MCP server

CommerceHook ships a hosted MCP (Model Context Protocol) server at https://mcp.commercehook.app/mcp, so AI coding agents can inspect your webhooks directly: “what did the last order webhook contain?” becomes a question your agent can answer with the real payload in front of it.

claude.ai: add it as a connector

In Claude, go to Settings → Connectors → Add custom connector and give it the server URL:

https://mcp.commercehook.app/mcp

Claude will send you to CommerceHook to sign in and approve the connection. There is no key to create, copy or paste, and nothing to configure: sign in the way you normally do (magic link or passkey), press Allow access, and the connector is live.

A connected app gets the same access an API key has, which is everything your account can reach. It appears under Connected apps in settings, where revoking it cuts it off on its next request.

Claude Code and Cursor: use an API key

Clients that take a config file authenticate with an API key created in settings.

Claude Code:

claude mcp add --transport http commercehook https://mcp.commercehook.app/mcp --header "Authorization: Bearer chk_your_key_here"

Cursor (.cursor/mcp.json) and other clients that take JSON config:

{
  "mcpServers": {
    "commercehook": {
      "url": "https://mcp.commercehook.app/mcp",
      "headers": {
        "Authorization": "Bearer chk_your_key_here"
      }
    }
  }
}

Tools

The tool set mirrors the REST API exactly:

• get_account: whose key this is, and the plan
• list_endpoints: every endpoint with its URL, event count, and last-received time
• create_endpoint: returns the URL to register as a webhook destination
• rename_endpoint, delete_endpoint: delete is permanent and removes stored events, and its description tells agents to confirm with you first
• list_events: newest first, with search (q) and cursor pagination
• get_event: the full payload, raw body, and the headers as stored (credential values redacted, Cloudflare’s transit headers not kept)
• export_events: the endpoint’s stored history in one call, as export JSON or a HAR capture, with the same q filter as list_events
• replay_event: re-fire a stored event at your real handler and report what it did

Every tool also declares what it does before it does it, using the standard MCP hints: whether it only reads, whether it can destroy something, and whether it reaches outside CommerceHook. Two are worth knowing:

• delete_endpoint is the only tool marked destructive. Clients that ask before destructive calls will now ask before this one.
• replay_event is the only tool marked open-world, because it sends a request to a URL you supply and whatever your handler then does is outside our reach.

Notes

• The MCP server calls the same API your dashboard uses, so ownership rules and the rate limit (120 requests/minute) apply as normal, per API key or per connected app.
• Revoking an API key, or a connected app, cuts the agent off immediately.
• The OAuth flow is standard: PKCE is required, clients register themselves (RFC 7591), and the metadata lives at /.well-known/oauth-protected-resource/mcp on the MCP host, so any compliant client can find its own way in.
• Try it: connect, then ask your agent to “list my CommerceHook endpoints and show the most recent event”.