@webhooks-cc/mcp 1.12.1 → 1.14.0

package/README.md

@@ -11,6 +11,16 @@ The server reads `WHK_API_KEY` from the environment. It also supports:
 - `WHK_BASE_URL` for a custom API base URL
 - `WHK_WEBHOOK_URL` for a custom receiver base URL
 
+### Claude Code plugin
+
+The plugin installs the server together with a webhook testing skill that tells Claude when to use it:
+
+```text
+/plugin install webhooks-cc --marketplace kroqdotdev/webhooks-cc
+```
+
+For other agents, `npx skills add kroqdotdev/webhooks-cc` installs the same skill. See [Agent skill](https://webhooks.cc/docs/mcp/skills).
+
 ### One-click
 
 - **Cursor**: [Add to Cursor](https://cursor.com/en/install-mcp?name=webhooks-cc&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkB3ZWJob29rcy1jYy9tY3AiXSwiZW52Ijp7IldIS19BUElfS0VZIjoid2hjY18uLi4ifX0=)
@@ -54,11 +64,11 @@ npx @webhooks-cc/mcp setup claude-desktop --api-key whcc_...
 }
 ```
 
-Get your API key at [webhooks.cc/account](https://webhooks.cc/account).
+Get your API key at [webhooks.cc/account/api-keys](https://webhooks.cc/account/api-keys).
 
 ## What it exposes
 
-The server exposes `38` tools, `3` prompts, and `3` resource surfaces with an API key, and `10` sandbox tools without one.
+The server exposes `46` tools, `3` prompts, and `3` resource surfaces with an API key, and `11` sandbox tools without one.
 
 ### Endpoint tools
 
@@ -66,6 +76,7 @@ The server exposes `38` tools, `3` prompts, and `3` resource surfaces with an AP
 - `list_endpoints`
 - `get_endpoint`
 - `update_endpoint`
+- `preview_response`
 - `delete_endpoint`
 - `create_endpoints`
 - `delete_endpoints`
@@ -80,6 +91,7 @@ The server exposes `38` tools, `3` prompts, and `3` resource surfaces with an AP
 - `wait_for_requests`
 - `replay_request`
 - `compare_requests`
+- `generate_payload_schema` (TypeScript, Zod, Pydantic, or JSON Schema from captured bodies)
 - `extract_from_request`
 - `verify_signature`
 - `clear_requests`
@@ -92,19 +104,24 @@ Every endpoint on an account receives email at `{slug}@mailhooks.cc` (and `{slug
 - `get_email`
 - `wait_for_email`
 - `send_test_email`
+- `render_email` (an email in Postmark, SendGrid, Mailgun or CloudMailin shape, optionally posted to your local inbound handler)
 
 The request tools and resources return emails too (filter with `kind`), without the raw message or the HTML part and with the text cut at 8,000 characters; `get_email` returns the HTML.
 
 ### Forwarding tools
 
-Forward every captured HTTP request and email to a URL or a Slack or Discord channel, as received,
-as signed JSON or as a chat message, retried and logged (owner only):
+Send captured HTTP requests and emails to up to 10 destinations (your servers, Slack or Discord
+channels, Zapier or n8n), each with its own kinds, conditions, format (as received, signed JSON,
+a JSON body you shape with placeholders, or a chat message), throttle, delay and signing secret,
+retried and logged (owner only):
 
-- `configure_forwarding` (URL, on/off, kinds, format, your headers, path, retries, order, sent time field)
-- `get_forwarding_secret` (returns the `whsec_` secret; with `rotate: true`, replaces it)
-- `test_forwarding`
-- `list_deliveries` (the delivery log with its counts, or every try of one request)
-- `redeliver` (one request, or every failed delivery of an endpoint)
+- `list_destinations`, `add_destination`, `update_destination`, `remove_destination`
+- `preview_destination` (dry run: does the filter pass, and the exact request it would send)
+- `configure_forwarding` (the primary destination: URL, on/off, kinds, format, your headers, path, retries, order, sent time field)
+- `get_forwarding_secret` (returns a destination's `whsec_` secret; with `rotate: true`, replaces it)
+- `test_forwarding` (sends one request to a destination and reports the answer)
+- `list_deliveries` (the delivery log with its counts, by destination, or every try of one request)
+- `redeliver` (one request, to one destination or all, or every failed delivery of an endpoint)
 
 ### Send and test tools
 
@@ -132,7 +149,7 @@ Endpoints shared with you already appear in `list_endpoints` (with `fromTeam`) a
 
 Started without `WHK_API_KEY`, the server registers sandbox tools instead ([auth.md](https://webhooks.cc/auth.md)):
 
-- `create_endpoint`, `list_endpoints`, `get_endpoint`, `delete_endpoint`, `list_requests`, `get_request`, `wait_for_request`: the same names and arguments as the full tools, in a sandbox of up to 3 endpoints, 25 captured requests each and 100 in all, for 24 hours. The first `create_endpoint` registers it (a few seconds of proof of work).
+- `create_endpoint`, `list_endpoints`, `get_endpoint`, `delete_endpoint`, `list_requests`, `get_request`, `wait_for_request`, `generate_payload_schema`: the same names and arguments as the full tools, in a sandbox of up to 3 endpoints, 25 captured requests each and 100 in all, for 24 hours. The first `create_endpoint` registers it (a few seconds of proof of work).
 - `connect_account`: returns a link and a 6-digit code for a human to connect the agent to their account.
 - `wait_for_connection`: waits for the human, then replaces the sandbox tools with the full tools for that account (`notifications/tools/list_changed`).
 - `about_sandbox`: the limits and how to connect, without a network call.

package/dist/bin/mcp.js

@@ -76,6 +76,7 @@ function registerPrompts(server) {
                 "If a target URL is provided, use preview_webhook before send_to so the request shape is visible.",
                 targetUrl ? `Target URL: ${targetUrl}.` : null,
                 "Send a realistic provider webhook, wait for capture, and verify the signature if a secret is available.",
+                "Once real deliveries are captured, use generate_payload_schema to write the payload types for the handler.",
                 "Return the endpoint URL, the exact tools used, and the next step for the developer."
               ].filter(Boolean).join(" ")
             }
@@ -417,28 +418,75 @@ var methodSchema = import_zod2.z.enum(HTTP_METHODS).default("POST").describe("HT
 var kindSchema = import_zod2.z.enum(["http", "email"]).optional().describe('Only HTTP requests ("http") or only captured emails ("email")');
 var EMAIL_SCAN_LIMIT = 100;
 var durationOrTimestampSchema = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number()]);
-var ruleConditionSchema = import_zod2.z.object({
-  field: import_zod2.z.enum(["method", "path", "header", "body_contains", "body_path", "query"]).describe("Request field to match against"),
-  op: import_zod2.z.enum(["eq", "contains", "starts_with", "matches", "exists"]).describe("Comparison operator"),
-  value: import_zod2.z.string().max(import_sdk.MAX_CONDITION_VALUE_LEN).optional().describe(
-    `Value to compare against (required unless op is "exists", max ${import_sdk.MAX_CONDITION_VALUE_LEN} chars)`
+var CONDITION_FIELD_NAMES = Object.keys(import_sdk.CONDITION_FIELDS);
+var CONDITION_OP_NAMES = import_sdk.CONDITION_OPS;
+function conditionSchema(use) {
+  const fields = use === "response" ? CONDITION_FIELD_NAMES.filter((field) => import_sdk.CONDITION_FIELDS[field].response) : CONDITION_FIELD_NAMES;
+  return import_zod2.z.object({
+    field: import_zod2.z.enum(fields).describe(
+      use === "response" ? "What to read: method, path, header (name), query (name), body (text), body_path (path into a JSON or form body), content_type, size" : "What to read: method, path, header (name), query (name), body, body_path (path), content_type, size, kind (http or email), email (name: subject, from, to, text or tag), spam_score, email_auth (name: spf, dkim or dmarc), signature (verified, failed or missing)"
+    ),
+    op: import_zod2.z.enum(CONDITION_OP_NAMES).describe(
+      "eq, neq, contains, not_contains, starts_with, ends_with, matches (glob: * one path segment, ** any, ? one character), regex (RE2, searched anywhere; (?i) ignores case), exists, not_exists, gt, gte, lt, lte (numbers)"
+    ),
+    value: import_zod2.z.string().max(import_sdk.MAX_CONDITION_VALUE_LEN).optional().describe(`What to compare with (not for exists and not_exists)`),
+    name: import_zod2.z.string().max(import_sdk.MAX_CONDITION_NAME_LEN).optional().describe("Header or query parameter name; the email part; spf, dkim or dmarc"),
+    path: import_zod2.z.string().max(import_sdk.MAX_CONDITION_PATH_LEN).optional().describe('Dot path for body_path, e.g. data.object.status or items.0.sku or a["odd.key"]')
+  }).superRefine((condition, ctx) => {
+    for (const issue of (0, import_sdk.conditionIssues)(condition, { use })) {
+      ctx.addIssue({ code: "custom", message: issue });
+    }
+  });
+}
+var ruleConditionSchema = conditionSchema("response");
+var destinationFields = {
+  name: import_zod2.z.string().max(100).nullable().optional().describe("A name for the list and the log"),
+  enabled: import_zod2.z.boolean().optional().describe("Send to it (default true)"),
+  http: import_zod2.z.boolean().optional().describe("Takes HTTP requests (default true)"),
+  email: import_zod2.z.boolean().optional().describe("Takes emails (default true)"),
+  filter: import_zod2.z.object({
+    logic: import_zod2.z.enum(["and", "or"]).optional().describe("and (default): every condition; or: any"),
+    conditions: import_zod2.z.array(conditionSchema("filter")).max(10)
+  }).nullable().optional().describe(
+    "Send only captures that match (null: everything it takes). Conditions like response rules plus kind, email (name: subject, from, to, text, tag), spam_score, email_auth (name: spf, dkim, dmarc) and signature (verified, failed, missing)"
   ),
-  name: import_zod2.z.string().max(import_sdk.MAX_CONDITION_NAME_LEN).optional().describe(
-    `Header name or query param name (required for header/query, max ${import_sdk.MAX_CONDITION_NAME_LEN} chars)`
+  format: import_zod2.z.enum([
+    "auto",
+    "as_received",
+    "json",
+    "template",
+    "chat",
+    "postmark",
+    "sendgrid",
+    "mailgun",
+    "cloudmailin"
+  ]).optional().describe(
+    "auto (pick from the URL), as_received (relay HTTP requests unchanged; emails as signed JSON), json (signed JSON envelope), template (your bodyTemplate, signed like json), chat (Slack or Discord message), or an inbound mail provider's shape for emails (postmark, sendgrid, mailgun, cloudmailin; HTTP requests then go as received), to test the inbound handler you wrote for that provider"
   ),
-  path: import_zod2.z.string().max(import_sdk.MAX_CONDITION_PATH_LEN).optional().describe(
-    `JSON dot-notation path (required for body_path, max ${import_sdk.MAX_CONDITION_PATH_LEN} chars)`
-  )
-}).refine((c) => c.op === "exists" || c.value !== void 0 && c.value.length > 0, {
-  message: 'value is required when op is not "exists"'
-}).refine(
-  (c) => !(c.field === "header" || c.field === "query") || c.name !== void 0 && c.name.length > 0,
-  { message: "name is required for header and query conditions" }
-).refine((c) => c.field !== "body_path" || c.path !== void 0 && c.path.length > 0, {
-  message: "path is required for body_path conditions"
-}).refine((c) => c.op !== "matches" || !c.value || c.value.length <= import_sdk.MAX_GLOB_PATTERN_LEN, {
-  message: `matches pattern must be ${import_sdk.MAX_GLOB_PATTERN_LEN} chars or less`
-});
+  mailgunSigningKey: import_zod2.z.string().max(200).nullable().optional().describe(
+    "For format mailgun: your Mailgun HTTP webhook signing key, so the form's signature verifies; null removes it. Write-only."
+  ),
+  bodyTemplate: import_zod2.z.unknown().optional().describe(
+    `For format template: any JSON value whose strings hold {{ placeholders }}, e.g. {"event": "{{ json.type }}", "amount": "{{ json.data.amount }}", "code": "{{ codes.0 }}"}. A string that is only a placeholder keeps the value's type; a missing field becomes null. HTTP requests read method, path, query.x, headers.x, body, json.path, id, receivedAt, signature; emails read the email.received fields (subject, from.address, to, text, codes, links, auth, spam, tag)`
+  ),
+  messageTemplate: import_zod2.z.string().max(4e3).nullable().optional().describe(
+    "For format chat: the message text with {{ placeholders }}; null sends the standard message"
+  ),
+  headers: import_zod2.z.array(
+    import_zod2.z.object({
+      name: import_zod2.z.string().describe("Header name, e.g. Authorization"),
+      value: import_zod2.z.string().nullable().describe("Value, or null to keep the stored one")
+    })
+  ).max(10).optional().describe("Your own headers for every delivery (not chat). Replaces the whole list"),
+  appendPath: import_zod2.z.boolean().optional().describe("Append the captured path to the URL (as_received)"),
+  retrySeconds: import_zod2.z.union([import_zod2.z.literal(0), import_zod2.z.literal(3600), import_zod2.z.literal(86400)]).optional().describe("Retry failed deliveries for 86400 (default), 3600 or 0 seconds"),
+  keepOrder: import_zod2.z.boolean().optional().describe("One delivery at a time, in capture order"),
+  sentField: import_zod2.z.string().max(128).nullable().optional().describe("JSON body field with the sender's own timestamp"),
+  throttleSeconds: import_zod2.z.number().int().min(0).max(3600).optional().describe(
+    "At most one delivery every N seconds; the rest are not sent (1 makes a heads-up channel)"
+  ),
+  delaySeconds: import_zod2.z.number().int().min(0).max(3600).optional().describe("Wait this long after the capture before sending, like a callback")
+};
 var responseRuleSchema = import_zod2.z.object({
   name: import_zod2.z.string().max(import_sdk.MAX_RULE_NAME_LEN).optional().describe(`Human-readable rule name (max ${import_sdk.MAX_RULE_NAME_LEN} chars)`),
   enabled: import_zod2.z.boolean().optional().default(true).describe("Whether this rule is active"),
@@ -449,8 +497,10 @@ var responseRuleSchema = import_zod2.z.object({
 var responseRulesSchema = import_zod2.z.array(responseRuleSchema).max(50).describe("Ordered conditional response rules (first match wins, max 50)");
 var mockResponseSchema = import_zod2.z.object({
   status: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_STATUS_MIN).max(import_sdk.MOCK_RESPONSE_STATUS_MAX).describe(`HTTP status code (${import_sdk.MOCK_RESPONSE_STATUS_MIN}-${import_sdk.MOCK_RESPONSE_STATUS_MAX})`),
-  body: import_zod2.z.string().default("").describe("Response body string (default: empty)"),
-  headers: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string()).default({}).describe("Response headers (default: none)"),
+  body: import_zod2.z.string().default("").describe(
+    'Response body (default: empty). {{ placeholders }} are filled in from the request: {{ json.id }} (a JSON or form body field), {{ body }}, {{ headers.user-agent }}, {{ query.page }}, {{ method }}, {{ path }}, {{ id }}, {{ uuid }}, {{ now }}; filters: | default: "x", | json, | lower, | upper, | truncate: 80'
+  ),
+  headers: import_zod2.z.record(import_zod2.z.string(), import_zod2.z.string()).default({}).describe("Response headers (default: none); values may use {{ placeholders }} too"),
   delay: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_DELAY_MIN).max(import_sdk.MOCK_RESPONSE_DELAY_MAX).optional().describe(
     `Response delay in milliseconds (${import_sdk.MOCK_RESPONSE_DELAY_MIN}-${import_sdk.MOCK_RESPONSE_DELAY_MAX}, default: none)`
   )
@@ -493,6 +543,67 @@ var waitForRequestShape = {
   timeout: durationOrTimestampSchema.default("30s").describe('How long to wait, for example "30s"'),
   pollInterval: durationOrTimestampSchema.optional().describe('Interval between polls, for example "500ms" or "1s"')
 };
+var payloadSchemaShape = {
+  endpointSlug: import_zod2.z.string().describe("The endpoint slug"),
+  format: import_zod2.z.enum(import_sdk.PAYLOAD_SCHEMA_FORMATS).default("typescript").describe(
+    'Output: "typescript" interfaces, "zod" schemas, "pydantic" models, or "json-schema"'
+  ),
+  name: import_zod2.z.string().max(100).optional().describe("Root type name (default: from the detected event, else WebhookPayload)"),
+  event: import_zod2.z.string().optional().describe(
+    'Only requests whose detected provider event matches, e.g. "invoice.paid" or "push". One event per schema gives the tightest types.'
+  ),
+  method: import_zod2.z.string().optional().describe("Only requests with this HTTP method"),
+  path: import_zod2.z.string().optional().describe("Only requests with this path"),
+  requestIds: import_zod2.z.array(import_zod2.z.string()).min(1).max(50).optional().describe("Use exactly these requests instead of the latest ones"),
+  limit: import_zod2.z.number().int().min(1).max(100).default(20).describe("How many of the latest requests to read before filtering")
+};
+function eventName(event) {
+  const words = event.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter(Boolean);
+  const name = words.map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join("");
+  if (!name) return "WebhookPayload";
+  return /^[0-9]/.test(name) ? `Webhook${name}Event` : `${name}Event`;
+}
+function payloadSchemaResult(requests, args2) {
+  const method = args2.method?.toUpperCase();
+  const matching = requests.filter(
+    (request) => request.kind !== "email" && (!method || request.method.toUpperCase() === method) && (!args2.path || request.path === args2.path) && (!args2.event || (0, import_sdk.detectWebhookInfo)(request)?.event === args2.event)
+  );
+  if (matching.length === 0) {
+    throw new Error(
+      `None of the ${requests.length} requests read matched. Capture a request first, or loosen event, method or path.`
+    );
+  }
+  const events = [
+    ...new Set(
+      matching.map((request) => (0, import_sdk.detectWebhookInfo)(request)?.event).filter((e) => !!e)
+    )
+  ];
+  const name = args2.name ?? (events.length === 1 ? eventName(events[0]) : void 0);
+  const result = (0, import_sdk.generateRequestSchema)(matching, { format: args2.format, name });
+  if (result.samples === 0) {
+    throw new Error(
+      `None of the ${matching.length} matching requests has a JSON or form body to learn from.`
+    );
+  }
+  const output = {
+    format: result.format,
+    name: result.name,
+    samples: result.samples,
+    skipped: result.skipped,
+    ...events.length > 0 ? { events } : {},
+    ...events.length > 1 ? {
+      warning: `The samples mix ${events.length} events, so fields of one event show up as optional. Pass event for one schema per event.`
+    } : {},
+    code: result.code
+  };
+  const size = JSON.stringify(output, null, 2).length;
+  if (size > MAX_OUTPUT) {
+    throw new Error(
+      `The schema is ${result.code.length} characters, more than this tool can return. Narrow it with event or requestIds, or call generateRequestSchema() from @webhooks-cc/sdk in code.`
+    );
+  }
+  return jsonContent(output);
+}
 function textContent(text) {
   return { content: [{ type: "text", text }] };
 }
@@ -744,6 +855,8 @@ var ESSENTIAL_DETAIL_FIELDS = [
   "tag",
   "subject",
   "from",
+  "fields",
+  "replyText",
   "size",
   "test",
   "spam",
@@ -753,6 +866,11 @@ var ESSENTIAL_DETAIL_FIELDS = [
   "html",
   "htmlTruncated"
 ];
+function shrinkRendered(rendered, max) {
+  const body = typeof rendered.body === "string" ? rendered.body : "";
+  if (body.length <= max - 1024) return rendered;
+  return { ...rendered, body: body.slice(0, max - 1024), bodyTruncated: true };
+}
 function emailDetail(client, email, view, includeHtml) {
   const { data } = client.emails.toJson(email, {
     endpoint: view.endpoint,
@@ -915,7 +1033,7 @@ function registerTools(server, client) {
   );
   server.tool(
     "update_endpoint",
-    "Update an endpoint name, mock response, conditional response rules, signing configuration, or whether codes and links are picked out of its emails.",
+    "Update an endpoint name, mock response, conditional response rules, signing configuration, whether codes and links are picked out of its emails, or the named fields picked out of them.",
     {
       slug: import_zod2.z.string().describe("The endpoint slug to update"),
       name: import_zod2.z.string().optional().describe("New display name"),
@@ -929,7 +1047,17 @@ function registerTools(server, client) {
       signingHeader: import_zod2.z.string().nullable().optional().describe(
         "Custom signature header name (only for generic-hmac provider), or null to clear"
       ),
-      showEmailExtracts: import_zod2.z.boolean().optional().describe("Pick codes and links out of emails (dashboard and forwarded JSON). Owner only.")
+      showEmailExtracts: import_zod2.z.boolean().optional().describe("Pick codes and links out of emails (dashboard and forwarded JSON). Owner only."),
+      emailFields: import_zod2.z.array(
+        import_zod2.z.object({
+          name: import_zod2.z.string().describe("Letters, digits and _, starting with a letter: {{ fields.name }}"),
+          from: import_zod2.z.enum(["subject", "text", "html", "from", "to", "header"]).describe("What it reads; html is the HTML as text"),
+          header: import_zod2.z.string().optional().describe('The header name, for from "header"'),
+          pattern: import_zod2.z.string().describe("RE2 regular expression; the first group is the value (no lookarounds)")
+        })
+      ).max(20).nullable().optional().describe(
+        "Named fields picked out of every email: shown with it, `fields` in its JSON, read by forwarding templates and filters (email_field). Replaces the list; null or [] removes them. Owner only."
+      )
     },
     withErrorHandling(
       async ({
@@ -941,7 +1069,8 @@ function registerTools(server, client) {
         signingProvider,
         signingSecret,
         signingHeader,
-        showEmailExtracts
+        showEmailExtracts,
+        emailFields
       }) => {
         const endpoint = await client.endpoints.update(slug, {
           name,
@@ -951,12 +1080,33 @@ function registerTools(server, client) {
           signingProvider,
           signingSecret,
           signingHeader,
-          showEmailExtracts
+          showEmailExtracts,
+          emailFields
         });
         return jsonContent(endpoint);
       }
     )
   );
+  server.tool(
+    "preview_response",
+    "Dry run of an endpoint's responses: which response rule answers a captured request, and the response with its {{ placeholders }} filled in, exactly as the receiver would send it. Nothing is sent. Pass mockResponse or responseRules to try settings before saving them with update_endpoint.",
+    {
+      slug: import_zod2.z.string().describe("The endpoint slug"),
+      requestId: import_zod2.z.string().optional().describe(
+        "A captured request on the endpoint (default: the newest HTTP request, or a sample)"
+      ),
+      mockResponse: mockResponseSchema.nullable().optional().describe("Try this default response instead of the saved one (null: none)"),
+      responseRules: responseRulesSchema.nullable().optional().describe("Try these rules instead of the saved ones (null: none)")
+    },
+    withErrorHandling(async ({ slug, requestId, mockResponse, responseRules }) => {
+      const preview = await client.endpoints.previewResponse(slug, {
+        ...requestId ? { requestId } : {},
+        ...mockResponse !== void 0 ? { mockResponse } : {},
+        ...responseRules !== void 0 ? { responseRules } : {}
+      });
+      return jsonContent(preview);
+    })
+  );
   server.tool(
     "delete_endpoint",
     "Delete a webhook endpoint and all its captured requests.",
@@ -1172,6 +1322,39 @@ function registerTools(server, client) {
       });
     })
   );
+  server.tool(
+    "render_email",
+    "A captured email in the shape an inbound mail provider posts it (postmark, sendgrid, mailgun, cloudmailin), to test the inbound handler you wrote for that provider against real mail. Returns the method, headers and body; with targetUrl (your local handler), posts it there and returns the answer. A Mailgun form is signed when you pass the signing key your handler checks.",
+    {
+      requestId: import_zod2.z.string().describe("The captured email's request ID"),
+      format: import_zod2.z.enum(["postmark", "sendgrid", "mailgun", "cloudmailin", "json"]).describe("Whose shape; json is webhooks.cc's own email.received JSON (unsigned)"),
+      mailgunSigningKey: import_zod2.z.string().optional().describe("For mailgun: the signing key your handler verifies with (a test key)"),
+      targetUrl: httpUrlSchema.optional().describe("Post it here, e.g. http://localhost:3000/api/inbound/postmark")
+    },
+    withErrorHandling(async ({ requestId, format, mailgunSigningKey, targetUrl }) => {
+      const rendered = await client.emails.render(requestId, {
+        format,
+        ...mailgunSigningKey ? { mailgunSigningKey } : {}
+      });
+      if (!targetUrl) {
+        return jsonContent(
+          shrinkRendered(rendered, MAX_BODY_SIZE)
+        );
+      }
+      const response = await fetch(targetUrl, {
+        method: "POST",
+        headers: { "content-type": rendered.headers["content-type"] },
+        body: rendered.body,
+        redirect: "manual"
+      });
+      return jsonContent({
+        format,
+        status: response.status,
+        statusText: response.statusText,
+        body: await readBodyTruncated(response)
+      });
+    })
+  );
   server.tool(
     "compare_requests",
     "Compare two captured requests and show the structured differences.",
@@ -1189,6 +1372,15 @@ function registerTools(server, client) {
       return jsonContent(diff);
     })
   );
+  server.tool(
+    "generate_payload_schema",
+    "Generate TypeScript interfaces, Zod schemas, Pydantic models, or JSON Schema from captured request bodies. Several requests of one event teach which fields are optional or nullable, so filter with event (or pass requestIds) and write the result into the codebase instead of hand-typing the payload.",
+    payloadSchemaShape,
+    withErrorHandling(async ({ endpointSlug, requestIds, limit, ...args2 }) => {
+      const requests = requestIds ? await Promise.all(requestIds.map((id) => client.requests.get(id))) : await client.requests.list(endpointSlug, { limit, kind: "http" });
+      return payloadSchemaResult(requests, args2);
+    })
+  );
   server.tool(
     "extract_from_request",
     "Extract specific JSON fields from a captured request body.",
@@ -1546,9 +1738,79 @@ function registerTools(server, client) {
       return jsonContent({ ...result, address: client.emails.address(slug, tag) });
     })
   );
+  server.tool(
+    "list_destinations",
+    "List where an endpoint's captures go: its destinations (up to 10) with their URL, kinds, filter, format, templates and timing, and with summary: true their last 24 hours. Owner only.",
+    {
+      slug: import_zod2.z.string().describe("The endpoint slug"),
+      summary: import_zod2.z.boolean().default(true).describe("Add each destination's last 24 hours")
+    },
+    withErrorHandling(async ({ slug, summary }) => {
+      return jsonContent(await client.destinations.list(slug, { summary }));
+    })
+  );
+  server.tool(
+    "add_destination",
+    "Add a destination for an endpoint's captures: your server (as received or signed JSON), a Slack or Discord channel (chat, optionally your own messageTemplate, throttleSeconds 1 for a heads-up), or a JSON body you shape with bodyTemplate (for Zapier, n8n or your API). filter sends only matching captures; delaySeconds makes it a callback. Each destination gets its own signing secret. Check it with preview_destination before relying on it. Owner only.",
+    {
+      slug: import_zod2.z.string().describe("The endpoint slug"),
+      url: httpUrlSchema.describe("https URL on a public host name, or a Slack or Discord webhook"),
+      ...destinationFields
+    },
+    withErrorHandling(async ({ slug, ...input }) => {
+      return jsonContent(await client.destinations.create(slug, input));
+    })
+  );
+  server.tool(
+    "update_destination",
+    "Change a destination: any of its fields; only the ones you pass change. Owner only.",
+    {
+      slug: import_zod2.z.string().describe("The endpoint slug"),
+      destinationId: import_zod2.z.string().describe("The destination's id (from list_destinations)"),
+      url: httpUrlSchema.optional().describe("A new URL"),
+      ...destinationFields
+    },
+    withErrorHandling(async ({ slug, destinationId, ...input }) => {
+      return jsonContent(await client.destinations.update(slug, destinationId, input));
+    })
+  );
+  server.tool(
+    "remove_destination",
+    "Remove a destination. Deliveries still waiting for it are marked failed; its log stays. Owner only.",
+    {
+      slug: import_zod2.z.string().describe("The endpoint slug"),
+      destinationId: import_zod2.z.string().describe("The destination's id")
+    },
+    withErrorHandling(async ({ slug, destinationId }) => {
+      await client.destinations.delete(slug, destinationId);
+      return textContent(`Destination ${destinationId} removed.`);
+    })
+  );
+  server.tool(
+    "preview_destination",
+    "Dry run of a destination against a captured request: whether its filter lets the request through and the exact request it would send (method, URL, headers, body with placeholders filled in). Nothing is sent. Use destinationId for a saved destination, destination for unsaved fields (on top of the saved ones, or with a url on their own), or both.",
+    {
+      slug: import_zod2.z.string().describe("The endpoint slug"),
+      destinationId: import_zod2.z.string().optional().describe("A saved destination"),
+      destination: import_zod2.z.object({ url: httpUrlSchema.optional(), ...destinationFields }).optional().describe("Unsaved fields to try"),
+      requestId: import_zod2.z.string().optional().describe("A captured request (default: the newest of the kind it takes, or a sample)")
+    },
+    withErrorHandling(async ({ slug, destinationId, destination, requestId }) => {
+      if (!destinationId && !destination?.url) {
+        throw new Error("Pass destinationId, or a destination with a url");
+      }
+      return jsonContent(
+        await client.destinations.preview(slug, {
+          ...destinationId ? { destinationId } : {},
+          ...destination ? { destination } : {},
+          ...requestId ? { requestId } : {}
+        })
+      );
+    })
+  );
   server.tool(
     "configure_forwarding",
-    "Change an endpoint's forwarding: the URL, on or off, which kinds (HTTP requests, emails), the format, your own headers, and the advanced options. Only the arguments you pass change. Owner only. Saving the first URL creates the signing secret. A Slack or Discord webhook URL gets a chat message automatically.",
+    "Change an endpoint's primary forwarding destination (the one the endpoint's forward* fields stand for): the URL, on or off, which kinds, the format, your own headers, and the advanced options. Only the arguments you pass change. Owner only. For several destinations, filters, templates, throttling or delays, use add_destination and update_destination.",
     {
       slug: import_zod2.z.string().describe("The endpoint slug"),
       url: httpUrlSchema.nullable().optional().describe("https URL on a public host name, or null to remove it (forwarding must be off)"),
@@ -1596,23 +1858,32 @@ function registerTools(server, client) {
     "Read (or with rotate: true, replace) the whsec_ secret forwarded deliveries are signed with. Owner only. Treat the value as a credential: put it in the handler's environment, not in code.",
     {
       slug: import_zod2.z.string().describe("The endpoint slug"),
+      destinationId: import_zod2.z.string().optional().describe("A destination (default: the endpoint's primary destination)"),
       rotate: import_zod2.z.boolean().default(false).describe("Replace the secret; every delivery from now on uses the new one")
     },
-    withErrorHandling(async ({ slug, rotate }) => {
-      const secret = rotate ? await client.forwarding.rotateSecret(slug) : await client.forwarding.secret(slug);
+    withErrorHandling(async ({ slug, destinationId, rotate }) => {
+      const secret = destinationId ? rotate ? await client.destinations.rotateSecret(slug, destinationId) : await client.destinations.secret(slug, destinationId) : rotate ? await client.forwarding.rotateSecret(slug) : await client.forwarding.secret(slug);
       return jsonContent({ secret, rotated: rotate });
     })
   );
   server.tool(
     "test_forwarding",
-    "Send the endpoint's newest captured request of a kind (or a sample) to its forwarding URL once, exactly as a delivery would go out, and report the answer. Works with forwarding on or off; nothing is retried or logged.",
+    "Send the endpoint's newest captured request of a kind (or a sample, or requestId) to a destination once, exactly as a delivery would go out, and report the answer. Works whether it is on or off, and whatever its filter says; nothing is retried or logged.",
     {
       slug: import_zod2.z.string().describe("The endpoint slug"),
-      kind: import_zod2.z.enum(["http", "email"]).optional().describe(
-        "Which kind to send (default: http when HTTP requests are forwarded, else email)"
-      )
+      destinationId: import_zod2.z.string().optional().describe("A destination (default: the endpoint's primary destination)"),
+      kind: import_zod2.z.enum(["http", "email"]).optional().describe("Which kind to send (default: http when the destination takes HTTP requests)"),
+      requestId: import_zod2.z.string().optional().describe("With destinationId: a captured request to send")
     },
-    withErrorHandling(async ({ slug, kind }) => {
+    withErrorHandling(async ({ slug, destinationId, kind, requestId }) => {
+      if (destinationId) {
+        return jsonContent(
+          await client.destinations.test(slug, destinationId, {
+            ...kind ? { kind } : {},
+            ...requestId ? { requestId } : {}
+          })
+        );
+      }
       return jsonContent(await client.forwarding.test(slug, kind ? { kind } : {}));
     })
   );
@@ -1623,17 +1894,25 @@ function registerTools(server, client) {
       endpointSlug: import_zod2.z.string().optional().describe("List the endpoint's delivery log"),
       requestId: import_zod2.z.string().optional().describe("List every delivery and try of this request"),
       limit: import_zod2.z.number().int().min(1).max(100).default(20).describe("With endpointSlug: max rows"),
-      status: import_zod2.z.enum(["all", "pending", "failed"]).default("all").describe("With endpointSlug: all, pending (queued or retrying) or failed"),
+      status: import_zod2.z.enum(["all", "pending", "failed", "skipped"]).default("all").describe(
+        "With endpointSlug: all, pending (queued or retrying), failed or skipped (filtered out)"
+      ),
+      destinationId: import_zod2.z.string().optional().describe("With endpointSlug: only this destination"),
       before: import_zod2.z.string().optional().describe("With endpointSlug: a row's cursor, to list older rows")
     },
-    withErrorHandling(async ({ endpointSlug, requestId, limit, status, before }) => {
+    withErrorHandling(async ({ endpointSlug, requestId, limit, status, destinationId, before }) => {
       if (requestId === void 0 === (endpointSlug === void 0)) {
         throw new Error("Pass exactly one of endpointSlug or requestId");
       }
       if (requestId) return jsonContent(await client.forwarding.requestDeliveries(requestId));
       const [summary, deliveries] = await Promise.all([
         client.forwarding.summary(endpointSlug),
-        client.forwarding.deliveries(endpointSlug, { limit, status, before })
+        client.forwarding.deliveries(endpointSlug, {
+          limit,
+          status,
+          before,
+          ...destinationId ? { destinationId } : {}
+        })
       ]);
       return jsonContent({
         summary,
@@ -1644,17 +1923,19 @@ function registerTools(server, client) {
   );
   server.tool(
     "redeliver",
-    "Forward again with the endpoint's current settings: one captured request or email (requestId; it also sends one that was never forwarded), or every request whose latest delivery failed (endpointSlug, oldest first, up to 1,000 at a time). Owner only; fails while forwarding is off.",
+    "Forward again with the current settings: one captured request or email (requestId; to every destination that takes it, or with destinationId to that one whatever its filter says), or every request whose latest delivery failed (endpointSlug, optionally only destinationId, oldest first, up to 1,000 at a time per destination). Owner only.",
     {
       requestId: import_zod2.z.string().optional().describe("The request or email to send again"),
-      endpointSlug: import_zod2.z.string().optional().describe("Send every failed delivery of this endpoint again")
+      endpointSlug: import_zod2.z.string().optional().describe("Send every failed delivery of this endpoint again"),
+      destinationId: import_zod2.z.string().optional().describe("Only this destination")
     },
-    withErrorHandling(async ({ requestId, endpointSlug }) => {
+    withErrorHandling(async ({ requestId, endpointSlug, destinationId }) => {
       if (requestId === void 0 === (endpointSlug === void 0)) {
         throw new Error("Pass exactly one of requestId or endpointSlug");
       }
+      const options = destinationId ? { destinationId } : {};
       return jsonContent(
-        requestId ? await client.forwarding.redeliver(requestId) : await client.forwarding.redeliverFailed(endpointSlug)
+        requestId ? await client.forwarding.redeliver(requestId, options) : await client.forwarding.redeliverFailed(endpointSlug, options)
       );
     })
   );
@@ -1879,6 +2160,18 @@ function registerSandboxTools(server, options = {}) {
       })
     )
   );
+  registered.push(
+    server.tool(
+      "generate_payload_schema",
+      "Generate TypeScript interfaces, Zod schemas, Pydantic models, or JSON Schema from the bodies of requests captured by a sandbox endpoint. Several requests of one event teach which fields are optional or nullable.",
+      payloadSchemaShape,
+      withErrorHandling(async ({ endpointSlug, requestIds, limit, ...args2 }) => {
+        const sandbox = await session.requireSandbox();
+        const requests = requestIds ? await Promise.all(requestIds.map((id) => sandbox.requests.get(id))) : await sandbox.requests.list(endpointSlug, { limit });
+        return payloadSchemaResult(requests, args2);
+      })
+    )
+  );
   registered.push(
     server.tool(
       "connect_account",
@@ -2034,7 +2327,7 @@ function registerSandboxTools(server, options = {}) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.12.1" : "0.0.0-dev";
+var VERSION = true ? "1.14.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const webhookUrl = options.webhookUrl ?? process.env.WHK_WEBHOOK_URL;
@@ -2255,7 +2548,7 @@ function runSetup(args2) {
   const apiKey = resolveApiKey(flags);
   if (!apiKey) {
     console.error("Error: API key required. Pass --api-key or set WHK_API_KEY env var.");
-    console.error("Get your API key at https://webhooks.cc/account\n");
+    console.error("Get your API key at https://webhooks.cc/account/api-keys\n");
     process.exit(1);
   }
   validateApiKeyFormat(apiKey);
@@ -2310,7 +2603,7 @@ Setup:
   npx @webhooks-cc/mcp setup windsurf --api-key whcc_...
   npx @webhooks-cc/mcp setup claude-desktop --api-key whcc_...
 
-Get your API key at https://webhooks.cc/account
+Get your API key at https://webhooks.cc/account/api-keys
 `);
 } else if (command && command !== "--") {
   console.error(`Unknown command: "${command}". Run with --help for usage.`);