@webhooks-cc/mcp 1.16.0 → 1.18.0

package/README.md

@@ -34,7 +34,7 @@ For other agents, `npx skills add kroqdotdev/webhooks-cc` installs the same skil
 - **claude.ai and Claude Desktop**: Settings, Connectors, add a custom connector with the URL `https://webhooks.cc/mcp`
 - **ChatGPT**: add it as a custom connector (developer mode)
 
-A client that can send headers may use an API key instead: `Authorization: Bearer whcc_...`. The remote server has 45 tools: `send_to` and `replay_request` are left out and `targetUrl` is refused, because a hosted server cannot reach your machine, and waits are capped at 50 seconds. It needs an account (no sandbox), and serves tools only, without prompts or resources.
+A client that can send headers may use an API key instead: `Authorization: Bearer whcc_...`. The remote server has 54 tools: `send_to`, `replay_request` and `share_port` are left out and `targetUrl` is refused, because a hosted server cannot reach your machine, and waits are capped at 50 seconds. It needs an account (no sandbox), and serves tools only, without prompts or resources.
 
 ### One-click
 
@@ -83,13 +83,14 @@ Leave out `env` to start without a key. Get your API key at [webhooks.cc/account
 
 ## What it exposes
 
-The server exposes `47` tools, `3` prompts, and `3` resource surfaces with an API key, the same `47` tools and the prompts with a saved connection, and `11` sandbox tools otherwise. The remote server exposes `45` tools.
+The server exposes `57` tools, `3` prompts, and `3` resource surfaces with an API key, the same `57` tools and the prompts with a saved connection, and `11` sandbox tools otherwise. The remote server exposes `54` tools.
 
 ### Endpoint tools
 
 - `create_endpoint`
 - `list_endpoints`
 - `get_endpoint`
+- `favorite_endpoint` (mark or unmark one of your favourites; `list_endpoints` and `get_endpoint` show `favorite`)
 - `update_endpoint`
 - `preview_response`
 - `delete_endpoint`
@@ -154,6 +155,17 @@ retried and logged (owner only):
 
 Endpoints shared with you already appear in `list_endpoints` (with `fromTeam`) and work with every request tool except `clear_requests`, which stays with the owner. Invites are not exposed: accepting one claims a paid seat.
 
+### Sharing tools
+
+- `share_port`: shares a local port at a `https://<name>.sharehooks.cc` link by running `whk share` (local server only; needs [whk](https://webhooks.cc/installation) installed, or `WHK_PATH` naming it). The share runs until `stop_share`, the plan's session limit, or the end of the server. Free shares get a random name ending in `-free`, two hours, and a notice page before the site; Pro and Business can pass a reserved `name` and a `password`.
+- `list_shares`: running and recent previews and live tunnels, this month's shared data, the plan's sharing limits, and `hints` with the next step (the server's own in tool names, plus slots or data running out).
+- `stop_share`: stops a preview or live tunnel, and says whether it had already ended.
+- `share_requests`: the last requests visitors made to a running preview (no addresses).
+- `list_names`, `reserve_name` (optionally inside a team), `release_name`: reserved preview names (Pro and Business).
+- `set_name_password`, `clear_name_password`: the password visitors need for every preview under a name. The password is never echoed back.
+
+Everything the dashboard's Shares page does is here, so an agent never needs it; only `share_port` needs the local server.
+
 ### Discovery and account tools
 
 - `list_provider_templates`

package/dist/bin/mcp.js

@@ -158,6 +158,15 @@ function omitHeaders(holder) {
   holder.headers = {};
   holder.headersOmitted = `${count} headers left out to fit the output`;
 }
+function trimAuth(holder) {
+  const auth = holder.auth;
+  if (auth && typeof auth === "object" && !Array.isArray(auth)) {
+    const verdicts = { ...auth };
+    delete verdicts.setup;
+    delete verdicts.authenticationResults;
+    holder.auth = verdicts;
+  }
+}
 function trimSpam(holder) {
   const spam = holder.spam;
   if (spam && typeof spam === "object" && !Array.isArray(spam)) {
@@ -305,6 +314,7 @@ function compactRequest(request) {
   shrinkToFit(root, budget, [
     () => trimParsed(compact),
     () => omitHeaders(compact),
+    () => trimAuth(email),
     () => trimSpam(email),
     () => capLists(email),
     () => cutStringToFit(root, email, "text", "textTruncated", budget, TEXT_FLOOR),
@@ -445,6 +455,10 @@ function registerResources(server, client) {
 var import_zod3 = require("zod");
 var import_sdk2 = require("@webhooks-cc/sdk");
 
+// src/version.ts
+var VERSION = true ? "1.18.0" : "0.0.0-dev";
+var MCP_USER_AGENT = `webhooks-cc-mcp/${VERSION}`;
+
 // src/tools.ts
 var import_zod2 = require("zod");
 var import_sdk = require("@webhooks-cc/sdk");
@@ -996,7 +1010,7 @@ function emailDetail(client, email, view, includeHtml) {
   ]);
   return detail;
 }
-var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request"]);
+var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request", "share_port"]);
 var TARGET_URL_TOOLS = /* @__PURE__ */ new Set(["render_email", "test_webhook_flow"]);
 var REMOTE_MAX_WAIT_MS = 5e4;
 var REMOTE_MIN_POLL_MS = 1e3;
@@ -1054,9 +1068,78 @@ function toolTarget(target, remote, handles) {
     }
   };
 }
+function shareSummary(live) {
+  const notes = [];
+  if (live.notice) {
+    notes.push(
+      "The first time each browser opens the link, it sees a short notice from webhooks.cc and clicks Open the preview (Free, and paid accounts in their first 7 days)."
+    );
+  }
+  if (live.password) notes.push("Visitors need the password.");
+  if (live.expiresAt) {
+    notes.push(
+      `The plan stops this share at ${live.expiresAt}; reconnecting does not extend it, and starting it again gives a new link.`
+    );
+  }
+  notes.push("It runs until stop_share or the end of this MCP server.");
+  return {
+    url: live.url,
+    name: live.name,
+    port: live.port,
+    expiresAt: live.expiresAt,
+    notice: live.notice,
+    password: live.password,
+    notes: notes.join(" ")
+  };
+}
+var REMOTE_SHARE = "`whk share <port>` on the person's computer (or the local MCP server, npx -y @webhooks-cc/mcp, which has share_port)";
+function shareHints(list, remote = false) {
+  const start = remote ? REMOTE_SHARE : "share_port";
+  const hints = [];
+  const limits = list.limits;
+  const usage = list.usage;
+  const previews = list.shares.filter((s) => s.kind !== "live" && !s.endedAt && s.mine !== false);
+  if (usage?.over) {
+    hints.push(
+      `This month's shared data is used up, so previews are paused until ${usage.resetsAt}. A larger plan (Pro 25 GB, Business 150 GB) raises it; the person upgrades on webhooks.cc.`
+    );
+  }
+  if (limits && previews.length >= limits.shares) {
+    hints.push(
+      `All ${limits.shares} of the plan's preview slots are in use: stop one with stop_share (its id is in shares) before ${start}.`
+    );
+  }
+  if (limits && limits.sessionMinutes) {
+    hints.push(
+      `Previews on this plan stop after ${limits.sessionMinutes} minutes; ${start} again gives a new link.`
+    );
+  }
+  if (limits && !limits.passwords) {
+    hints.push("Passwords and reserved names come with Pro and Business.");
+  }
+  return hints;
+}
+function toolWords(hint, remote = false) {
+  const words = hint.replace(/whk shares stop(?: <[^>]*>)?/g, "stop_share").replace(/whk shares (?:ls|list)/g, "list_shares").replace(/whk shares log(?: <[^>]*>)?/g, "share_requests").replace(/whk names reserve(?: <[^>]*>)?(?: --team <[^>]*>)?/g, "reserve_name").replace(/whk names release(?: <[^>]*>)?/g, "release_name").replace(/whk names password(?: <[^>]*>)? --clear/g, "clear_name_password").replace(/whk names password(?: <[^>]*>)?/g, "set_name_password").replace(/whk names ls/g, "list_names");
+  if (remote) return words;
+  return words.replace(/whk share <port> --password/g, "share_port with a password").replace(/whk share <port>/g, "share_port");
+}
+function withShareHints(list, remote = false) {
+  const server = (list.hints ?? []).map((h) => toolWords(h, remote));
+  const ours = shareHints(list, remote);
+  if (list.suspended && !server.some((h) => /suspended/i.test(h))) {
+    ours.unshift(
+      `Sharing is suspended on this account: ${remote ? "new previews are" : "share_port is"} refused. The person can write to support@webhooks.cc.`
+    );
+  }
+  const hints = [.../* @__PURE__ */ new Set([...server, ...ours])];
+  return hints.length > 0 ? { ...list, hints } : { ...list };
+}
 function registerTools(target, client, options = {}) {
   const handles = [];
-  const server = toolTarget(target, options.remote === true, handles);
+  const remote = options.remote === true;
+  const server = toolTarget(target, remote, handles);
+  const shareWith = remote ? REMOTE_SHARE : "share_port";
   server.tool(
     "create_endpoint",
     "Create a webhook endpoint. Returns the endpoint slug, URL, and metadata.",
@@ -1177,6 +1260,18 @@ function registerTools(target, client, options = {}) {
       return jsonContent(endpoint);
     })
   );
+  server.tool(
+    "favorite_endpoint",
+    "Mark an endpoint as one of your favourites, or unmark it with favorite: false. A favourite is your own choice, so endpoints shared with you through teams can be marked too; list_endpoints and get_endpoint show it as favorite. Idempotent.",
+    {
+      slug: import_zod2.z.string().describe("The endpoint slug"),
+      favorite: import_zod2.z.boolean().optional().describe("true marks it as a favourite (the default), false unmarks it")
+    },
+    withErrorHandling(async ({ slug, favorite }) => {
+      const result = favorite === false ? await client.endpoints.unfavorite(slug) : await client.endpoints.favorite(slug);
+      return jsonContent({ slug, favorite: result.favorite });
+    })
+  );
   server.tool(
     "update_endpoint",
     "Update an endpoint name, mock response, conditional response rules, signing configuration, whether codes and links are picked out of its emails, or the named fields picked out of them.",
@@ -2105,6 +2200,143 @@ function registerTools(target, client, options = {}) {
       );
     })
   );
+  const started = /* @__PURE__ */ new Map();
+  server.tool(
+    "share_port",
+    "Share a port on this computer at a public link (https://<name>.sharehooks.cc) by running the webhooks.cc CLI (whk share), so a person can open the site you are building. Returns the link. It keeps running until stop_share, the plan's session limit, or the end of this MCP server. Asking again for the same port without a name or password returns the running link; with a name or password, the running share on that port stops and a new one starts. Free accounts get a random name ending in -free, a 2-hour limit and a notice page before the site; Pro and Business can use a reserved name and a password. Needs whk installed on this computer. For a webhook provider that must get your local app's real answer, use `whk tunnel <port> --live` instead.",
+    {
+      port: import_zod2.z.number().int().min(1).max(65535).describe("The local port the site runs on"),
+      name: import_zod2.z.string().optional().describe("A name you reserved (Pro and Business); leave out for a random one"),
+      password: import_zod2.z.string().min(8).max(200).optional().describe("What visitors must type (Pro and Business), 8 to 200 characters")
+    },
+    withErrorHandling(async ({ port, name, password }) => {
+      const running = started.get(port);
+      if (running && !name && !password) {
+        return jsonContent({ ...shareSummary(running), alreadyRunning: true });
+      }
+      if (running) {
+        started.delete(port);
+        await running.stop();
+      }
+      let live;
+      try {
+        live = await client.shares.start({
+          port,
+          ...name ? { name } : {},
+          ...password ? { password } : {},
+          ...process.env.WHK_PATH ? { whkPath: process.env.WHK_PATH } : {}
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `${message} With these tools: list_shares shows what runs and the plan's limits, stop_share frees a slot, list_names shows the names you can use.`
+        );
+      }
+      started.set(port, live);
+      void live.closed.then(() => {
+        if (started.get(port) === live) started.delete(port);
+      });
+      const summary = shareSummary(live);
+      try {
+        const list = await client.shares.list({ state: "live" });
+        summary.limits = list.limits;
+        summary.usage = list.usage;
+        const hints = shareHints(list);
+        if (hints.length > 0) summary.hints = hints;
+      } catch {
+      }
+      return jsonContent(summary);
+    })
+  );
+  server.tool(
+    "list_shares",
+    `List your public previews of local ports (whk share${remote ? "" : ", share_port"}) and live tunnels (whk tunnel --live): live ones first, then the latest that ended, with this month's shared data and your plan's sharing limits. Not the same as share_endpoint, which shares an endpoint with a team.`,
+    {
+      state: import_zod2.z.enum(["live", "ended"]).optional().describe("Only the running ones, or only the ended ones")
+    },
+    withErrorHandling(async ({ state }) => {
+      return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
+    })
+  );
+  server.tool(
+    "stop_share",
+    "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",
+    {
+      id: import_zod2.z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      const result = await client.shares.stop(id);
+      return jsonContent({
+        id,
+        stopped: result.stopped,
+        edgeReached: result.edgeReached,
+        note: result.stopped ? result.edgeReached ? "Stopped; its CLI was told and exits." : "Stopped; the edge could not be told at once, so it ends within half a minute." : "It had already ended."
+      });
+    })
+  );
+  server.tool(
+    "share_requests",
+    "The last requests visitors made to a running preview (from list_shares), newest first: method, path, status, time, size, country, device and a number per visitor, never an address. Use it to see whether the person opened the link and what failed for them. `available` is false when the log could not be read just now.",
+    {
+      id: import_zod2.z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      return jsonContent(await client.shares.requests(id));
+    })
+  );
+  server.tool(
+    "list_names",
+    `List the reserved preview names you can share under (Pro and Business): your own and your teams', each with its link, whether it has a password, whether a preview runs under it now, and whether your plan still covers it (usable). Includes how many your plan allows and how many you hold. Share under one with ${remote ? "`whk share <port> --name <name>` on the person's computer (or the local MCP server's share_port)" : "share_port and its name"}.`,
+    {},
+    withErrorHandling(async () => {
+      return jsonContent(await client.names.list());
+    })
+  );
+  server.tool(
+    "reserve_name",
+    `Reserve a preview name, so ${shareWith} can use the link https://<name>.sharehooks.cc (Pro and Business). Lowercase letters, digits and dashes; names that look like random ones or end in -free are refused. With team, the name belongs to that team and every member may share under it.`,
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name: lowercase letters, digits and dashes"),
+      team: import_zod2.z.string().optional().describe("A team's id or name (from list_teams), to keep the name inside that team")
+    },
+    withErrorHandling(async ({ name, team }) => {
+      return jsonContent(await client.names.reserve(name, team ? { team } : {}));
+    })
+  );
+  server.tool(
+    "release_name",
+    "Release a reserved preview name you kept (or, for a team name, as the team's owner). A preview running under it stops, and the link stops working.",
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.release(name);
+      return jsonContent({ released: name });
+    })
+  );
+  server.tool(
+    "set_name_password",
+    "Put a password on every preview under a reserved name (Pro and Business): visitors must type it before the page opens. The password is not shown back; give it to the person yourself.",
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names"),
+      password: import_zod2.z.string().min(8).max(200).describe("What visitors must type, 8 to 200 characters")
+    },
+    withErrorHandling(async ({ name, password }) => {
+      await client.names.setPassword(name, password);
+      return jsonContent({ name, password: true });
+    })
+  );
+  server.tool(
+    "clear_name_password",
+    "Take the password off a reserved name, so its previews open without one.",
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.clearPassword(name);
+      return jsonContent({ name, password: false });
+    })
+  );
   server.tool(
     "describe",
     "Describe all available SDK operations, parameters, and types.",
@@ -2149,7 +2381,8 @@ var AgentSession = class {
       baseUrl: this.baseUrl,
       webhookUrl: this.webhookUrl,
       clientName: this.clientName,
-      credentialsFile: this.credentialsFile
+      credentialsFile: this.credentialsFile,
+      userAgent: MCP_USER_AGENT
     };
   }
   /**
@@ -2242,6 +2475,7 @@ function registerSandboxTools(server, options = {}) {
     baseUrl,
     webhookUrl,
     credentialsFile: options.credentialsFile,
+    userAgent: MCP_USER_AGENT,
     // The human disconnected the agent: back to the sandbox, unless a
     // newer connection is already on display.
     onRevoked: () => queueMicrotask(() => {
@@ -2403,7 +2637,8 @@ function sandboxToolSet(server, session, showAccount) {
             webhookUrl: session.webhookUrl,
             email: normalized,
             clientName: session.clientName,
-            credentialsFile: session.credentialsFile
+            credentialsFile: session.credentialsFile,
+            userAgent: MCP_USER_AGENT
           }));
           session.connect = { via: "connect", pending, email: normalized };
           attempt = pending;
@@ -2509,7 +2744,6 @@ function sandboxToolSet(server, session, showAccount) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.16.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const webhookUrl = options.webhookUrl ?? process.env.WHK_WEBHOOK_URL;
@@ -2524,7 +2758,7 @@ function createServer(options = {}) {
     registerPrompts(server);
     return server;
   }
-  const client = new import_sdk3.WebhooksCC({ apiKey, webhookUrl, baseUrl });
+  const client = new import_sdk3.WebhooksCC({ apiKey, webhookUrl, baseUrl, userAgent: MCP_USER_AGENT });
   registerTools(server, client);
   registerPrompts(server);
   registerResources(server, client);

package/dist/{chunk-4LEPLCW5.mjs → chunk-GTEE7L2Y.mjs}

@@ -67,6 +67,15 @@ function omitHeaders(holder) {
   holder.headers = {};
   holder.headersOmitted = `${count} headers left out to fit the output`;
 }
+function trimAuth(holder) {
+  const auth = holder.auth;
+  if (auth && typeof auth === "object" && !Array.isArray(auth)) {
+    const verdicts = { ...auth };
+    delete verdicts.setup;
+    delete verdicts.authenticationResults;
+    holder.auth = verdicts;
+  }
+}
 function trimSpam(holder) {
   const spam = holder.spam;
   if (spam && typeof spam === "object" && !Array.isArray(spam)) {
@@ -214,6 +223,7 @@ function compactRequest(request) {
   shrinkToFit(root, budget, [
     () => trimParsed(compact),
     () => omitHeaders(compact),
+    () => trimAuth(email),
     () => trimSpam(email),
     () => capLists(email),
     () => cutStringToFit(root, email, "text", "textTruncated", budget, TEXT_FLOOR),
@@ -778,7 +788,7 @@ function emailDetail(client, email, view, includeHtml) {
   ]);
   return detail;
 }
-var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request"]);
+var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request", "share_port"]);
 var TARGET_URL_TOOLS = /* @__PURE__ */ new Set(["render_email", "test_webhook_flow"]);
 var REMOTE_MAX_WAIT_MS = 5e4;
 var REMOTE_MIN_POLL_MS = 1e3;
@@ -836,9 +846,78 @@ function toolTarget(target, remote, handles) {
     }
   };
 }
+function shareSummary(live) {
+  const notes = [];
+  if (live.notice) {
+    notes.push(
+      "The first time each browser opens the link, it sees a short notice from webhooks.cc and clicks Open the preview (Free, and paid accounts in their first 7 days)."
+    );
+  }
+  if (live.password) notes.push("Visitors need the password.");
+  if (live.expiresAt) {
+    notes.push(
+      `The plan stops this share at ${live.expiresAt}; reconnecting does not extend it, and starting it again gives a new link.`
+    );
+  }
+  notes.push("It runs until stop_share or the end of this MCP server.");
+  return {
+    url: live.url,
+    name: live.name,
+    port: live.port,
+    expiresAt: live.expiresAt,
+    notice: live.notice,
+    password: live.password,
+    notes: notes.join(" ")
+  };
+}
+var REMOTE_SHARE = "`whk share <port>` on the person's computer (or the local MCP server, npx -y @webhooks-cc/mcp, which has share_port)";
+function shareHints(list, remote = false) {
+  const start = remote ? REMOTE_SHARE : "share_port";
+  const hints = [];
+  const limits = list.limits;
+  const usage = list.usage;
+  const previews = list.shares.filter((s) => s.kind !== "live" && !s.endedAt && s.mine !== false);
+  if (usage?.over) {
+    hints.push(
+      `This month's shared data is used up, so previews are paused until ${usage.resetsAt}. A larger plan (Pro 25 GB, Business 150 GB) raises it; the person upgrades on webhooks.cc.`
+    );
+  }
+  if (limits && previews.length >= limits.shares) {
+    hints.push(
+      `All ${limits.shares} of the plan's preview slots are in use: stop one with stop_share (its id is in shares) before ${start}.`
+    );
+  }
+  if (limits && limits.sessionMinutes) {
+    hints.push(
+      `Previews on this plan stop after ${limits.sessionMinutes} minutes; ${start} again gives a new link.`
+    );
+  }
+  if (limits && !limits.passwords) {
+    hints.push("Passwords and reserved names come with Pro and Business.");
+  }
+  return hints;
+}
+function toolWords(hint, remote = false) {
+  const words = hint.replace(/whk shares stop(?: <[^>]*>)?/g, "stop_share").replace(/whk shares (?:ls|list)/g, "list_shares").replace(/whk shares log(?: <[^>]*>)?/g, "share_requests").replace(/whk names reserve(?: <[^>]*>)?(?: --team <[^>]*>)?/g, "reserve_name").replace(/whk names release(?: <[^>]*>)?/g, "release_name").replace(/whk names password(?: <[^>]*>)? --clear/g, "clear_name_password").replace(/whk names password(?: <[^>]*>)?/g, "set_name_password").replace(/whk names ls/g, "list_names");
+  if (remote) return words;
+  return words.replace(/whk share <port> --password/g, "share_port with a password").replace(/whk share <port>/g, "share_port");
+}
+function withShareHints(list, remote = false) {
+  const server = (list.hints ?? []).map((h) => toolWords(h, remote));
+  const ours = shareHints(list, remote);
+  if (list.suspended && !server.some((h) => /suspended/i.test(h))) {
+    ours.unshift(
+      `Sharing is suspended on this account: ${remote ? "new previews are" : "share_port is"} refused. The person can write to support@webhooks.cc.`
+    );
+  }
+  const hints = [.../* @__PURE__ */ new Set([...server, ...ours])];
+  return hints.length > 0 ? { ...list, hints } : { ...list };
+}
 function registerTools(target, client, options = {}) {
   const handles = [];
-  const server = toolTarget(target, options.remote === true, handles);
+  const remote = options.remote === true;
+  const server = toolTarget(target, remote, handles);
+  const shareWith = remote ? REMOTE_SHARE : "share_port";
   server.tool(
     "create_endpoint",
     "Create a webhook endpoint. Returns the endpoint slug, URL, and metadata.",
@@ -959,6 +1038,18 @@ function registerTools(target, client, options = {}) {
       return jsonContent(endpoint);
     })
   );
+  server.tool(
+    "favorite_endpoint",
+    "Mark an endpoint as one of your favourites, or unmark it with favorite: false. A favourite is your own choice, so endpoints shared with you through teams can be marked too; list_endpoints and get_endpoint show it as favorite. Idempotent.",
+    {
+      slug: z.string().describe("The endpoint slug"),
+      favorite: z.boolean().optional().describe("true marks it as a favourite (the default), false unmarks it")
+    },
+    withErrorHandling(async ({ slug, favorite }) => {
+      const result = favorite === false ? await client.endpoints.unfavorite(slug) : await client.endpoints.favorite(slug);
+      return jsonContent({ slug, favorite: result.favorite });
+    })
+  );
   server.tool(
     "update_endpoint",
     "Update an endpoint name, mock response, conditional response rules, signing configuration, whether codes and links are picked out of its emails, or the named fields picked out of them.",
@@ -1887,6 +1978,143 @@ function registerTools(target, client, options = {}) {
       );
     })
   );
+  const started = /* @__PURE__ */ new Map();
+  server.tool(
+    "share_port",
+    "Share a port on this computer at a public link (https://<name>.sharehooks.cc) by running the webhooks.cc CLI (whk share), so a person can open the site you are building. Returns the link. It keeps running until stop_share, the plan's session limit, or the end of this MCP server. Asking again for the same port without a name or password returns the running link; with a name or password, the running share on that port stops and a new one starts. Free accounts get a random name ending in -free, a 2-hour limit and a notice page before the site; Pro and Business can use a reserved name and a password. Needs whk installed on this computer. For a webhook provider that must get your local app's real answer, use `whk tunnel <port> --live` instead.",
+    {
+      port: z.number().int().min(1).max(65535).describe("The local port the site runs on"),
+      name: z.string().optional().describe("A name you reserved (Pro and Business); leave out for a random one"),
+      password: z.string().min(8).max(200).optional().describe("What visitors must type (Pro and Business), 8 to 200 characters")
+    },
+    withErrorHandling(async ({ port, name, password }) => {
+      const running = started.get(port);
+      if (running && !name && !password) {
+        return jsonContent({ ...shareSummary(running), alreadyRunning: true });
+      }
+      if (running) {
+        started.delete(port);
+        await running.stop();
+      }
+      let live;
+      try {
+        live = await client.shares.start({
+          port,
+          ...name ? { name } : {},
+          ...password ? { password } : {},
+          ...process.env.WHK_PATH ? { whkPath: process.env.WHK_PATH } : {}
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `${message} With these tools: list_shares shows what runs and the plan's limits, stop_share frees a slot, list_names shows the names you can use.`
+        );
+      }
+      started.set(port, live);
+      void live.closed.then(() => {
+        if (started.get(port) === live) started.delete(port);
+      });
+      const summary = shareSummary(live);
+      try {
+        const list = await client.shares.list({ state: "live" });
+        summary.limits = list.limits;
+        summary.usage = list.usage;
+        const hints = shareHints(list);
+        if (hints.length > 0) summary.hints = hints;
+      } catch {
+      }
+      return jsonContent(summary);
+    })
+  );
+  server.tool(
+    "list_shares",
+    `List your public previews of local ports (whk share${remote ? "" : ", share_port"}) and live tunnels (whk tunnel --live): live ones first, then the latest that ended, with this month's shared data and your plan's sharing limits. Not the same as share_endpoint, which shares an endpoint with a team.`,
+    {
+      state: z.enum(["live", "ended"]).optional().describe("Only the running ones, or only the ended ones")
+    },
+    withErrorHandling(async ({ state }) => {
+      return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
+    })
+  );
+  server.tool(
+    "stop_share",
+    "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",
+    {
+      id: z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      const result = await client.shares.stop(id);
+      return jsonContent({
+        id,
+        stopped: result.stopped,
+        edgeReached: result.edgeReached,
+        note: result.stopped ? result.edgeReached ? "Stopped; its CLI was told and exits." : "Stopped; the edge could not be told at once, so it ends within half a minute." : "It had already ended."
+      });
+    })
+  );
+  server.tool(
+    "share_requests",
+    "The last requests visitors made to a running preview (from list_shares), newest first: method, path, status, time, size, country, device and a number per visitor, never an address. Use it to see whether the person opened the link and what failed for them. `available` is false when the log could not be read just now.",
+    {
+      id: z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      return jsonContent(await client.shares.requests(id));
+    })
+  );
+  server.tool(
+    "list_names",
+    `List the reserved preview names you can share under (Pro and Business): your own and your teams', each with its link, whether it has a password, whether a preview runs under it now, and whether your plan still covers it (usable). Includes how many your plan allows and how many you hold. Share under one with ${remote ? "`whk share <port> --name <name>` on the person's computer (or the local MCP server's share_port)" : "share_port and its name"}.`,
+    {},
+    withErrorHandling(async () => {
+      return jsonContent(await client.names.list());
+    })
+  );
+  server.tool(
+    "reserve_name",
+    `Reserve a preview name, so ${shareWith} can use the link https://<name>.sharehooks.cc (Pro and Business). Lowercase letters, digits and dashes; names that look like random ones or end in -free are refused. With team, the name belongs to that team and every member may share under it.`,
+    {
+      name: z.string().min(1).max(63).describe("The name: lowercase letters, digits and dashes"),
+      team: z.string().optional().describe("A team's id or name (from list_teams), to keep the name inside that team")
+    },
+    withErrorHandling(async ({ name, team }) => {
+      return jsonContent(await client.names.reserve(name, team ? { team } : {}));
+    })
+  );
+  server.tool(
+    "release_name",
+    "Release a reserved preview name you kept (or, for a team name, as the team's owner). A preview running under it stops, and the link stops working.",
+    {
+      name: z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.release(name);
+      return jsonContent({ released: name });
+    })
+  );
+  server.tool(
+    "set_name_password",
+    "Put a password on every preview under a reserved name (Pro and Business): visitors must type it before the page opens. The password is not shown back; give it to the person yourself.",
+    {
+      name: z.string().min(1).max(63).describe("The name, from list_names"),
+      password: z.string().min(8).max(200).describe("What visitors must type, 8 to 200 characters")
+    },
+    withErrorHandling(async ({ name, password }) => {
+      await client.names.setPassword(name, password);
+      return jsonContent({ name, password: true });
+    })
+  );
+  server.tool(
+    "clear_name_password",
+    "Take the password off a reserved name, so its previews open without one.",
+    {
+      name: z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.clearPassword(name);
+      return jsonContent({ name, password: false });
+    })
+  );
   server.tool(
     "describe",
     "Describe all available SDK operations, parameters, and types.",
@@ -1915,5 +2143,8 @@ export {
   withErrorHandling,
   REMOTE_MAX_WAIT_MS,
   REMOTE_MIN_POLL_MS,
+  shareHints,
+  toolWords,
+  withShareHints,
   registerTools
 };