~/docs
## REST
$ # create a bin
curl -X POST https://hooklens-brown.vercel.app/api/bins -H 'content-type: application/json' -d '{"name":"stripe"}'
curl -X POST https://hooklens-brown.vercel.app/api/bins -H 'content-type: application/json' -d '{"name":"stripe"}'
$ # catch a webhook (any method works)
curl -X POST https://hooklens-brown.vercel.app/api/hook/bin_abc123 -d '{"type":"order.paid"}'
curl -X POST https://hooklens-brown.vercel.app/api/hook/bin_abc123 -d '{"type":"order.paid"}'
$ # read captures / inspect one / export
curl https://hooklens-brown.vercel.app/api/bins/bin_abc123/requests?limit=10
curl https://hooklens-brown.vercel.app/api/bins/bin_abc123/requests/req_xyz
curl -O https://hooklens-brown.vercel.app/api/bins/bin_abc123/export
curl https://hooklens-brown.vercel.app/api/bins/bin_abc123/requests?limit=10
curl https://hooklens-brown.vercel.app/api/bins/bin_abc123/requests/req_xyz
curl -O https://hooklens-brown.vercel.app/api/bins/bin_abc123/export
$ # rename / clear / delete
curl -X PATCH https://hooklens-brown.vercel.app/api/bins/bin_abc123 -d '{"name":"prod"}'
curl -X DELETE https://hooklens-brown.vercel.app/api/bins/bin_abc123/requests
curl -X DELETE https://hooklens-brown.vercel.app/api/bins/bin_abc123
curl -X PATCH https://hooklens-brown.vercel.app/api/bins/bin_abc123 -d '{"name":"prod"}'
curl -X DELETE https://hooklens-brown.vercel.app/api/bins/bin_abc123/requests
curl -X DELETE https://hooklens-brown.vercel.app/api/bins/bin_abc123
## MCP (agents)
Point any MCP client at https://hooklens-brown.vercel.app/api/mcp (JSON-RPC 2.0: initialize / tools/list / tools/call). Full manifest: /mcp.json.
$ tools: create_bin · list_bins · get_requests · inspect_request · clear_bin
$ mcp console → https://hooklens-brown.vercel.app/api/mcp
Click a preset — every call below hits the live database.
$ # mcp.json for your agent config
{
"mcpServers": {
"hooklens": { "url": "https://hooklens-brown.vercel.app/api/mcp", "transport": "json-rpc" }
}
}## integrity
Every capture is sealed at arrival: SHA-384(prevSeal ‖ canonicalJson) chained per bin. The inspector replays the chain and shows seal ok or seal BROKEN — export the JSON and anyone can re-verify offline.
## limits
Bodies capped at 256 KB, 50 headers stored, latest 100 captures per bin readable. This is a debugging tool — never POST real secrets, cards, or PII through it.