mockbird.mockbird.workers.dev

Very long descriptions are sometimes used to bury instructions to the AI. Skim it before allowing.

This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.

The inspector returns captured headers (including arbitrary x-* headers) and body snippets for any request hitting the mock API. While authorization is redacted to its scheme, other sensitive headers (e.g. API keys sent as x-api-key, custom auth tokens) could be logged and returned verbatim to whoever holds the adminKey. This is inherent to the tool's debugging purpose but is a capability worth flagging since it could inadvertently surface credentials a user points at the mock endpoint during testing.

custom_route lets a caller define catch-all routes (e.g. /webhooks/*) that echo back {{headers.x}}, {{body}}, etc. Combined with inspect_requests, this creates a general-purpose request bin. This is a legitimate, disclosed feature for webhook testing, but agents should be cautious about using it to capture data from real third-party systems (e.g. pointing a production webhook at a catch-all route) since captured payloads/headers are retained and retrievable by anyone with the adminKey.

The notify parameter forwards monitoring alerts (with HMAC signature) to any HTTPS URL supplied by the caller. This is standard, disclosed functionality, but agents should confirm with the user before wiring monitoring data to a webhook endpoint, especially if the notify URL is inferred rather than explicitly provided by the user.

Same pattern as uptime_monitor: the notify parameter routes missed-check-in alerts to any external HTTPS endpoint. Disclosed and functional, but worth confirming the destination is genuinely user-intended rather than agent-assumed.

Same notify-to-arbitrary-webhook pattern as uptime_monitor/heartbeat; low risk but agents should verify the notify URL was explicitly provided by the user rather than guessed or reused from another context.