Knock vs ntfy

Knock

Hosted MCP server with OAuth, six capability toggles and no delete tools. Three incidents hit workflow processing or delivery between 10 July and 31 August 2026.

ntfy

Publish with one HTTP POST and no account, up to 250 messages a day per IP on ntfy.sh. Unreserved topics on ntfy.sh can be read and written by anyone who knows the name.

Knock

1. Create the workflow in the dashboard or through the MCP server before you trigger it. Triggers reference it by key
2. Send an Idempotency-Key on every trigger. It holds 24 hours and only the trigger endpoint accepts it
3. Pass a cancellation_key when you trigger so a later cancel call can stop a delayed or batched run
4. Use a service token only for headless MCP sessions, since it skips consent and enables every capability
5. Keep test and production apart. Rate limits and keys are scoped to an environment

ntfy

1. Use a long random topic name, or a reserved topic with a Bearer token
2. Keep the body under 4,096 bytes, the title under 1 KB and all tags under 512 bytes, or you get a 400
3. Don't blind-retry a publish. There's no idempotency key, so the person gets it twice
4. Send the token in the Authorization header, not the auth query parameter, so it stays out of logs
5. Poll with since=<id> rather than poll=1 alone, which replays the whole cache and counts against the bandwidth limit