io.github.pipehero/pipehero

Est-ce que io.github.pipehero/pipehero est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.pipehero/pipehero » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 25 outils

• add_api_example≈ 314 tokens

  Save a response example on an endpoint (for instance the 402 your handler returns for a declined card). Replaces the example with the same name, so it is safe to repeat.

  Paramètres, retour & exemple (9)

  Paramètres

  • body · ? · optionnel
    Example response body (any JSON).
  • name · string · requis
    e.g. Card declined.
  • path · string · optionnel
    Route path as written in the code, e.g. /v1/charges/:id or /v1/charges/{id}.
  • method · string · optionnel
    HTTP method of the route, e.g. POST. Use with path instead of endpoint_id.
  • status · integer · requis
  • headers · array · optionnel
  • endpoint_id · string · optionnel
    Id of the endpoint. Alternative to method + path.
  • status_text · string · optionnel
  • collection_id · string · requis
    Id from list_api_collections.

  Exemple d'appel

  {"name": "add_api_example", "arguments": {"name": "texte", "status": 1, "collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_api_drift≈ 264 tokens

  Compare a collection's docs with the real traffic a tunnel captured (Pro/Team). Returns routes nobody documented, status codes with no example, response or request fields missing from every example (or with another type), undocumented query parameters, and documented fields that never appear. Each finding includes `request_id` of the newest request that shows it: pass it to save_captured_request to add it to the docs, or fix the docs with upsert_api_endpoint and add_api_example. Use it to find out what drifted after a code change.

  Paramètres, retour & exemple (3)

  Paramètres

  • limit · integer · optionnel
    How many recent requests to compare (default 200, max 500).
  • tunnel · string · requis
    Subdomain of the tunnel whose traffic to compare.
  • collection_id · string · requis

  Exemple d'appel

  {"name": "check_api_drift", "arguments": {"tunnel": "texte", "collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_api_collection≈ 119 tokens

  Create an empty API collection. Prefer import_api_spec when there is an OpenAPI file, and upsert_api_endpoint to fill it from the code.

  Paramètres, retour & exemple (2)

  Paramètres

  • name · string · requis
  • description · string · optionnel

  Exemple d'appel

  {"name": "create_api_collection", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• delete_api_endpoint≈ 204 tokens

  Delete an endpoint and its examples. Use when the route no longer exists in the code. Cannot be undone.

  Paramètres, retour & exemple (4)

  Paramètres

  • path · string · optionnel
    Route path as written in the code, e.g. /v1/charges/:id or /v1/charges/{id}.
  • method · string · optionnel
    HTTP method of the route, e.g. POST. Use with path instead of endpoint_id.
  • endpoint_id · string · optionnel
    Id of the endpoint. Alternative to method + path.
  • collection_id · string · requis
    Id from list_api_collections.

  Exemple d'appel

  {"name": "delete_api_endpoint", "arguments": {"collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• export_api_collection≈ 114 tokens

  Export a collection as an OpenAPI 3.1 or Postman 2.1 document. Handy to read the whole API at once.

  Paramètres, retour & exemple (2)

  Paramètres

  • format · string · optionnel · openapi | postman
  • collection_id · string · requis

  Exemple d'appel

  {"name": "export_api_collection", "arguments": {"collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_api_collection≈ 105 tokens

  Get one collection's folders, endpoints (id, method, path, name, version, example count) and environments (with their variables).

  Paramètres, retour & exemple (1)

  Paramètres

  • collection_id · string · requis

  Exemple d'appel

  {"name": "get_api_collection", "arguments": {"collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_api_endpoint≈ 214 tokens

  Get one endpoint in full: description, parameters, headers, request body, saved response examples and its current `version`. Identify it by endpoint_id or by method + path.

  Paramètres, retour & exemple (4)

  Paramètres

  • path · string · optionnel
    Route path as written in the code, e.g. /v1/charges/:id or /v1/charges/{id}.
  • method · string · optionnel
    HTTP method of the route, e.g. POST. Use with path instead of endpoint_id.
  • endpoint_id · string · optionnel
    Id of the endpoint. Alternative to method + path.
  • collection_id · string · requis
    Id from list_api_collections.

  Exemple d'appel

  {"name": "get_api_endpoint", "arguments": {"collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_api_share_link≈ 252 tokens

  Get the shareable link of an endpoint (a read-only page with its docs, examples and latest run, secrets hidden), who can open it and who was invited. Use it to put the link in a PR, an issue or a message. Each endpoint has one link that never changes; `shared: false` means it has none yet (see share_api_endpoint).

  Paramètres, retour & exemple (4)

  Paramètres

  • path · string · optionnel
    Route path as written in the code, e.g. /v1/charges/:id or /v1/charges/{id}.
  • method · string · optionnel
    HTTP method of the route, e.g. POST. Use with path instead of endpoint_id.
  • endpoint_id · string · optionnel
    Id of the endpoint. Alternative to method + path.
  • collection_id · string · requis
    Id from list_api_collections.

  Exemple d'appel

  {"name": "get_api_share_link", "arguments": {"collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_request≈ 98 tokens

  Get the full request and response (headers + body) of one captured webhook by id.

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
  • subdomain · string · requis

  Exemple d'appel

  {"name": "get_request", "arguments": {"id": "texte", "subdomain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• import_api_spec≈ 227 tokens

  Import an OpenAPI 3.x document (as JSON), a Postman v2.x collection (JSON) or a curl command into a new collection, or into `collection_id`. All or nothing, and plan limits are checked first. Credentials are never imported (they become variables). Convert YAML to JSON before sending.

  Paramètres, retour & exemple (4)

  Paramètres

  • name · string · optionnel
    Name for the new collection.
  • format · string · requis · openapi | postman | har | curl
  • content · ? · requis
    The document (object or JSON string), or the curl command.
  • collection_id · string · optionnel
    Add to this collection instead of creating one.

  Exemple d'appel

  {"name": "import_api_spec", "arguments": {"format": "openapi", "content": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_api_collections≈ 87 tokens

  List the workspace's API collections (saved endpoints with examples and environments). Start here to find a collection_id.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_api_collections", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_api_monitors≈ 166 tokens

  See which endpoints of a collection are checked on a schedule (Pro/Team monitors) and how they are doing: state (healthy, failing, blip, paused, waiting), the last check with its status, latency and error, and since when it has been failing. Use it to find out what is broken in staging or production, then read the endpoint and its code. Read-only: people decide what to monitor.

  Paramètres, retour & exemple (1)

  Paramètres

  • collection_id · string · requis

  Exemple d'appel

  {"name": "list_api_monitors", "arguments": {"collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_api_proposals≈ 144 tokens

  See what happened to the changes you proposed. Some workspaces review AI changes: your write tools then answer `pending_review` and change nothing until a teammate approves. This lists the latest proposals with their status (pending, approved, rejected with the reviewer's reason, or failed with why) so you can tell whether a change went through.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_api_proposals", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_api_runs≈ 219 tokens

  Recent runs of an endpoint (newest first, default 5): who/what was sent and what came back. Use to see what happened the last time it was run.

  Paramètres, retour & exemple (5)

  Paramètres

  • path · string · optionnel
    Route path as written in the code, e.g. /v1/charges/:id or /v1/charges/{id}.
  • limit · integer · optionnel
    1 to 20.
  • method · string · optionnel
    HTTP method of the route, e.g. POST. Use with path instead of endpoint_id.
  • endpoint_id · string · optionnel
    Id of the endpoint. Alternative to method + path.
  • collection_id · string · requis
    Id from list_api_collections.

  Exemple d'appel

  {"name": "list_api_runs", "arguments": {"collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_requests≈ 94 tokens

  List recent webhooks/requests captured for a tunnel. Returns id, method, path, status and bodies.

  Paramètres, retour & exemple (1)

  Paramètres

  • subdomain · string · requis

  Exemple d'appel

  {"name": "list_requests", "arguments": {"subdomain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_tunnels≈ 70 tokens

  List the user's Pipehero tunnels and whether each is currently online.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_tunnels", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• replay_request≈ 103 tokens

  Replay a captured webhook to the user's localhost (the tunnel CLI must be running).

  Paramètres, retour & exemple (2)

  Paramètres

  • id · string · requis
  • subdomain · string · requis

  Exemple d'appel

  {"name": "replay_request", "arguments": {"id": "texte", "subdomain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• run_api_endpoint≈ 380 tokens

  Send an endpoint against an environment and return the real response (status, headers, body up to 20 KB). A `local` environment goes through the user's tunnel to their localhost (the CLI must be running); staging/prod are sent from Pipehero's cloud (Pro/Team) to public addresses only. Sending to a `prod` environment with a write method needs confirm_write_to_prod: true, which you should only pass after the user agrees. Use it to check that the code you wrote behaves as documented.

  Paramètres, retour & exemple (7)

  Paramètres

  • path · string · optionnel
    Route path as written in the code, e.g. /v1/charges/:id or /v1/charges/{id}.
  • method · string · optionnel
    HTTP method of the route, e.g. POST. Use with path instead of endpoint_id.
  • variables · object · optionnel
    Values for {{variables}} the environment doesn't define, e.g. {"id": "ch_123"}.
  • endpoint_id · string · optionnel
    Id of the endpoint. Alternative to method + path.
  • environment · string · requis
    Environment name or id, e.g. local.
  • collection_id · string · requis
    Id from list_api_collections.
  • confirm_write_to_prod · boolean · optionnel

  Exemple d'appel

  {"name": "run_api_endpoint", "arguments": {"environment": "texte", "collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• save_captured_request≈ 345 tokens

  Document a real request captured by a tunnel (get its id from list_requests). If an endpoint already covers the route, the response is added to it as an example; otherwise an endpoint is created from the request. Credentials, cookies and signatures are replaced by {{variables}} and only JSON bodies are kept. A response already saved as an example is not duplicated. Use it to document webhooks and calls you have only seen in traffic.

  Paramètres, retour & exemple (7)

  Paramètres

  • path · string · optionnel
  • folder · string · optionnel
    Folder for a newly created endpoint, created by name if missing.
  • method · string · optionnel
    With path: the endpoint that should receive the example.
  • tunnel · string · requis
    Subdomain of the tunnel that captured the request.
  • request_id · string · requis
    Id of the captured request, from list_requests.
  • endpoint_id · string · optionnel
    Add the example to this endpoint instead of matching by route. Alternative to method + path.
  • collection_id · string · requis

  Exemple d'appel

  {"name": "save_captured_request", "arguments": {"tunnel": "texte", "request_id": "texte", "collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• send_test_webhook≈ 188 tokens

  Send a generated test webhook to the user's localhost (the tunnel CLI must be running). Provide a `provider` (stripe, github, shopify, clerk, slack, resend, paddle, polar, lemonsqueezy) and optional `event` for a realistic sample payload, or pass a custom JSON `body`. Pro plan required.

  Paramètres, retour & exemple (4)

  Paramètres

  • body · string · optionnel
    Custom JSON body (overrides the template)
  • event · string · optionnel
  • provider · string · requis
  • subdomain · string · requis

  Exemple d'appel

  {"name": "send_test_webhook", "arguments": {"provider": "texte", "subdomain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• set_long_requests≈ 152 tokens

  Opt a tunnel into a 120-second ingress timeout instead of the 30-second default — for tool calls that legitimately run long, e.g. an MCP server exposed through the tunnel. Persists on the tunnel; pass enabled: false to revert to the 30-second default.

  Paramètres, retour & exemple (2)

  Paramètres

  • enabled · boolean · requis
  • subdomain · string · requis

  Exemple d'appel

  {"name": "set_long_requests", "arguments": {"enabled": true, "subdomain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• set_ws_passthrough≈ 150 tokens

  Opt a tunnel into WebSocket passthrough, so an application-level WebSocket connection (e.g. a mobile/web app's own realtime feature) can be relayed to your localhost. Pro/Team plan required to enable; pass enabled: false to disable on any plan.

  Paramètres, retour & exemple (2)

  Paramètres

  • enabled · boolean · requis
  • subdomain · string · requis

  Exemple d'appel

  {"name": "set_ws_passthrough", "arguments": {"enabled": true, "subdomain": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• share_api_collection≈ 312 tokens

  Share a whole collection: every endpoint in it (including ones added later), with its examples and latest run, read-only and with secrets hidden. Environments are never shown and it can't be exported. Returns the collection's link, which never changes. With no other arguments it stays restricted to the workspace; set `link_access` or `invite` people only when the user asks to share it outside the team. get_api_collection returns the link as `share` once it exists.

  Paramètres, retour & exemple (3)

  Paramètres

  • invite · array · optionnel
    People to invite by email (at most 10). Each gets an email.
  • link_access · string · optionnel · restricted | viewer | commenter
    Who can open it with just the link. Omit to keep the current setting (restricted for a new share).
  • collection_id · string · requis

  Exemple d'appel

  {"name": "share_api_collection", "arguments": {"collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• share_api_endpoint≈ 438 tokens

  Create an endpoint's shareable link and return it. With no other arguments the link stays restricted: workspace members can open it (they sign in), which is enough for a PR or an internal message. Only when the user asks to share it outside the workspace: set `link_access` to `viewer` (anyone with the link can read) or `commenter` (Team plan; commenting asks for sign-in), or `invite` people by email (they get an email and sign in with that address). `restricted` turns the public link off; the URL stays the same. The page is read-only and always hides credentials and secrets.

  Paramètres, retour & exemple (6)

  Paramètres

  • path · string · optionnel
    Route path as written in the code, e.g. /v1/charges/:id or /v1/charges/{id}.
  • invite · array · optionnel
    People to invite by email (at most 10). Each gets an email.
  • method · string · optionnel
    HTTP method of the route, e.g. POST. Use with path instead of endpoint_id.
  • endpoint_id · string · optionnel
    Id of the endpoint. Alternative to method + path.
  • link_access · string · optionnel · restricted | viewer | commenter
    Who can open it with just the link. Omit to keep the current setting (restricted for a new share).
  • collection_id · string · requis
    Id from list_api_collections.

  Exemple d'appel

  {"name": "share_api_endpoint", "arguments": {"collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• upsert_api_endpoint≈ 432 tokens

  Document an endpoint: creates it, or updates the existing one for the same method + path. Use it whenever you add or change a route in the code, so the docs stay true. Only the fields you send change. `path` may use :id, {id} or {{id}} for variables. `folder` is created by name if missing. Send `version` (from get_api_endpoint) to avoid overwriting a teammate's edit; a stale version is rejected.

  Paramètres, retour & exemple (11)

  Paramètres

  • body · ? · optionnel
    Example request body (any JSON). null clears it.
  • kind · string · optionnel · http | event
    `event` for a webhook your app sends.
  • name · string · optionnel
    Short title, e.g. Create a charge. Defaults to METHOD /path.
  • path · string · requis
  • folder · string · optionnel
    Folder name, e.g. Charges.
  • method · string · requis
  • params · array · optionnel
    Documented fields.
  • headers · array · optionnel
  • version · integer · optionnel
  • description · string · optionnel
  • collection_id · string · requis

  Exemple d'appel

  {"name": "upsert_api_endpoint", "arguments": {"path": "texte", "method": "texte", "collection_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.pipehero.app/mcp