hookinlet receives webhooks into named inboxes, verifies their signatures, and keeps a queryable history. Agents read it over REST, SSE, or MCP, with no glue code.
Every inbox has its own random ingest URL, its own signing secret and its own sequence. Senders get their 2xx only after the event is committed; readers catch up whenever they run.
A cursor is the last sequence number you handled. Pass it back and you resume exactly where you stopped — across restarts, reconnects and protocols.
Page through history. Good for cron jobs and batch agents.
$ curl -s -H "Authorization: Bearer $TOKEN" \ 'localhost:8080/v1/inboxes/github/messages ?after=117&limit=2' \ | jq -c '.messages[] | {seq, event_type}' {"seq":118,"event_type":"push"} {"seq":119,"event_type":"pull_request"} # keep .next as your cursor
Live messages as they land. Reconnect with Last-Event-ID and you get every later message exactly once.
$ curl -N -H "Authorization: Bearer $TOKEN" \ -H 'Last-Event-ID: 118' \ localhost:8080/v1/inboxes/github/stream retry: 3000 id: 119 event: message data: {"seq":119,"inbox":"github", data: "event_type":"pull_request", …} : ping
One endpoint, four read-only tools. wait_for_messages is the whole polling loop in one call, and what the sender wrote is kept under untrusted.
# endpoint, with an agent token http://localhost:8080/mcp # tools list_inboxes() query_messages(inbox, after, limit, bodies) get_message(inbox, seq) wait_for_messages(inbox, after, timeout_seconds) # in a session → wait_for_messages("slack", after=56) ← #57 verified untrusted: { event_type: "app_mention", … }
Open /admin on your server and sign in with the admin token. It does what the command line does, in a browser.
Built into the binary; turn it off with HOOKINLET_ADMIN_UI=false. What a sender wrote is always shown as text, never as HTML.
Stripe, GitHub, Slack, Standard Webhooks (Svix), a configurable HMAC and a shared token, all checked on the exact bytes sent. Set verifier: stripe and the secret.
Per-inbox sequence numbers, assigned in commit order. Keep the last one you handled and you see every message exactly once. You are told if retention removed messages you had not read, or if the inbox was restored or recreated.
Keep by age, by count, or both. Messages expire on your schedule, never because a reader was slow.
One static Go binary or one Docker image. SQLite by default, so there's nothing else to run.
Declare inboxes in a YAML file and run hookinlet apply. It creates what's missing, changes only what differs, and never deletes. Secrets come from the environment, never the file.
Issue as many named read-only tokens as you need, each scoped to some inboxes or all. Replace one by issuing a new one and revoking the old, with no gap. Every message says whether it was verified.
Bodies are stored byte for byte. Read them back from /raw and the sender's signature still verifies.
A VPS, a container, a box under your desk: one process per data directory, with TLS in front. No telemetry, no phone-home.
A sender gets its 2xx only after the message is committed and synced to disk. Forged signatures get a 401 and are never stored. Verifier secrets are encrypted at rest and tied to their inbox.
# inboxes.yaml · hookinlet apply -f inboxes.yaml
inboxes:
- slug: stripe
verifier: stripe
secret_env: STRIPE_WEBHOOK_SECRET
retention_days: 30
- slug: github
verifier: github
secret_env: GITHUB_WEBHOOK_SECRET
retention_max_count: 50000
- slug: slack
verifier: slack
secret_env: SLACK_SIGNING_SECRET
retention_days: 7
Every feature on this page. Your host, your data, your retention.
$ go install github.com/hookinlet/hookinlet/cmd/hookinlet@latest $ hookinlet serve && hookinlet apply -f inboxes.yaml
The same inboxes on a hosted endpoint, with nothing to deploy. Tell us what you'd use it for and we'll shape it around that.