Skip to main content
Glama
MCP Events Bridge

MCP Events Bridge

Official

create_callback_url

Idempotent

Creates a public callback URL that forwards MCP Events webhook deliveries to an agent’s localhost port and path, enabling agents without a public URL to subscribe and receive events.

Instructions

Create a public callback URL for MCP Events webhook delivery, for an agent on this machine with no public URL of its own, then pass it to events/subscribe. Deliveries reach Hookdeck Event Gateway at the URL, and the bridge forwards them to http://localhost:. With secret, Event Gateway answers the subscribe challenge and accepts only deliveries signed with it. Without it, the URL is pass-through and your receiver must verify every delivery: use that when you subscribe with a different secret per path under one URL. Deliveries are signed with your subscription secret: route them by X-MCP-Subscription-Id and dedupe by webhook-id. Calling again with the same agent, name and secret returns the existing URL; a different secret, or a port or path you pass that differs, is an error. A URL no subscription uses for an hour is deleted. Not needed if your agent has a public URL or polls (wait_for_event, poll_events).

Input Schema

NameRequiredDescriptionDefault
nameYesA name for this URL (up to 40 letters, digits or _), e.g. "email_from_alice". Reusing a name with the same secret returns that URL.
pathNoLocal path deliveries are forwarded to. Set by the agent's first URL (default /events) and shared by the rest.
portNoLocal port your agent receives deliveries on. Set by the agent's first URL (default 3000) and shared by the rest.
agentYesYour agent or machine name (up to 40 letters, digits or _), e.g. "laptop". It names an Event Gateway destination shared by its URLs, so keep it unique in the Hookdeck project.
secretNoThe whsec_ secret you will subscribe with. One URL holds one secret: to rotate, create a URL with a new name. Omit for a pass-through URL.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.8.1

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: it explains the delivery path (Hookdeck Event Gateway forwarding to localhost:<port><path>), what the secret changes (challenge answering and signed-delivery enforcement vs pass-through), the idempotency contract, the error condition on conflicting secret/port/path, and the one-hour unused-URL deletion. That TTL and the challenge behavior are not derivable from readOnlyHint/idempotentHint/destructiveHint alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action and the primary use case, and nearly every clause carries operational information (routing header, dedupe header, TTL, error conditions). It is a single dense paragraph with several stacked colon-clauses, so the secret-mode versus pass-through-mode distinction takes a second pass to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a creation tool with no output schema and five parameters, the description covers success (returns the URL, or the existing one), failure (conflicting secret/port/path), lifecycle (hour-based deletion), and how the returned URL is consumed downstream. Nothing an agent needs in order to call it correctly and interpret the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage the baseline is 3, and the description adds real cross-parameter meaning: reusing agent+name+secret returns the existing URL, while a differing secret or a differing port/path is an error. It also clarifies the one-secret-per-URL rule and that rotation requires a new name. Only port/path values themselves are left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Create a public callback URL for MCP Events webhook delivery") plus the exact scope: an agent on this machine with no public URL. It explicitly contrasts with the siblings wait_for_event and poll_events, so an agent can pick the right tool without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a positive condition (no public URL of its own), the downstream step (pass it to events/subscribe), and an explicit exclusion ("Not needed if your agent has a public URL or polls") naming the alternative tools. It also resolves the secret-vs-no-secret fork with a stated criterion (different secret per path under one URL).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.