescript" interfaces, "zod" schemas, "pydantic" models, or "json-schema"'
+  ),
+  name: import_zod2.z.string().max(100).optional().describe("Root type name (default: from the detected event, else WebhookPayload)"),
+  event: import_zod2.z.string().optional().describe(
+    'Only requests whose detected provider event matches, e.g. "invoice.paid" or "push". One event per schema gives the tightest types.'
+  ),
+  method: import_zod2.z.string().optional().describe("Only requests with this HTTP method"),
+  path: import_zod2.z.string().optional().describe("Only requests with this path"),
+  requestIds: import_zod2.z.array(import_zod2.z.string()).min(1).max(50).optional().describe("Use exactly these requests instead of the latest ones"),
+  limit: import_zod2.z.number().int().min(1).max(100).default(20).describe("How many of the latest requests to read before filtering")
+};
+function eventName(event) {
+  const words = event.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter(Boolean);
+  const name = words.map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+  if (!name) return "WebhookPayload";
+  return /^[0-9]/.test(name) ? `Webhook${name}Event` : `${name}Event`;
+}
+function payloadSchemaResult(requests, args2) {
+  const method = args2.method?.toUpperCase();
+  const matching = requests.filter(
+    (request) => request.kind !== "email" && (!method || request.method.toUpperCase() === method) && (!args2.path || request.path === args2.path) && (!args2.event || (0, import_sdk.detectWebhookInfo)(request)?.event === args2.event)
+  );
+  if (matching.length === 0) {
+    throw new Error(
+      `None of the ${requests.length} requests read matched. Capture a request first, or loosen event, method or path.`
+    );
+  }
+  const events = [
+    ...new Set(
+      matching.map((request) => (0, import_sdk.detectWebhookInfo)(request)?.event).filter((e) => !!e)
+    )
+  ];
+  const name = args2.name ?? (events.length === 1 ? eventName(events[0]) : void 0);
+  const result = (0, import_sdk.generateRequestSchema)(matching, { format: args2.format, name });
+  if (result.samples === 0) {
+    throw new Error(
+      `None of the ${matching.length} matching requests has a JSON or form body to learn from.`
+    );
+  }
+  const output = {
+    format: result.format,
+    name: result.name,
+    samples: result.samples,
+    skipped: result.skipped,
+    ...events.length > 0 ? { events } : {},
+    ...events.length > 1 ? {
+      warning: `The samples mix ${events.length} events, so fields of one event show up as optional. Pass event for one schema per event.`
+    } : {},
+    code: result.code
+  };
+  const size = JSON.stringify(output, null, 2).length;
+  if (size > MAX_OUTPUT) {
+    throw new Error(
+      `The schema is ${result.code.length} characters, more than this tool can return. Narrow it with event or requestIds, or call generateRequestSchema() from @webhooks-cc/sdk in code.`
+    );
+  }
+  return jsonContent(output);
+}
 function textContent(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -737,6 +808,7 @@ var ESSENTIAL_DETAIL_FIELDS = [
   "from",
   "size",
   "test",
+  "spam",
   "text",
   "textTruncated",
   "htmlSize",
@@ -765,6 +837,7 @@ function emailDetail(client, email, view, includeHtml) {
   };
   shrinkToFit(detail, MAX_BODY_SIZE, [
     () => omitHeaders(detail),
+    () => trimSpam(detail),
     () => capExtracts(detail),
     () => capLists(detail),
     () => cutStringToFit(detail, detail, "html", "htmlTruncated", MAX_BODY_SIZE),
@@ -1178,6 +1251,15 @@ function registerTools(server, client) {
       return jsonContent(diff);
     })
   );
+  server.tool(
+    "generate_payload_schema",
+    "Generate TypeScript interfaces, Zod schemas, Pydantic models, or JSON Schema from captured request bodies. Several requests of one event teach which fields are optional or nullable, so filter with event (or pass requestIds) and write the result into the codebase instead of hand-typing the payload.",
+    payloadSchemaShape,
+    withErrorHandling(async ({ endpointSlug, requestIds, limit, ...args2 }) => {
+      const requests = requestIds ? await Promise.all(requestIds.map((id) => client.requests.get(id))) : await client.requests.list(endpointSlug, { limit, kind: "http" });
+      return payloadSchemaResult(requests, args2);
+    })
+  );
   server.tool(
     "extract_from_request",
     "Extract specific JSON fields from a captured request body.",
@@ -1868,6 +1950,18 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
+  registered.push(
+    server.tool(
+      "generate_payload_schema",
+      "Generate TypeScript interfaces, Zod schemas, Pydantic models, or JSON Schema from the bodies of requests captured by a sandbox endpoint. Several requests of one event teach which fields are optional or nullable.",
+      payloadSchemaShape,
+      withErrorHandling(async ({ endpointSlug, requestIds, limit, ...args2 }) => {
+        const sandbox = await session.requireSandbox();
+        const requests = requestIds ? await Promise.all(requestIds.map((id) => sandbox.requests.get(id))) : await sandbox.requests.list(endpointSlug, { limit });
+        return payloadSchemaResult(requests, args2);
+      })
+    )
+  );
   registered.push(
     server.tool(
       "connect_account",
@@ -2023,7 +2117,7 @@ function registerSandboxTools(server, options = {}) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.12.0" : "0.0.0-dev";
+var VERSION = true ? "1.13.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const webhookUrl = options.webhookUrl ?? process.env.WHK_WEBHOOK_URL;
@@ -2244,7 +2338,7 @@ function runSetup(args2) {
   const apiKey = resolveApiKey(flags);
   if (!apiKey) {
     console.error("Error: API key required. Pass --api-key or set WHK_API_KEY env var.");
-    console.error("Get your API key at https://webhooks.cc/account\n");
+    console.error("Get your API key at https://webhooks.cc/account/api-keys\n");
     process.exit(1);
   }
   validateApiKeyFormat(apiKey);
@@ -2299,7 +2393,7 @@ Setup:
   npx @webhooks-cc/mcp setup windsurf --api-key whcc_...
   npx @webhooks-cc/mcp setup claude-desktop --api-key whcc_...
 
-Get your API key at https://webhooks.cc/account
+Get your API key at https://webhooks.cc/account/api-keys
 `);
 } else if (command && command !== "--") {
   console.error(`Unknown command: "${command}". Run with --help for usage.`);

package/dist/index.d.mts

@@ -53,4 +53,5 @@ interface CreateServerOptions {
  */
 declare function createServer(options?: CreateServerOptions): McpServer;
 
-export { type CreateServerOptions, type SandboxToolOptions, createServer, registerAgentRegistrationTools, registerPrompts, registerResources, registerSandboxTools, registerTools };
+export { createServer, registerAgentRegistrationTools, registerPrompts, registerResources, registerSandboxTools, registerTools };
+export type { CreateServerOptions, SandboxToolOptions };

package/dist/index.d.ts

@@ -53,4 +53,5 @@ interface CreateServerOptions {
  */
 declare function createServer(options?: CreateServerOptions): McpServer;
 
-export { type CreateServerOptions, type SandboxToolOptions, createServer, registerAgentRegistrationTools, registerPrompts, registerResources, registerSandboxTools, registerTools };
+export { createServer, registerAgentRegistrationTools, registerPrompts, registerResources, registerSandboxTools, registerTools };
+export type { CreateServerOptions, SandboxToolOptions };

package/dist/index.js

@@ -99,6 +99,7 @@ function registerPrompts(server) {
                 "If a target URL is provided, use preview_webhook before send_to so the request shape is visible.",
                 targetUrl ? `Target URL: ${targetUrl}.` : null,
                 "Send a realistic provider webhook, wait for capture, and verify the signature if a secret is available.",
+                "Once real deliveries are captured, use generate_payload_schema to write the payload types for the handler.",
                 "Return the endpoint URL, the exact tools used, and the next step for the developer."
               ].filter(Boolean).join(" ")
             }
@@ -180,6 +181,13 @@ function omitHeaders(holder) {
   holder.headers = {};
   holder.headersOmitted = `${count} headers left out to fit the output`;
 }
+function trimSpam(holder) {
+  const spam = holder.spam;
+  if (spam && typeof spam === "object" && !Array.isArray(spam)) {
+    const { score, required, action, error } = spam;
+    holder.spam = { score, required, action, error };
+  }
+}
 function capExtracts(holder) {
   if (Array.isArray(holder.codes) && holder.codes.length > MAX_EXTRACTS) {
     holder.codes = holder.codes.slice(0, MAX_EXTRACTS);
@@ -244,7 +252,8 @@ var ESSENTIAL_EMAIL_FIELDS = [
   "date",
   "text",
   "textTruncated",
-  "htmlSize"
+  "htmlSize",
+  "spam"
 ];
 function compactRequest(request) {
   if (request.kind !== "email") return request;
@@ -271,6 +280,7 @@ function compactRequest(request) {
   const budget = MAX_OUTPUT - 128;
   shrinkToFit(root, budget, [
     () => omitHeaders(compact),
+    () => trimSpam(email),
     () => capLists(email),
     () => cutStringToFit(root, email, "text", "textTruncated", budget, TEXT_FLOOR),
     // Down to the essentials there may be room for more of the text again.
@@ -507,6 +517,67 @@ var waitForRequestShape = {
   timeout: durationOrTimestampSchema.default("30s").describe('How long to wait, for example "30s"'),
   pollInterval: durationOrTimestampSchema.optional().describe('Interval between polls, for example "500ms" or "1s"')
 };
+var payloadSchemaShape = {
+  endpointSlug: import_zod2.z.string().describe("The endpoint slug"),
+  format: import_zod2.z.enum(import_sdk.PAYLOAD_SCHEMA_FORMATS).default("typescript").describe(
+    'Output: "typescript" interfaces, "zod" schemas, "pydantic" models, or "json-schema"'
+  ),
+  name: import_zod2.z.string().max(100).optional().describe("Root type name (default: from the detected event, else WebhookPayload)"),
+  event: import_zod2.z.string().optional().describe(
+    'Only requests whose detected provider event matches, e.g. "invoice.paid" or "push". One event per schema gives the tightest types.'
+  ),
+  method: import_zod2.z.string().optional().describe("Only requests with this HTTP method"),
+  path: import_zod2.z.string().optional().describe("Only requests with this path"),
+  requestIds: import_zod2.z.array(import_zod2.z.string()).min(1).max(50).optional().describe("Use exactly these requests instead of the latest ones"),
+  limit: import_zod2.z.number().int().min(1).max(100).default(20).describe("How many of the latest requests to read before filtering")
+};
+function eventName(event) {
+  const words = event.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter(Boolean);
+  const name = words.map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+  if (!name) return "WebhookPayload";
+  return /^[0-9]/.test(name) ? `Webhook${name}Event` : `${name}Event`;
+}
+function payloadSchemaResult(requests, args) {
+  const method = args.method?.toUpperCase();
+  const matching = requests.filter(
+    (request) => request.kind !== "email" && (!method || request.method.toUpperCase() === method) && (!args.path || request.path === args.path) && (!args.event || (0, import_sdk.detectWebhookInfo)(request)?.event === args.event)
+  );
+  if (matching.length === 0) {
+    throw new Error(
+      `None of the ${requests.length} requests read matched. Capture a request first, or loosen event, method or path.`
+    );
+  }
+  const events = [
+    ...new Set(
+      matching.map((request) => (0, import_sdk.detectWebhookInfo)(request)?.event).filter((e) => !!e)
+    )
+  ];
+  const name = args.name ?? (events.length === 1 ? eventName(events[0]) : void 0);
+  const result = (0, import_sdk.generateRequestSchema)(matching, { format: args.format, name });
+  if (result.samples === 0) {
+    throw new Error(
+      `None of the ${matching.length} matching requests has a JSON or form body to learn from.`
+    );
+  }
+  const output = {
+    format: result.format,
+    name: result.name,
+    samples: result.samples,
+    skipped: result.skipped,
+    ...events.length > 0 ? { events } : {},
+    ...events.length > 1 ? {
+      warning: `The samples mix ${events.length} events, so fields of one event show up as optional. Pass event for one schema per event.`
+    } : {},
+    code: result.code
+  };
+  const size = JSON.stringify(output, null, 2).length;
+  if (size > MAX_OUTPUT) {
+    throw new Error(
+      `The schema is ${result.code.length} characters, more than this tool can return. Narrow it with event or requestIds, or call generateRequestSchema() from @webhooks-cc/sdk in code.`
+    );
+  }
+  return jsonContent(output);
+}
 function textContent(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -760,6 +831,7 @@ var ESSENTIAL_DETAIL_FIELDS = [
   "from",
   "size",
   "test",
+  "spam",
   "text",
   "textTruncated",
   "htmlSize",
@@ -788,6 +860,7 @@ function emailDetail(client, email, view, includeHtml) {
   };
   shrinkToFit(detail, MAX_BODY_SIZE, [
     () => omitHeaders(detail),
+    () => trimSpam(detail),
     () => capExtracts(detail),
     () => capLists(detail),
     () => cutStringToFit(detail, detail, "html", "htmlTruncated", MAX_BODY_SIZE),
@@ -1201,6 +1274,15 @@ function registerTools(server, client) {
       return jsonContent(diff);
     })
   );
+  server.tool(
+    "generate_payload_schema",
+    "Generate TypeScript interfaces, Zod schemas, Pydantic models, or JSON Schema from captured request bodies. Several requests of one event teach which fields are optional or nullable, so filter with event (or pass requestIds) and write the result into the codebase instead of hand-typing the payload.",
+    payloadSchemaShape,
+    withErrorHandling(async ({ endpointSlug, requestIds, limit, ...args }) => {
+      const requests = requestIds ? await Promise.all(requestIds.map((id) => client.requests.get(id))) : await client.requests.list(endpointSlug, { limit, kind: "http" });
+      return payloadSchemaResult(requests, args);
+    })
+  );
   server.tool(
     "extract_from_request",
     "Extract specific JSON fields from a captured request body.",
@@ -1891,6 +1973,18 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
+  registered.push(
+    server.tool(
+      "generate_payload_schema",
+      "Generate TypeScript interfaces, Zod schemas, Pydantic models, or JSON Schema from the bodies of requests captured by a sandbox endpoint. Several requests of one event teach which fields are optional or nullable.",
+      payloadSchemaShape,
+      withErrorHandling(async ({ endpointSlug, requestIds, limit, ...args }) => {
+        const sandbox = await session.requireSandbox();
+        const requests = requestIds ? await Promise.all(requestIds.map((id) => sandbox.requests.get(id))) : await sandbox.requests.list(endpointSlug, { limit });
+        return payloadSchemaResult(requests, args);
+      })
+    )
+  );
   registered.push(
     server.tool(
       "connect_account",
@@ -2049,7 +2143,7 @@ function registerAgentRegistrationTools(server) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.12.0" : "0.0.0-dev";
+var VERSION = true ? "1.13.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const webhookUrl = options.webhookUrl ?? process.env.WHK_WEBHOOK_URL;

package/dist/index.mjs

@@ -70,6 +70,7 @@ function registerPrompts(server) {
                 "If a target URL is provided, use preview_webhook before send_to so the request shape is visible.",
                 targetUrl ? `Target URL: ${targetUrl}.` : null,
                 "Send a realistic provider webhook, wait for capture, and verify the signature if a secret is available.",
+                "Once real deliveries are captured, use generate_payload_schema to write the payload types for the handler.",
                 "Return the endpoint URL, the exact tools used, and the next step for the developer."
               ].filter(Boolean).join(" ")
             }
@@ -151,6 +152,13 @@ function omitHeaders(holder) {
   holder.headers = {};
   holder.headersOmitted = `${count} headers left out to fit the output`;
 }
+function trimSpam(holder) {
+  const spam = holder.spam;
+  if (spam && typeof spam === "object" && !Array.isArray(spam)) {
+    const { score, required, action, error } = spam;
+    holder.spam = { score, required, action, error };
+  }
+}
 function capExtracts(holder) {
   if (Array.isArray(holder.codes) && holder.codes.length > MAX_EXTRACTS) {
     holder.codes = holder.codes.slice(0, MAX_EXTRACTS);
@@ -215,7 +223,8 @@ var ESSENTIAL_EMAIL_FIELDS = [
   "date",
   "text",
   "textTruncated",
-  "htmlSize"
+  "htmlSize",
+  "spam"
 ];
 function compactRequest(request) {
   if (request.kind !== "email") return request;
@@ -242,6 +251,7 @@ function compactRequest(request) {
   const budget = MAX_OUTPUT - 128;
   shrinkToFit(root, budget, [
     () => omitHeaders(compact),
+    () => trimSpam(email),
     () => capLists(email),
     () => cutStringToFit(root, email, "text", "textTruncated", budget, TEXT_FLOOR),
     // Down to the essentials there may be room for more of the text again.
@@ -408,7 +418,10 @@ import {
   verifySignature,
   WebhooksCCError,
   extractCode,
-  extractLink
+  extractLink,
+  detectWebhookInfo,
+  generateRequestSchema,
+  PAYLOAD_SCHEMA_FORMATS
 } from "@webhooks-cc/sdk";
 var MAX_BODY_SIZE = MAX_OUTPUT;
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
@@ -504,6 +517,67 @@ var waitForRequestShape = {
   timeout: durationOrTimestampSchema.default("30s").describe('How long to wait, for example "30s"'),
   pollInterval: durationOrTimestampSchema.optional().describe('Interval between polls, for example "500ms" or "1s"')
 };
+var payloadSchemaShape = {
+  endpointSlug: z2.string().describe("The endpoint slug"),
+  format: z2.enum(PAYLOAD_SCHEMA_FORMATS).default("typescript").describe(
+    'Output: "typescript" interfaces, "zod" schemas, "pydantic" models, or "json-schema"'
+  ),
+  name: z2.string().max(100).optional().describe("Root type name (default: from the detected event, else WebhookPayload)"),
+  event: z2.string().optional().describe(
+    'Only requests whose detected provider event matches, e.g. "invoice.paid" or "push". One event per schema gives the tightest types.'
+  ),
+  method: z2.string().optional().describe("Only requests with this HTTP method"),
+  path: z2.string().optional().describe("Only requests with this path"),
+  requestIds: z2.array(z2.string()).min(1).max(50).optional().describe("Use exactly these requests instead of the latest ones"),
+  limit: z2.number().int().min(1).max(100).default(20).describe("How many of the latest requests to read before filtering")
+};
+function eventName(event) {
+  const words = event.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter(Boolean);
+  const name = words.map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+  if (!name) return "WebhookPayload";
+  return /^[0-9]/.test(name) ? `Webhook${name}Event` : `${name}Event`;
+}
+function payloadSchemaResult(requests, args) {
+  const method = args.method?.toUpperCase();
+  const matching = requests.filter(
+    (request) => request.kind !== "email" && (!method || request.method.toUpperCase() === method) && (!args.path || request.path === args.path) && (!args.event || detectWebhookInfo(request)?.event === args.event)
+  );
+  if (matching.length === 0) {
+    throw new Error(
+      `None of the ${requests.length} requests read matched. Capture a request first, or loosen event, method or path.`
+    );
+  }
+  const events = [
+    ...new Set(
+      matching.map((request) => detectWebhookInfo(request)?.event).filter((e) => !!e)
+    )
+  ];
+  const name = args.name ?? (events.length === 1 ? eventName(events[0]) : void 0);
+  const result = generateRequestSchema(matching, { format: args.format, name });
+  if (result.samples === 0) {
+    throw new Error(
+      `None of the ${matching.length} matching requests has a JSON or form body to learn from.`
+    );
+  }
+  const output = {
+    format: result.format,
+    name: result.name,
+    samples: result.samples,
+    skipped: result.skipped,
+    ...events.length > 0 ? { events } : {},
+    ...events.length > 1 ? {
+      warning: `The samples mix ${events.length} events, so fields of one event show up as optional. Pass event for one schema per event.`
+    } : {},
+    code: result.code
+  };
+  const size = JSON.stringify(output, null, 2).length;
+  if (size > MAX_OUTPUT) {
+    throw new Error(
+      `The schema is ${result.code.length} characters, more than this tool can return. Narrow it with event or requestIds, or call generateRequestSchema() from @webhooks-cc/sdk in code.`
+    );
+  }
+  return jsonContent(output);
+}
 function textContent(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -757,6 +831,7 @@ var ESSENTIAL_DETAIL_FIELDS = [
   "from",
   "size",
   "test",
+  "spam",
   "text",
   "textTruncated",
   "htmlSize",
@@ -785,6 +860,7 @@ function emailDetail(client, email, view, includeHtml) {
   };
   shrinkToFit(detail, MAX_BODY_SIZE, [
     () => omitHeaders(detail),
+    () => trimSpam(detail),
     () => capExtracts(detail),
     () => capLists(detail),
     () => cutStringToFit(detail, detail, "html", "htmlTruncated", MAX_BODY_SIZE),
@@ -1198,6 +1274,15 @@ function registerTools(server, client) {
       return jsonContent(diff);
     })
   );
+  server.tool(
+    "generate_payload_schema",
+    "Generate TypeScript interfaces, Zod schemas, Pydantic models, or JSON Schema from captured request bodies. Several requests of one event teach which fields are optional or nullable, so filter with event (or pass requestIds) and write the result into the codebase instead of hand-typing the payload.",
+    payloadSchemaShape,
+    withErrorHandling(async ({ endpointSlug, requestIds, limit, ...args }) => {
+      const requests = requestIds ? await Promise.all(requestIds.map((id) => client.requests.get(id))) : await client.requests.list(endpointSlug, { limit, kind: "http" });
+      return payloadSchemaResult(requests, args);
+    })
+  );
   server.tool(
     "extract_from_request",
     "Extract specific JSON fields from a captured request body.",
@@ -1888,6 +1973,18 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
+  registered.push(
+    server.tool(
+      "generate_payload_schema",
+      "Generate TypeScript interfaces, Zod schemas, Pydantic models, or JSON Schema from the bodies of requests captured by a sandbox endpoint. Several requests of one event teach which fields are optional or nullable.",
+      payloadSchemaShape,
+      withErrorHandling(async ({ endpointSlug, requestIds, limit, ...args }) => {
+        const sandbox = await session.requireSandbox();
+        const requests = requestIds ? await Promise.all(requestIds.map((id) => sandbox.requests.get(id))) : await sandbox.requests.list(endpointSlug, { limit });
+        return payloadSchemaResult(requests, args);
+      })
+    )
+  );
   registered.push(
     server.tool(
       "connect_account",
@@ -2046,7 +2143,7 @@ function registerAgentRegistrationTools(server) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.12.0" : "0.0.0-dev";
+var VERSION = true ? "1.13.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const webhookUrl = options.webhookUrl ?? process.env.WHK_WEBHOOK_URL;

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@webhooks-cc/mcp",
-  "version": "1.12.0",
+  "version": "1.13.0",
+  "mcpName": "io.github.kroqdotdev/webhooks-cc",
   "description": "MCP server for webhooks.cc — AI agent integration for webhook testing",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -31,20 +32,20 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/webhooks-cc/webhooks-cc",
+    "url": "https://github.com/kroqdotdev/webhooks-cc",
     "directory": "packages/mcp"
   },
   "homepage": "https://webhooks.cc",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.31.0",
-    "zod": "^4.6.5",
-    "@webhooks-cc/sdk": "1.14.0"
+    "@modelcontextprotocol/sdk": "^1.32.0",
+    "zod": "^4.6.7",
+    "@webhooks-cc/sdk": "1.17.0"
   },
   "devDependencies": {
-    "@types/node": "^26.6.4",
-    "tsup": "^8.5.1",
+    "@types/node": "^26.6.5",
+    "tsup": "^9.0.0",
     "typescript": "^6.0.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.5"
   },
   "scripts": {
     "build": "tsup",