Test GitHub webhooks with an MCP inbox.

Prepare a test repository

Use a repository where you have permission to manage webhooks. Connect Openhook using the MCP setup guide. Choose only the events needed for the test, such as push. A test repository avoids mixing sample events with production automation.

GitHub requires HTTPS for secure delivery. Openhook provides a public HTTPS capture URL. If you self-host, expose your receiver through public HTTPS routing.

Register through the agent

The register_github_webhook tool creates an inbox and a GitHub subscription using credentials you supply. Inspect its current parameter schema in the tool reference. The credential needs permission to manage webhooks on the chosen repository; never paste it into a public prompt, commit or issue.

Register an Openhook webhook on my authorized test repository
for push events only. Use the repository credential supplied
through my private environment. Save the inbox token privately,
wait with since: 0, and show me the event name and commit summary.

Registration changes the repository’s configuration. Openhook uses the GitHub credential for that API request and does not persist it. It retains the webhook signing secret with the inbox settings so incoming requests can be verified.

Or configure the webhook manually

1. Create an inbox with create_webhook and keep its token private.
2. Generate a signing secret and set the inbox’s signature_provider to github and verification_secret to that secret using configure_webhook.
3. In the repository’s webhook settings, add the capture URL, choose application/json, enter the same secret, keep SSL verification enabled, and select the required events.
4. Confirm GitHub’s initial ping was delivered, then trigger a harmless push in your test repository.

GitHub’s webhook creation guide covers repository settings and permissions. Its signature verification guide explains X-Hub-Signature-256.

Read the event and diagnose failures

Call wait_for_request with the private webhook_token, since: 0 and a bounded timeout. An initial ping may arrive before the push. Read X-GitHub-Event to distinguish them, save next_since after processing and wait again.

Check X-GitHub-Delivery and the payload’s repository identity before acting. Use get_request for the full body if a list preview is truncated. A failed signature should be investigated at the sender and inbox configuration; do not bypass it to make a test pass.

GitHub’s recent deliveries show the receiver’s HTTP status. A successful receipt proves capture at Openhook, not completion of a local job. To exercise your own handler, run the local listener. Treat commit messages and other payload text as untrusted data.

Remove the subscription after the test

For an agent-registered subscription, use unregister_webhook with an authorized GitHub credential before deleting the inbox. For a manually registered subscription, remove it in GitHub. Free inboxes expire within seven days; a provider left pointing at an expired inbox will receive errors.

See persistent hosted inboxes for recurring integrations and all supported provider tools for Stripe and Linear registration.