@webhooks-cc/mcp 1.17.0 → 1.18.0

package/README.md

@@ -34,7 +34,7 @@ For other agents, `npx skills add kroqdotdev/webhooks-cc` installs the same skil
 - **claude.ai and Claude Desktop**: Settings, Connectors, add a custom connector with the URL `https://webhooks.cc/mcp`
 - **ChatGPT**: add it as a custom connector (developer mode)
 
-A client that can send headers may use an API key instead: `Authorization: Bearer whcc_...`. The remote server has 46 tools: `send_to` and `replay_request` are left out and `targetUrl` is refused, because a hosted server cannot reach your machine, and waits are capped at 50 seconds. It needs an account (no sandbox), and serves tools only, without prompts or resources.
+A client that can send headers may use an API key instead: `Authorization: Bearer whcc_...`. The remote server has 54 tools: `send_to`, `replay_request` and `share_port` are left out and `targetUrl` is refused, because a hosted server cannot reach your machine, and waits are capped at 50 seconds. It needs an account (no sandbox), and serves tools only, without prompts or resources.
 
 ### One-click
 
@@ -83,7 +83,7 @@ Leave out `env` to start without a key. Get your API key at [webhooks.cc/account
 
 ## What it exposes
 
-The server exposes `48` tools, `3` prompts, and `3` resource surfaces with an API key, the same `48` tools and the prompts with a saved connection, and `11` sandbox tools otherwise. The remote server exposes `46` tools.
+The server exposes `57` tools, `3` prompts, and `3` resource surfaces with an API key, the same `57` tools and the prompts with a saved connection, and `11` sandbox tools otherwise. The remote server exposes `54` tools.
 
 ### Endpoint tools
 
@@ -155,6 +155,17 @@ retried and logged (owner only):
 
 Endpoints shared with you already appear in `list_endpoints` (with `fromTeam`) and work with every request tool except `clear_requests`, which stays with the owner. Invites are not exposed: accepting one claims a paid seat.
 
+### Sharing tools
+
+- `share_port`: shares a local port at a `https://<name>.sharehooks.cc` link by running `whk share` (local server only; needs [whk](https://webhooks.cc/installation) installed, or `WHK_PATH` naming it). The share runs until `stop_share`, the plan's session limit, or the end of the server. Free shares get a random name ending in `-free`, two hours, and a notice page before the site; Pro and Business can pass a reserved `name` and a `password`.
+- `list_shares`: running and recent previews and live tunnels, this month's shared data, the plan's sharing limits, and `hints` with the next step (the server's own in tool names, plus slots or data running out).
+- `stop_share`: stops a preview or live tunnel, and says whether it had already ended.
+- `share_requests`: the last requests visitors made to a running preview (no addresses).
+- `list_names`, `reserve_name` (optionally inside a team), `release_name`: reserved preview names (Pro and Business).
+- `set_name_password`, `clear_name_password`: the password visitors need for every preview under a name. The password is never echoed back.
+
+Everything the dashboard's Shares page does is here, so an agent never needs it; only `share_port` needs the local server.
+
 ### Discovery and account tools
 
 - `list_provider_templates`

package/dist/bin/mcp.js

@@ -158,6 +158,15 @@ function omitHeaders(holder) {
   holder.headers = {};
   holder.headersOmitted = `${count} headers left out to fit the output`;
 }
+function trimAuth(holder) {
+  const auth = holder.auth;
+  if (auth && typeof auth === "object" && !Array.isArray(auth)) {
+    const verdicts = { ...auth };
+    delete verdicts.setup;
+    delete verdicts.authenticationResults;
+    holder.auth = verdicts;
+  }
+}
 function trimSpam(holder) {
   const spam = holder.spam;
   if (spam && typeof spam === "object" && !Array.isArray(spam)) {
@@ -305,6 +314,7 @@ function compactRequest(request) {
   shrinkToFit(root, budget, [
     () => trimParsed(compact),
     () => omitHeaders(compact),
+    () => trimAuth(email),
     () => trimSpam(email),
     () => capLists(email),
     () => cutStringToFit(root, email, "text", "textTruncated", budget, TEXT_FLOOR),
@@ -446,7 +456,7 @@ var import_zod3 = require("zod");
 var import_sdk2 = require("@webhooks-cc/sdk");
 
 // src/version.ts
-var VERSION = true ? "1.17.0" : "0.0.0-dev";
+var VERSION = true ? "1.18.0" : "0.0.0-dev";
 var MCP_USER_AGENT = `webhooks-cc-mcp/${VERSION}`;
 
 // src/tools.ts
@@ -1000,7 +1010,7 @@ function emailDetail(client, email, view, includeHtml) {
   ]);
   return detail;
 }
-var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request"]);
+var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request", "share_port"]);
 var TARGET_URL_TOOLS = /* @__PURE__ */ new Set(["render_email", "test_webhook_flow"]);
 var REMOTE_MAX_WAIT_MS = 5e4;
 var REMOTE_MIN_POLL_MS = 1e3;
@@ -1058,9 +1068,78 @@ function toolTarget(target, remote, handles) {
     }
   };
 }
+function shareSummary(live) {
+  const notes = [];
+  if (live.notice) {
+    notes.push(
+      "The first time each browser opens the link, it sees a short notice from webhooks.cc and clicks Open the preview (Free, and paid accounts in their first 7 days)."
+    );
+  }
+  if (live.password) notes.push("Visitors need the password.");
+  if (live.expiresAt) {
+    notes.push(
+      `The plan stops this share at ${live.expiresAt}; reconnecting does not extend it, and starting it again gives a new link.`
+    );
+  }
+  notes.push("It runs until stop_share or the end of this MCP server.");
+  return {
+    url: live.url,
+    name: live.name,
+    port: live.port,
+    expiresAt: live.expiresAt,
+    notice: live.notice,
+    password: live.password,
+    notes: notes.join(" ")
+  };
+}
+var REMOTE_SHARE = "`whk share <port>` on the person's computer (or the local MCP server, npx -y @webhooks-cc/mcp, which has share_port)";
+function shareHints(list, remote = false) {
+  const start = remote ? REMOTE_SHARE : "share_port";
+  const hints = [];
+  const limits = list.limits;
+  const usage = list.usage;
+  const previews = list.shares.filter((s) => s.kind !== "live" && !s.endedAt && s.mine !== false);
+  if (usage?.over) {
+    hints.push(
+      `This month's shared data is used up, so previews are paused until ${usage.resetsAt}. A larger plan (Pro 25 GB, Business 150 GB) raises it; the person upgrades on webhooks.cc.`
+    );
+  }
+  if (limits && previews.length >= limits.shares) {
+    hints.push(
+      `All ${limits.shares} of the plan's preview slots are in use: stop one with stop_share (its id is in shares) before ${start}.`
+    );
+  }
+  if (limits && limits.sessionMinutes) {
+    hints.push(
+      `Previews on this plan stop after ${limits.sessionMinutes} minutes; ${start} again gives a new link.`
+    );
+  }
+  if (limits && !limits.passwords) {
+    hints.push("Passwords and reserved names come with Pro and Business.");
+  }
+  return hints;
+}
+function toolWords(hint, remote = false) {
+  const words = hint.replace(/whk shares stop(?: <[^>]*>)?/g, "stop_share").replace(/whk shares (?:ls|list)/g, "list_shares").replace(/whk shares log(?: <[^>]*>)?/g, "share_requests").replace(/whk names reserve(?: <[^>]*>)?(?: --team <[^>]*>)?/g, "reserve_name").replace(/whk names release(?: <[^>]*>)?/g, "release_name").replace(/whk names password(?: <[^>]*>)? --clear/g, "clear_name_password").replace(/whk names password(?: <[^>]*>)?/g, "set_name_password").replace(/whk names ls/g, "list_names");
+  if (remote) return words;
+  return words.replace(/whk share <port> --password/g, "share_port with a password").replace(/whk share <port>/g, "share_port");
+}
+function withShareHints(list, remote = false) {
+  const server = (list.hints ?? []).map((h) => toolWords(h, remote));
+  const ours = shareHints(list, remote);
+  if (list.suspended && !server.some((h) => /suspended/i.test(h))) {
+    ours.unshift(
+      `Sharing is suspended on this account: ${remote ? "new previews are" : "share_port is"} refused. The person can write to support@webhooks.cc.`
+    );
+  }
+  const hints = [.../* @__PURE__ */ new Set([...server, ...ours])];
+  return hints.length > 0 ? { ...list, hints } : { ...list };
+}
 function registerTools(target, client, options = {}) {
   const handles = [];
-  const server = toolTarget(target, options.remote === true, handles);
+  const remote = options.remote === true;
+  const server = toolTarget(target, remote, handles);
+  const shareWith = remote ? REMOTE_SHARE : "share_port";
   server.tool(
     "create_endpoint",
     "Create a webhook endpoint. Returns the endpoint slug, URL, and metadata.",
@@ -2121,6 +2200,143 @@ function registerTools(target, client, options = {}) {
       );
     })
   );
+  const started = /* @__PURE__ */ new Map();
+  server.tool(
+    "share_port",
+    "Share a port on this computer at a public link (https://<name>.sharehooks.cc) by running the webhooks.cc CLI (whk share), so a person can open the site you are building. Returns the link. It keeps running until stop_share, the plan's session limit, or the end of this MCP server. Asking again for the same port without a name or password returns the running link; with a name or password, the running share on that port stops and a new one starts. Free accounts get a random name ending in -free, a 2-hour limit and a notice page before the site; Pro and Business can use a reserved name and a password. Needs whk installed on this computer. For a webhook provider that must get your local app's real answer, use `whk tunnel <port> --live` instead.",
+    {
+      port: import_zod2.z.number().int().min(1).max(65535).describe("The local port the site runs on"),
+      name: import_zod2.z.string().optional().describe("A name you reserved (Pro and Business); leave out for a random one"),
+      password: import_zod2.z.string().min(8).max(200).optional().describe("What visitors must type (Pro and Business), 8 to 200 characters")
+    },
+    withErrorHandling(async ({ port, name, password }) => {
+      const running = started.get(port);
+      if (running && !name && !password) {
+        return jsonContent({ ...shareSummary(running), alreadyRunning: true });
+      }
+      if (running) {
+        started.delete(port);
+        await running.stop();
+      }
+      let live;
+      try {
+        live = await client.shares.start({
+          port,
+          ...name ? { name } : {},
+          ...password ? { password } : {},
+          ...process.env.WHK_PATH ? { whkPath: process.env.WHK_PATH } : {}
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `${message} With these tools: list_shares shows what runs and the plan's limits, stop_share frees a slot, list_names shows the names you can use.`
+        );
+      }
+      started.set(port, live);
+      void live.closed.then(() => {
+        if (started.get(port) === live) started.delete(port);
+      });
+      const summary = shareSummary(live);
+      try {
+        const list = await client.shares.list({ state: "live" });
+        summary.limits = list.limits;
+        summary.usage = list.usage;
+        const hints = shareHints(list);
+        if (hints.length > 0) summary.hints = hints;
+      } catch {
+      }
+      return jsonContent(summary);
+    })
+  );
+  server.tool(
+    "list_shares",
+    `List your public previews of local ports (whk share${remote ? "" : ", share_port"}) and live tunnels (whk tunnel --live): live ones first, then the latest that ended, with this month's shared data and your plan's sharing limits. Not the same as share_endpoint, which shares an endpoint with a team.`,
+    {
+      state: import_zod2.z.enum(["live", "ended"]).optional().describe("Only the running ones, or only the ended ones")
+    },
+    withErrorHandling(async ({ state }) => {
+      return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
+    })
+  );
+  server.tool(
+    "stop_share",
+    "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",
+    {
+      id: import_zod2.z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      const result = await client.shares.stop(id);
+      return jsonContent({
+        id,
+        stopped: result.stopped,
+        edgeReached: result.edgeReached,
+        note: result.stopped ? result.edgeReached ? "Stopped; its CLI was told and exits." : "Stopped; the edge could not be told at once, so it ends within half a minute." : "It had already ended."
+      });
+    })
+  );
+  server.tool(
+    "share_requests",
+    "The last requests visitors made to a running preview (from list_shares), newest first: method, path, status, time, size, country, device and a number per visitor, never an address. Use it to see whether the person opened the link and what failed for them. `available` is false when the log could not be read just now.",
+    {
+      id: import_zod2.z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      return jsonContent(await client.shares.requests(id));
+    })
+  );
+  server.tool(
+    "list_names",
+    `List the reserved preview names you can share under (Pro and Business): your own and your teams', each with its link, whether it has a password, whether a preview runs under it now, and whether your plan still covers it (usable). Includes how many your plan allows and how many you hold. Share under one with ${remote ? "`whk share <port> --name <name>` on the person's computer (or the local MCP server's share_port)" : "share_port and its name"}.`,
+    {},
+    withErrorHandling(async () => {
+      return jsonContent(await client.names.list());
+    })
+  );
+  server.tool(
+    "reserve_name",
+    `Reserve a preview name, so ${shareWith} can use the link https://<name>.sharehooks.cc (Pro and Business). Lowercase letters, digits and dashes; names that look like random ones or end in -free are refused. With team, the name belongs to that team and every member may share under it.`,
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name: lowercase letters, digits and dashes"),
+      team: import_zod2.z.string().optional().describe("A team's id or name (from list_teams), to keep the name inside that team")
+    },
+    withErrorHandling(async ({ name, team }) => {
+      return jsonContent(await client.names.reserve(name, team ? { team } : {}));
+    })
+  );
+  server.tool(
+    "release_name",
+    "Release a reserved preview name you kept (or, for a team name, as the team's owner). A preview running under it stops, and the link stops working.",
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.release(name);
+      return jsonContent({ released: name });
+    })
+  );
+  server.tool(
+    "set_name_password",
+    "Put a password on every preview under a reserved name (Pro and Business): visitors must type it before the page opens. The password is not shown back; give it to the person yourself.",
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names"),
+      password: import_zod2.z.string().min(8).max(200).describe("What visitors must type, 8 to 200 characters")
+    },
+    withErrorHandling(async ({ name, password }) => {
+      await client.names.setPassword(name, password);
+      return jsonContent({ name, password: true });
+    })
+  );
+  server.tool(
+    "clear_name_password",
+    "Take the password off a reserved name, so its previews open without one.",
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.clearPassword(name);
+      return jsonContent({ name, password: false });
+    })
+  );
   server.tool(
     "describe",
     "Describe all available SDK operations, parameters, and types.",

package/dist/{chunk-ZAPNMGCE.mjs → chunk-GTEE7L2Y.mjs}

@@ -67,6 +67,15 @@ function omitHeaders(holder) {
   holder.headers = {};
   holder.headersOmitted = `${count} headers left out to fit the output`;
 }
+function trimAuth(holder) {
+  const auth = holder.auth;
+  if (auth && typeof auth === "object" && !Array.isArray(auth)) {
+    const verdicts = { ...auth };
+    delete verdicts.setup;
+    delete verdicts.authenticationResults;
+    holder.auth = verdicts;
+  }
+}
 function trimSpam(holder) {
   const spam = holder.spam;
   if (spam && typeof spam === "object" && !Array.isArray(spam)) {
@@ -214,6 +223,7 @@ function compactRequest(request) {
   shrinkToFit(root, budget, [
     () => trimParsed(compact),
     () => omitHeaders(compact),
+    () => trimAuth(email),
     () => trimSpam(email),
     () => capLists(email),
     () => cutStringToFit(root, email, "text", "textTruncated", budget, TEXT_FLOOR),
@@ -778,7 +788,7 @@ function emailDetail(client, email, view, includeHtml) {
   ]);
   return detail;
 }
-var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request"]);
+var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request", "share_port"]);
 var TARGET_URL_TOOLS = /* @__PURE__ */ new Set(["render_email", "test_webhook_flow"]);
 var REMOTE_MAX_WAIT_MS = 5e4;
 var REMOTE_MIN_POLL_MS = 1e3;
@@ -836,9 +846,78 @@ function toolTarget(target, remote, handles) {
     }
   };
 }
+function shareSummary(live) {
+  const notes = [];
+  if (live.notice) {
+    notes.push(
+      "The first time each browser opens the link, it sees a short notice from webhooks.cc and clicks Open the preview (Free, and paid accounts in their first 7 days)."
+    );
+  }
+  if (live.password) notes.push("Visitors need the password.");
+  if (live.expiresAt) {
+    notes.push(
+      `The plan stops this share at ${live.expiresAt}; reconnecting does not extend it, and starting it again gives a new link.`
+    );
+  }
+  notes.push("It runs until stop_share or the end of this MCP server.");
+  return {
+    url: live.url,
+    name: live.name,
+    port: live.port,
+    expiresAt: live.expiresAt,
+    notice: live.notice,
+    password: live.password,
+    notes: notes.join(" ")
+  };
+}
+var REMOTE_SHARE = "`whk share <port>` on the person's computer (or the local MCP server, npx -y @webhooks-cc/mcp, which has share_port)";
+function shareHints(list, remote = false) {
+  const start = remote ? REMOTE_SHARE : "share_port";
+  const hints = [];
+  const limits = list.limits;
+  const usage = list.usage;
+  const previews = list.shares.filter((s) => s.kind !== "live" && !s.endedAt && s.mine !== false);
+  if (usage?.over) {
+    hints.push(
+      `This month's shared data is used up, so previews are paused until ${usage.resetsAt}. A larger plan (Pro 25 GB, Business 150 GB) raises it; the person upgrades on webhooks.cc.`
+    );
+  }
+  if (limits && previews.length >= limits.shares) {
+    hints.push(
+      `All ${limits.shares} of the plan's preview slots are in use: stop one with stop_share (its id is in shares) before ${start}.`
+    );
+  }
+  if (limits && limits.sessionMinutes) {
+    hints.push(
+      `Previews on this plan stop after ${limits.sessionMinutes} minutes; ${start} again gives a new link.`
+    );
+  }
+  if (limits && !limits.passwords) {
+    hints.push("Passwords and reserved names come with Pro and Business.");
+  }
+  return hints;
+}
+function toolWords(hint, remote = false) {
+  const words = hint.replace(/whk shares stop(?: <[^>]*>)?/g, "stop_share").replace(/whk shares (?:ls|list)/g, "list_shares").replace(/whk shares log(?: <[^>]*>)?/g, "share_requests").replace(/whk names reserve(?: <[^>]*>)?(?: --team <[^>]*>)?/g, "reserve_name").replace(/whk names release(?: <[^>]*>)?/g, "release_name").replace(/whk names password(?: <[^>]*>)? --clear/g, "clear_name_password").replace(/whk names password(?: <[^>]*>)?/g, "set_name_password").replace(/whk names ls/g, "list_names");
+  if (remote) return words;
+  return words.replace(/whk share <port> --password/g, "share_port with a password").replace(/whk share <port>/g, "share_port");
+}
+function withShareHints(list, remote = false) {
+  const server = (list.hints ?? []).map((h) => toolWords(h, remote));
+  const ours = shareHints(list, remote);
+  if (list.suspended && !server.some((h) => /suspended/i.test(h))) {
+    ours.unshift(
+      `Sharing is suspended on this account: ${remote ? "new previews are" : "share_port is"} refused. The person can write to support@webhooks.cc.`
+    );
+  }
+  const hints = [.../* @__PURE__ */ new Set([...server, ...ours])];
+  return hints.length > 0 ? { ...list, hints } : { ...list };
+}
 function registerTools(target, client, options = {}) {
   const handles = [];
-  const server = toolTarget(target, options.remote === true, handles);
+  const remote = options.remote === true;
+  const server = toolTarget(target, remote, handles);
+  const shareWith = remote ? REMOTE_SHARE : "share_port";
   server.tool(
     "create_endpoint",
     "Create a webhook endpoint. Returns the endpoint slug, URL, and metadata.",
@@ -1899,6 +1978,143 @@ function registerTools(target, client, options = {}) {
       );
     })
   );
+  const started = /* @__PURE__ */ new Map();
+  server.tool(
+    "share_port",
+    "Share a port on this computer at a public link (https://<name>.sharehooks.cc) by running the webhooks.cc CLI (whk share), so a person can open the site you are building. Returns the link. It keeps running until stop_share, the plan's session limit, or the end of this MCP server. Asking again for the same port without a name or password returns the running link; with a name or password, the running share on that port stops and a new one starts. Free accounts get a random name ending in -free, a 2-hour limit and a notice page before the site; Pro and Business can use a reserved name and a password. Needs whk installed on this computer. For a webhook provider that must get your local app's real answer, use `whk tunnel <port> --live` instead.",
+    {
+      port: z.number().int().min(1).max(65535).describe("The local port the site runs on"),
+      name: z.string().optional().describe("A name you reserved (Pro and Business); leave out for a random one"),
+      password: z.string().min(8).max(200).optional().describe("What visitors must type (Pro and Business), 8 to 200 characters")
+    },
+    withErrorHandling(async ({ port, name, password }) => {
+      const running = started.get(port);
+      if (running && !name && !password) {
+        return jsonContent({ ...shareSummary(running), alreadyRunning: true });
+      }
+      if (running) {
+        started.delete(port);
+        await running.stop();
+      }
+      let live;
+      try {
+        live = await client.shares.start({
+          port,
+          ...name ? { name } : {},
+          ...password ? { password } : {},
+          ...process.env.WHK_PATH ? { whkPath: process.env.WHK_PATH } : {}
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `${message} With these tools: list_shares shows what runs and the plan's limits, stop_share frees a slot, list_names shows the names you can use.`
+        );
+      }
+      started.set(port, live);
+      void live.closed.then(() => {
+        if (started.get(port) === live) started.delete(port);
+      });
+      const summary = shareSummary(live);
+      try {
+        const list = await client.shares.list({ state: "live" });
+        summary.limits = list.limits;
+        summary.usage = list.usage;
+        const hints = shareHints(list);
+        if (hints.length > 0) summary.hints = hints;
+      } catch {
+      }
+      return jsonContent(summary);
+    })
+  );
+  server.tool(
+    "list_shares",
+    `List your public previews of local ports (whk share${remote ? "" : ", share_port"}) and live tunnels (whk tunnel --live): live ones first, then the latest that ended, with this month's shared data and your plan's sharing limits. Not the same as share_endpoint, which shares an endpoint with a team.`,
+    {
+      state: z.enum(["live", "ended"]).optional().describe("Only the running ones, or only the ended ones")
+    },
+    withErrorHandling(async ({ state }) => {
+      return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
+    })
+  );
+  server.tool(
+    "stop_share",
+    "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",
+    {
+      id: z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      const result = await client.shares.stop(id);
+      return jsonContent({
+        id,
+        stopped: result.stopped,
+        edgeReached: result.edgeReached,
+        note: result.stopped ? result.edgeReached ? "Stopped; its CLI was told and exits." : "Stopped; the edge could not be told at once, so it ends within half a minute." : "It had already ended."
+      });
+    })
+  );
+  server.tool(
+    "share_requests",
+    "The last requests visitors made to a running preview (from list_shares), newest first: method, path, status, time, size, country, device and a number per visitor, never an address. Use it to see whether the person opened the link and what failed for them. `available` is false when the log could not be read just now.",
+    {
+      id: z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      return jsonContent(await client.shares.requests(id));
+    })
+  );
+  server.tool(
+    "list_names",
+    `List the reserved preview names you can share under (Pro and Business): your own and your teams', each with its link, whether it has a password, whether a preview runs under it now, and whether your plan still covers it (usable). Includes how many your plan allows and how many you hold. Share under one with ${remote ? "`whk share <port> --name <name>` on the person's computer (or the local MCP server's share_port)" : "share_port and its name"}.`,
+    {},
+    withErrorHandling(async () => {
+      return jsonContent(await client.names.list());
+    })
+  );
+  server.tool(
+    "reserve_name",
+    `Reserve a preview name, so ${shareWith} can use the link https://<name>.sharehooks.cc (Pro and Business). Lowercase letters, digits and dashes; names that look like random ones or end in -free are refused. With team, the name belongs to that team and every member may share under it.`,
+    {
+      name: z.string().min(1).max(63).describe("The name: lowercase letters, digits and dashes"),
+      team: z.string().optional().describe("A team's id or name (from list_teams), to keep the name inside that team")
+    },
+    withErrorHandling(async ({ name, team }) => {
+      return jsonContent(await client.names.reserve(name, team ? { team } : {}));
+    })
+  );
+  server.tool(
+    "release_name",
+    "Release a reserved preview name you kept (or, for a team name, as the team's owner). A preview running under it stops, and the link stops working.",
+    {
+      name: z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.release(name);
+      return jsonContent({ released: name });
+    })
+  );
+  server.tool(
+    "set_name_password",
+    "Put a password on every preview under a reserved name (Pro and Business): visitors must type it before the page opens. The password is not shown back; give it to the person yourself.",
+    {
+      name: z.string().min(1).max(63).describe("The name, from list_names"),
+      password: z.string().min(8).max(200).describe("What visitors must type, 8 to 200 characters")
+    },
+    withErrorHandling(async ({ name, password }) => {
+      await client.names.setPassword(name, password);
+      return jsonContent({ name, password: true });
+    })
+  );
+  server.tool(
+    "clear_name_password",
+    "Take the password off a reserved name, so its previews open without one.",
+    {
+      name: z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.clearPassword(name);
+      return jsonContent({ name, password: false });
+    })
+  );
   server.tool(
     "describe",
     "Describe all available SDK operations, parameters, and types.",
@@ -1927,5 +2143,8 @@ export {
   withErrorHandling,
   REMOTE_MAX_WAIT_MS,
   REMOTE_MIN_POLL_MS,
+  shareHints,
+  toolWords,
+  withShareHints,
   registerTools
 };

package/dist/index.js

@@ -182,6 +182,15 @@ function omitHeaders(holder) {
   holder.headers = {};
   holder.headersOmitted = `${count} headers left out to fit the output`;
 }
+function trimAuth(holder) {
+  const auth = holder.auth;
+  if (auth && typeof auth === "object" && !Array.isArray(auth)) {
+    const verdicts = { ...auth };
+    delete verdicts.setup;
+    delete verdicts.authenticationResults;
+    holder.auth = verdicts;
+  }
+}
 function trimSpam(holder) {
   const spam = holder.spam;
   if (spam && typeof spam === "object" && !Array.isArray(spam)) {
@@ -329,6 +338,7 @@ function compactRequest(request) {
   shrinkToFit(root, budget, [
     () => trimParsed(compact),
     () => omitHeaders(compact),
+    () => trimAuth(email),
     () => trimSpam(email),
     () => capLists(email),
     () => cutStringToFit(root, email, "text", "textTruncated", budget, TEXT_FLOOR),
@@ -470,7 +480,7 @@ var import_zod3 = require("zod");
 var import_sdk2 = require("@webhooks-cc/sdk");
 
 // src/version.ts
-var VERSION = true ? "1.17.0" : "0.0.0-dev";
+var VERSION = true ? "1.18.0" : "0.0.0-dev";
 var MCP_USER_AGENT = `webhooks-cc-mcp/${VERSION}`;
 
 // src/tools.ts
@@ -1024,7 +1034,7 @@ function emailDetail(client, email, view, includeHtml) {
   ]);
   return detail;
 }
-var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request"]);
+var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request", "share_port"]);
 var TARGET_URL_TOOLS = /* @__PURE__ */ new Set(["render_email", "test_webhook_flow"]);
 var REMOTE_MAX_WAIT_MS = 5e4;
 var REMOTE_MIN_POLL_MS = 1e3;
@@ -1082,9 +1092,78 @@ function toolTarget(target, remote, handles) {
     }
   };
 }
+function shareSummary(live) {
+  const notes = [];
+  if (live.notice) {
+    notes.push(
+      "The first time each browser opens the link, it sees a short notice from webhooks.cc and clicks Open the preview (Free, and paid accounts in their first 7 days)."
+    );
+  }
+  if (live.password) notes.push("Visitors need the password.");
+  if (live.expiresAt) {
+    notes.push(
+      `The plan stops this share at ${live.expiresAt}; reconnecting does not extend it, and starting it again gives a new link.`
+    );
+  }
+  notes.push("It runs until stop_share or the end of this MCP server.");
+  return {
+    url: live.url,
+    name: live.name,
+    port: live.port,
+    expiresAt: live.expiresAt,
+    notice: live.notice,
+    password: live.password,
+    notes: notes.join(" ")
+  };
+}
+var REMOTE_SHARE = "`whk share <port>` on the person's computer (or the local MCP server, npx -y @webhooks-cc/mcp, which has share_port)";
+function shareHints(list, remote = false) {
+  const start = remote ? REMOTE_SHARE : "share_port";
+  const hints = [];
+  const limits = list.limits;
+  const usage = list.usage;
+  const previews = list.shares.filter((s) => s.kind !== "live" && !s.endedAt && s.mine !== false);
+  if (usage?.over) {
+    hints.push(
+      `This month's shared data is used up, so previews are paused until ${usage.resetsAt}. A larger plan (Pro 25 GB, Business 150 GB) raises it; the person upgrades on webhooks.cc.`
+    );
+  }
+  if (limits && previews.length >= limits.shares) {
+    hints.push(
+      `All ${limits.shares} of the plan's preview slots are in use: stop one with stop_share (its id is in shares) before ${start}.`
+    );
+  }
+  if (limits && limits.sessionMinutes) {
+    hints.push(
+      `Previews on this plan stop after ${limits.sessionMinutes} minutes; ${start} again gives a new link.`
+    );
+  }
+  if (limits && !limits.passwords) {
+    hints.push("Passwords and reserved names come with Pro and Business.");
+  }
+  return hints;
+}
+function toolWords(hint, remote = false) {
+  const words = hint.replace(/whk shares stop(?: <[^>]*>)?/g, "stop_share").replace(/whk shares (?:ls|list)/g, "list_shares").replace(/whk shares log(?: <[^>]*>)?/g, "share_requests").replace(/whk names reserve(?: <[^>]*>)?(?: --team <[^>]*>)?/g, "reserve_name").replace(/whk names release(?: <[^>]*>)?/g, "release_name").replace(/whk names password(?: <[^>]*>)? --clear/g, "clear_name_password").replace(/whk names password(?: <[^>]*>)?/g, "set_name_password").replace(/whk names ls/g, "list_names");
+  if (remote) return words;
+  return words.replace(/whk share <port> --password/g, "share_port with a password").replace(/whk share <port>/g, "share_port");
+}
+function withShareHints(list, remote = false) {
+  const server = (list.hints ?? []).map((h) => toolWords(h, remote));
+  const ours = shareHints(list, remote);
+  if (list.suspended && !server.some((h) => /suspended/i.test(h))) {
+    ours.unshift(
+      `Sharing is suspended on this account: ${remote ? "new previews are" : "share_port is"} refused. The person can write to support@webhooks.cc.`
+    );
+  }
+  const hints = [.../* @__PURE__ */ new Set([...server, ...ours])];
+  return hints.length > 0 ? { ...list, hints } : { ...list };
+}
 function registerTools(target, client, options = {}) {
   const handles = [];
-  const server = toolTarget(target, options.remote === true, handles);
+  const remote = options.remote === true;
+  const server = toolTarget(target, remote, handles);
+  const shareWith = remote ? REMOTE_SHARE : "share_port";
   server.tool(
     "create_endpoint",
     "Create a webhook endpoint. Returns the endpoint slug, URL, and metadata.",
@@ -2145,6 +2224,143 @@ function registerTools(target, client, options = {}) {
       );
     })
   );
+  const started = /* @__PURE__ */ new Map();
+  server.tool(
+    "share_port",
+    "Share a port on this computer at a public link (https://<name>.sharehooks.cc) by running the webhooks.cc CLI (whk share), so a person can open the site you are building. Returns the link. It keeps running until stop_share, the plan's session limit, or the end of this MCP server. Asking again for the same port without a name or password returns the running link; with a name or password, the running share on that port stops and a new one starts. Free accounts get a random name ending in -free, a 2-hour limit and a notice page before the site; Pro and Business can use a reserved name and a password. Needs whk installed on this computer. For a webhook provider that must get your local app's real answer, use `whk tunnel <port> --live` instead.",
+    {
+      port: import_zod2.z.number().int().min(1).max(65535).describe("The local port the site runs on"),
+      name: import_zod2.z.string().optional().describe("A name you reserved (Pro and Business); leave out for a random one"),
+      password: import_zod2.z.string().min(8).max(200).optional().describe("What visitors must type (Pro and Business), 8 to 200 characters")
+    },
+    withErrorHandling(async ({ port, name, password }) => {
+      const running = started.get(port);
+      if (running && !name && !password) {
+        return jsonContent({ ...shareSummary(running), alreadyRunning: true });
+      }
+      if (running) {
+        started.delete(port);
+        await running.stop();
+      }
+      let live;
+      try {
+        live = await client.shares.start({
+          port,
+          ...name ? { name } : {},
+          ...password ? { password } : {},
+          ...process.env.WHK_PATH ? { whkPath: process.env.WHK_PATH } : {}
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `${message} With these tools: list_shares shows what runs and the plan's limits, stop_share frees a slot, list_names shows the names you can use.`
+        );
+      }
+      started.set(port, live);
+      void live.closed.then(() => {
+        if (started.get(port) === live) started.delete(port);
+      });
+      const summary = shareSummary(live);
+      try {
+        const list = await client.shares.list({ state: "live" });
+        summary.limits = list.limits;
+        summary.usage = list.usage;
+        const hints = shareHints(list);
+        if (hints.length > 0) summary.hints = hints;
+      } catch {
+      }
+      return jsonContent(summary);
+    })
+  );
+  server.tool(
+    "list_shares",
+    `List your public previews of local ports (whk share${remote ? "" : ", share_port"}) and live tunnels (whk tunnel --live): live ones first, then the latest that ended, with this month's shared data and your plan's sharing limits. Not the same as share_endpoint, which shares an endpoint with a team.`,
+    {
+      state: import_zod2.z.enum(["live", "ended"]).optional().describe("Only the running ones, or only the ended ones")
+    },
+    withErrorHandling(async ({ state }) => {
+      return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
+    })
+  );
+  server.tool(
+    "stop_share",
+    "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",
+    {
+      id: import_zod2.z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      const result = await client.shares.stop(id);
+      return jsonContent({
+        id,
+        stopped: result.stopped,
+        edgeReached: result.edgeReached,
+        note: result.stopped ? result.edgeReached ? "Stopped; its CLI was told and exits." : "Stopped; the edge could not be told at once, so it ends within half a minute." : "It had already ended."
+      });
+    })
+  );
+  server.tool(
+    "share_requests",
+    "The last requests visitors made to a running preview (from list_shares), newest first: method, path, status, time, size, country, device and a number per visitor, never an address. Use it to see whether the person opened the link and what failed for them. `available` is false when the log could not be read just now.",
+    {
+      id: import_zod2.z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      return jsonContent(await client.shares.requests(id));
+    })
+  );
+  server.tool(
+    "list_names",
+    `List the reserved preview names you can share under (Pro and Business): your own and your teams', each with its link, whether it has a password, whether a preview runs under it now, and whether your plan still covers it (usable). Includes how many your plan allows and how many you hold. Share under one with ${remote ? "`whk share <port> --name <name>` on the person's computer (or the local MCP server's share_port)" : "share_port and its name"}.`,
+    {},
+    withErrorHandling(async () => {
+      return jsonContent(await client.names.list());
+    })
+  );
+  server.tool(
+    "reserve_name",
+    `Reserve a preview name, so ${shareWith} can use the link https://<name>.sharehooks.cc (Pro and Business). Lowercase letters, digits and dashes; names that look like random ones or end in -free are refused. With team, the name belongs to that team and every member may share under it.`,
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name: lowercase letters, digits and dashes"),
+      team: import_zod2.z.string().optional().describe("A team's id or name (from list_teams), to keep the name inside that team")
+    },
+    withErrorHandling(async ({ name, team }) => {
+      return jsonContent(await client.names.reserve(name, team ? { team } : {}));
+    })
+  );
+  server.tool(
+    "release_name",
+    "Release a reserved preview name you kept (or, for a team name, as the team's owner). A preview running under it stops, and the link stops working.",
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.release(name);
+      return jsonContent({ released: name });
+    })
+  );
+  server.tool(
+    "set_name_password",
+    "Put a password on every preview under a reserved name (Pro and Business): visitors must type it before the page opens. The password is not shown back; give it to the person yourself.",
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names"),
+      password: import_zod2.z.string().min(8).max(200).describe("What visitors must type, 8 to 200 characters")
+    },
+    withErrorHandling(async ({ name, password }) => {
+      await client.names.setPassword(name, password);
+      return jsonContent({ name, password: true });
+    })
+  );
+  server.tool(
+    "clear_name_password",
+    "Take the password off a reserved name, so its previews open without one.",
+    {
+      name: import_zod2.z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.clearPassword(name);
+      return jsonContent({ name, password: false });
+    })
+  );
   server.tool(
     "describe",
     "Describe all available SDK operations, parameters, and types.",

package/dist/index.mjs

@@ -13,7 +13,7 @@ import {
   registerTools,
   waitForRequestShape,
   withErrorHandling
-} from "./chunk-ZAPNMGCE.mjs";
+} from "./chunk-GTEE7L2Y.mjs";
 
 // src/index.ts
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -262,7 +262,7 @@ import {
 } from "@webhooks-cc/sdk";
 
 // src/version.ts
-var VERSION = true ? "1.17.0" : "0.0.0-dev";
+var VERSION = true ? "1.18.0" : "0.0.0-dev";
 var MCP_USER_AGENT = `webhooks-cc-mcp/${VERSION}`;
 
 // src/sandbox-tools.ts

package/dist/tools.d.mts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { WebhooksCC, Request, PayloadSchemaFormat } from '@webhooks-cc/sdk';
+import { WebhooksCC, Request, PayloadSchemaFormat, TunnelShareList } from '@webhooks-cc/sdk';
 
 declare const createEndpointShape: {
     name: z.ZodOptional<z.ZodString>;
@@ -166,11 +166,31 @@ interface RegisterToolsOptions {
 declare const REMOTE_MAX_WAIT_MS = 50000;
 /** Shortest poll interval on the hosted server: each poll is an API request. */
 declare const REMOTE_MIN_POLL_MS = 1000;
+/**
+ * What an agent can do about the account's sharing limits, from a share
+ * list: the next step when slots or data run out, so it never has to send
+ * the person to the dashboard. `remote` for the hosted server, which has no
+ * share_port.
+ */
+declare function shareHints(list: TunnelShareList, remote?: boolean): string[];
+/**
+ * A server hint in this server's words: the whk commands it names become
+ * the tools that do the same, so an agent does not reach for a CLI. On the
+ * hosted server (`remote`) `whk share` stays a command for the person's
+ * computer, since that server has no share_port.
+ */
+declare function toolWords(hint: string, remote?: boolean): string;
+/**
+ * A share list with hints for an agent, for list_shares and share_port: the
+ * server's own (in tool words) and this server's, without repeats, so
+ * nothing the server says (a suspension, a pause) is lost.
+ */
+declare function withShareHints(list: TunnelShareList, remote?: boolean): Record<string, unknown>;
 /**
  * Registers the webhooks.cc tools for an account client. Returns their
  * handles, so a caller can swap the tool set later.
  */
 declare function registerTools(target: ToolServer, client: WebhooksCC, options?: RegisterToolsOptions): RegisteredToolHandle[];
 
-export { REMOTE_MAX_WAIT_MS, REMOTE_MIN_POLL_MS, createEndpointShape, deleteEndpointShape, getEndpointShape, getRequestShape, jsonContent, listEndpointsShape, listRequestsShape, payloadSchemaResult, payloadSchemaShape, registerTools, textContent, waitForRequestShape, withErrorHandling };
+export { REMOTE_MAX_WAIT_MS, REMOTE_MIN_POLL_MS, createEndpointShape, deleteEndpointShape, getEndpointShape, getRequestShape, jsonContent, listEndpointsShape, listRequestsShape, payloadSchemaResult, payloadSchemaShape, registerTools, shareHints, textContent, toolWords, waitForRequestShape, withErrorHandling, withShareHints };
 export type { RegisterToolsOptions, RegisteredToolHandle, ToolResult, ToolServer };

package/dist/tools.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { WebhooksCC, Request, PayloadSchemaFormat } from '@webhooks-cc/sdk';
+import { WebhooksCC, Request, PayloadSchemaFormat, TunnelShareList } from '@webhooks-cc/sdk';
 
 declare const createEndpointShape: {
     name: z.ZodOptional<z.ZodString>;
@@ -166,11 +166,31 @@ interface RegisterToolsOptions {
 declare const REMOTE_MAX_WAIT_MS = 50000;
 /** Shortest poll interval on the hosted server: each poll is an API request. */
 declare const REMOTE_MIN_POLL_MS = 1000;
+/**
+ * What an agent can do about the account's sharing limits, from a share
+ * list: the next step when slots or data run out, so it never has to send
+ * the person to the dashboard. `remote` for the hosted server, which has no
+ * share_port.
+ */
+declare function shareHints(list: TunnelShareList, remote?: boolean): string[];
+/**
+ * A server hint in this server's words: the whk commands it names become
+ * the tools that do the same, so an agent does not reach for a CLI. On the
+ * hosted server (`remote`) `whk share` stays a command for the person's
+ * computer, since that server has no share_port.
+ */
+declare function toolWords(hint: string, remote?: boolean): string;
+/**
+ * A share list with hints for an agent, for list_shares and share_port: the
+ * server's own (in tool words) and this server's, without repeats, so
+ * nothing the server says (a suspension, a pause) is lost.
+ */
+declare function withShareHints(list: TunnelShareList, remote?: boolean): Record<string, unknown>;
 /**
  * Registers the webhooks.cc tools for an account client. Returns their
  * handles, so a caller can swap the tool set later.
  */
 declare function registerTools(target: ToolServer, client: WebhooksCC, options?: RegisterToolsOptions): RegisteredToolHandle[];
 
-export { REMOTE_MAX_WAIT_MS, REMOTE_MIN_POLL_MS, createEndpointShape, deleteEndpointShape, getEndpointShape, getRequestShape, jsonContent, listEndpointsShape, listRequestsShape, payloadSchemaResult, payloadSchemaShape, registerTools, textContent, waitForRequestShape, withErrorHandling };
+export { REMOTE_MAX_WAIT_MS, REMOTE_MIN_POLL_MS, createEndpointShape, deleteEndpointShape, getEndpointShape, getRequestShape, jsonContent, listEndpointsShape, listRequestsShape, payloadSchemaResult, payloadSchemaShape, registerTools, shareHints, textContent, toolWords, waitForRequestShape, withErrorHandling, withShareHints };
 export type { RegisterToolsOptions, RegisteredToolHandle, ToolResult, ToolServer };

package/dist/tools.js

@@ -32,9 +32,12 @@ __export(tools_exports, {
   payloadSchemaResult: () => payloadSchemaResult,
   payloadSchemaShape: () => payloadSchemaShape,
   registerTools: () => registerTools,
+  shareHints: () => shareHints,
   textContent: () => textContent,
+  toolWords: () => toolWords,
   waitForRequestShape: () => waitForRequestShape,
-  withErrorHandling: () => withErrorHandling
+  withErrorHandling: () => withErrorHandling,
+  withShareHints: () => withShareHints
 });
 module.exports = __toCommonJS(tools_exports);
 var import_zod = require("zod");
@@ -76,6 +79,15 @@ function omitHeaders(holder) {
   holder.headers = {};
   holder.headersOmitted = `${count} headers left out to fit the output`;
 }
+function trimAuth(holder) {
+  const auth = holder.auth;
+  if (auth && typeof auth === "object" && !Array.isArray(auth)) {
+    const verdicts = { ...auth };
+    delete verdicts.setup;
+    delete verdicts.authenticationResults;
+    holder.auth = verdicts;
+  }
+}
 function trimSpam(holder) {
   const spam = holder.spam;
   if (spam && typeof spam === "object" && !Array.isArray(spam)) {
@@ -223,6 +235,7 @@ function compactRequest(request) {
   shrinkToFit(root, budget, [
     () => trimParsed(compact),
     () => omitHeaders(compact),
+    () => trimAuth(email),
     () => trimSpam(email),
     () => capLists(email),
     () => cutStringToFit(root, email, "text", "textTruncated", budget, TEXT_FLOOR),
@@ -787,7 +800,7 @@ function emailDetail(client, email, view, includeHtml) {
   ]);
   return detail;
 }
-var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request"]);
+var LOCAL_ONLY_TOOLS = /* @__PURE__ */ new Set(["send_to", "replay_request", "share_port"]);
 var TARGET_URL_TOOLS = /* @__PURE__ */ new Set(["render_email", "test_webhook_flow"]);
 var REMOTE_MAX_WAIT_MS = 5e4;
 var REMOTE_MIN_POLL_MS = 1e3;
@@ -845,9 +858,78 @@ function toolTarget(target, remote, handles) {
     }
   };
 }
+function shareSummary(live) {
+  const notes = [];
+  if (live.notice) {
+    notes.push(
+      "The first time each browser opens the link, it sees a short notice from webhooks.cc and clicks Open the preview (Free, and paid accounts in their first 7 days)."
+    );
+  }
+  if (live.password) notes.push("Visitors need the password.");
+  if (live.expiresAt) {
+    notes.push(
+      `The plan stops this share at ${live.expiresAt}; reconnecting does not extend it, and starting it again gives a new link.`
+    );
+  }
+  notes.push("It runs until stop_share or the end of this MCP server.");
+  return {
+    url: live.url,
+    name: live.name,
+    port: live.port,
+    expiresAt: live.expiresAt,
+    notice: live.notice,
+    password: live.password,
+    notes: notes.join(" ")
+  };
+}
+var REMOTE_SHARE = "`whk share <port>` on the person's computer (or the local MCP server, npx -y @webhooks-cc/mcp, which has share_port)";
+function shareHints(list, remote = false) {
+  const start = remote ? REMOTE_SHARE : "share_port";
+  const hints = [];
+  const limits = list.limits;
+  const usage = list.usage;
+  const previews = list.shares.filter((s) => s.kind !== "live" && !s.endedAt && s.mine !== false);
+  if (usage?.over) {
+    hints.push(
+      `This month's shared data is used up, so previews are paused until ${usage.resetsAt}. A larger plan (Pro 25 GB, Business 150 GB) raises it; the person upgrades on webhooks.cc.`
+    );
+  }
+  if (limits && previews.length >= limits.shares) {
+    hints.push(
+      `All ${limits.shares} of the plan's preview slots are in use: stop one with stop_share (its id is in shares) before ${start}.`
+    );
+  }
+  if (limits && limits.sessionMinutes) {
+    hints.push(
+      `Previews on this plan stop after ${limits.sessionMinutes} minutes; ${start} again gives a new link.`
+    );
+  }
+  if (limits && !limits.passwords) {
+    hints.push("Passwords and reserved names come with Pro and Business.");
+  }
+  return hints;
+}
+function toolWords(hint, remote = false) {
+  const words = hint.replace(/whk shares stop(?: <[^>]*>)?/g, "stop_share").replace(/whk shares (?:ls|list)/g, "list_shares").replace(/whk shares log(?: <[^>]*>)?/g, "share_requests").replace(/whk names reserve(?: <[^>]*>)?(?: --team <[^>]*>)?/g, "reserve_name").replace(/whk names release(?: <[^>]*>)?/g, "release_name").replace(/whk names password(?: <[^>]*>)? --clear/g, "clear_name_password").replace(/whk names password(?: <[^>]*>)?/g, "set_name_password").replace(/whk names ls/g, "list_names");
+  if (remote) return words;
+  return words.replace(/whk share <port> --password/g, "share_port with a password").replace(/whk share <port>/g, "share_port");
+}
+function withShareHints(list, remote = false) {
+  const server = (list.hints ?? []).map((h) => toolWords(h, remote));
+  const ours = shareHints(list, remote);
+  if (list.suspended && !server.some((h) => /suspended/i.test(h))) {
+    ours.unshift(
+      `Sharing is suspended on this account: ${remote ? "new previews are" : "share_port is"} refused. The person can write to support@webhooks.cc.`
+    );
+  }
+  const hints = [.../* @__PURE__ */ new Set([...server, ...ours])];
+  return hints.length > 0 ? { ...list, hints } : { ...list };
+}
 function registerTools(target, client, options = {}) {
   const handles = [];
-  const server = toolTarget(target, options.remote === true, handles);
+  const remote = options.remote === true;
+  const server = toolTarget(target, remote, handles);
+  const shareWith = remote ? REMOTE_SHARE : "share_port";
   server.tool(
     "create_endpoint",
     "Create a webhook endpoint. Returns the endpoint slug, URL, and metadata.",
@@ -1908,6 +1990,143 @@ function registerTools(target, client, options = {}) {
       );
     })
   );
+  const started = /* @__PURE__ */ new Map();
+  server.tool(
+    "share_port",
+    "Share a port on this computer at a public link (https://<name>.sharehooks.cc) by running the webhooks.cc CLI (whk share), so a person can open the site you are building. Returns the link. It keeps running until stop_share, the plan's session limit, or the end of this MCP server. Asking again for the same port without a name or password returns the running link; with a name or password, the running share on that port stops and a new one starts. Free accounts get a random name ending in -free, a 2-hour limit and a notice page before the site; Pro and Business can use a reserved name and a password. Needs whk installed on this computer. For a webhook provider that must get your local app's real answer, use `whk tunnel <port> --live` instead.",
+    {
+      port: import_zod.z.number().int().min(1).max(65535).describe("The local port the site runs on"),
+      name: import_zod.z.string().optional().describe("A name you reserved (Pro and Business); leave out for a random one"),
+      password: import_zod.z.string().min(8).max(200).optional().describe("What visitors must type (Pro and Business), 8 to 200 characters")
+    },
+    withErrorHandling(async ({ port, name, password }) => {
+      const running = started.get(port);
+      if (running && !name && !password) {
+        return jsonContent({ ...shareSummary(running), alreadyRunning: true });
+      }
+      if (running) {
+        started.delete(port);
+        await running.stop();
+      }
+      let live;
+      try {
+        live = await client.shares.start({
+          port,
+          ...name ? { name } : {},
+          ...password ? { password } : {},
+          ...process.env.WHK_PATH ? { whkPath: process.env.WHK_PATH } : {}
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(
+          `${message} With these tools: list_shares shows what runs and the plan's limits, stop_share frees a slot, list_names shows the names you can use.`
+        );
+      }
+      started.set(port, live);
+      void live.closed.then(() => {
+        if (started.get(port) === live) started.delete(port);
+      });
+      const summary = shareSummary(live);
+      try {
+        const list = await client.shares.list({ state: "live" });
+        summary.limits = list.limits;
+        summary.usage = list.usage;
+        const hints = shareHints(list);
+        if (hints.length > 0) summary.hints = hints;
+      } catch {
+      }
+      return jsonContent(summary);
+    })
+  );
+  server.tool(
+    "list_shares",
+    `List your public previews of local ports (whk share${remote ? "" : ", share_port"}) and live tunnels (whk tunnel --live): live ones first, then the latest that ended, with this month's shared data and your plan's sharing limits. Not the same as share_endpoint, which shares an endpoint with a team.`,
+    {
+      state: import_zod.z.enum(["live", "ended"]).optional().describe("Only the running ones, or only the ended ones")
+    },
+    withErrorHandling(async ({ state }) => {
+      return jsonContent(withShareHints(await client.shares.list(state ? { state } : {}), remote));
+    })
+  );
+  server.tool(
+    "stop_share",
+    "Stop a public preview or live tunnel by its id (from list_shares). The CLI running it is told why and exits.",
+    {
+      id: import_zod.z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      const result = await client.shares.stop(id);
+      return jsonContent({
+        id,
+        stopped: result.stopped,
+        edgeReached: result.edgeReached,
+        note: result.stopped ? result.edgeReached ? "Stopped; its CLI was told and exits." : "Stopped; the edge could not be told at once, so it ends within half a minute." : "It had already ended."
+      });
+    })
+  );
+  server.tool(
+    "share_requests",
+    "The last requests visitors made to a running preview (from list_shares), newest first: method, path, status, time, size, country, device and a number per visitor, never an address. Use it to see whether the person opened the link and what failed for them. `available` is false when the log could not be read just now.",
+    {
+      id: import_zod.z.string().describe("The share's id, from list_shares")
+    },
+    withErrorHandling(async ({ id }) => {
+      return jsonContent(await client.shares.requests(id));
+    })
+  );
+  server.tool(
+    "list_names",
+    `List the reserved preview names you can share under (Pro and Business): your own and your teams', each with its link, whether it has a password, whether a preview runs under it now, and whether your plan still covers it (usable). Includes how many your plan allows and how many you hold. Share under one with ${remote ? "`whk share <port> --name <name>` on the person's computer (or the local MCP server's share_port)" : "share_port and its name"}.`,
+    {},
+    withErrorHandling(async () => {
+      return jsonContent(await client.names.list());
+    })
+  );
+  server.tool(
+    "reserve_name",
+    `Reserve a preview name, so ${shareWith} can use the link https://<name>.sharehooks.cc (Pro and Business). Lowercase letters, digits and dashes; names that look like random ones or end in -free are refused. With team, the name belongs to that team and every member may share under it.`,
+    {
+      name: import_zod.z.string().min(1).max(63).describe("The name: lowercase letters, digits and dashes"),
+      team: import_zod.z.string().optional().describe("A team's id or name (from list_teams), to keep the name inside that team")
+    },
+    withErrorHandling(async ({ name, team }) => {
+      return jsonContent(await client.names.reserve(name, team ? { team } : {}));
+    })
+  );
+  server.tool(
+    "release_name",
+    "Release a reserved preview name you kept (or, for a team name, as the team's owner). A preview running under it stops, and the link stops working.",
+    {
+      name: import_zod.z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.release(name);
+      return jsonContent({ released: name });
+    })
+  );
+  server.tool(
+    "set_name_password",
+    "Put a password on every preview under a reserved name (Pro and Business): visitors must type it before the page opens. The password is not shown back; give it to the person yourself.",
+    {
+      name: import_zod.z.string().min(1).max(63).describe("The name, from list_names"),
+      password: import_zod.z.string().min(8).max(200).describe("What visitors must type, 8 to 200 characters")
+    },
+    withErrorHandling(async ({ name, password }) => {
+      await client.names.setPassword(name, password);
+      return jsonContent({ name, password: true });
+    })
+  );
+  server.tool(
+    "clear_name_password",
+    "Take the password off a reserved name, so its previews open without one.",
+    {
+      name: import_zod.z.string().min(1).max(63).describe("The name, from list_names")
+    },
+    withErrorHandling(async ({ name }) => {
+      await client.names.clearPassword(name);
+      return jsonContent({ name, password: false });
+    })
+  );
   server.tool(
     "describe",
     "Describe all available SDK operations, parameters, and types.",
@@ -1933,7 +2152,10 @@ function registerTools(target, client, options = {}) {
   payloadSchemaResult,
   payloadSchemaShape,
   registerTools,
+  shareHints,
   textContent,
+  toolWords,
   waitForRequestShape,
-  withErrorHandling
+  withErrorHandling,
+  withShareHints
 });

package/dist/tools.mjs

@@ -11,10 +11,13 @@ import {
   payloadSchemaResult,
   payloadSchemaShape,
   registerTools,
+  shareHints,
   textContent,
+  toolWords,
   waitForRequestShape,
-  withErrorHandling
-} from "./chunk-ZAPNMGCE.mjs";
+  withErrorHandling,
+  withShareHints
+} from "./chunk-GTEE7L2Y.mjs";
 export {
   REMOTE_MAX_WAIT_MS,
   REMOTE_MIN_POLL_MS,
@@ -28,7 +31,10 @@ export {
   payloadSchemaResult,
   payloadSchemaShape,
   registerTools,
+  shareHints,
   textContent,
+  toolWords,
   waitForRequestShape,
-  withErrorHandling
+  withErrorHandling,
+  withShareHints
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webhooks-cc/mcp",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "mcpName": "io.github.kroqdotdev/webhooks-cc",
   "description": "MCP server for webhooks.cc — AI agent integration for webhook testing",
   "main": "dist/index.js",
@@ -42,15 +42,15 @@
   },
   "homepage": "https://webhooks.cc",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.32.1",
+    "@modelcontextprotocol/sdk": "^1.32.2",
     "zod": "^4.6.7",
-    "@webhooks-cc/sdk": "1.21.0"
+    "@webhooks-cc/sdk": "1.22.0"
   },
   "devDependencies": {
-    "@types/node": "^26.6.5",
+    "@types/node": "^26.6.6",
     "tsup": "^9.0.0",
     "typescript": "^6.0.3",
-    "vitest": "^5.0.5"
+    "vitest": "^5.1.0"
   },
   "scripts": {
     "build": "tsup",