{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/hookdeck.json", "name": "Hookdeck", "score": 76.9, "shared": [ "events.webhooks-send" ], "slug": "hookdeck" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/ably.json", "name": "Ably", "score": 75, "shared": [ "events.webhooks-send" ], "slug": "ably" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/svix.json", "name": "Svix", "score": 74, "shared": [ "events.webhooks-send" ], "slug": "svix" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/upstash-qstash.json", "name": "Upstash QStash", "score": 72.3, "shared": [ "events.webhooks-send" ], "slug": "upstash-qstash" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/basecamp.json", "name": "Basecamp", "score": 67.9, "shared": [ "events.webhooks-send" ], "slug": "basecamp" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/plane.json", "name": "Plane", "score": 67.6, "shared": [ "events.webhooks-send" ], "slug": "plane" } ], "tool": { "slug": "hook0", "name": "Hook0", "vendor": "FGRibreau SARL", "vendorUrl": "https://www.hook0.com", "kind": "http-api", "category": "webhooks", "summary": "Hook0 is a webhook sending service from FGRibreau SARL in France. An application posts events to a REST API and Hook0 signs, retries and logs deliveries to subscriber endpoints. It runs as an EU-hosted cloud or self-hosted under SSPL-1.0.", "url": "https://www.anchorterminal.com/tools/hook0", "markdownUrl": "https://www.anchorterminal.com/tools/hook0.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/hook0.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/hook0.json", "repo": "https://github.com/hook0/hook0", "license": "SSPL-1.0 for the server (source available, not an OSI licence). The SDKs and the `hook0-mcp` server are MIT per crates.io and npm. Hook0 Cloud is a hosted service under Hook0's terms of service", "transports": [ "http", "stdio" ], "packages": [ { "registry": "npm", "name": "hook0-client" }, { "registry": "pypi", "name": "hook0-client" }, { "registry": "cargo", "name": "hook0-mcp" } ], "auth": "api-key", "authNotes": "Every call takes `Authorization: Bearer \u003ctoken\u003e` at https://app.hook0.com/api/v1. A person signs up in a browser, passes a Cloudflare Turnstile check and verifies an email address, then creates a service token in the dashboard. Service tokens are Biscuit tokens scoped to one organisation, and the holder can narrow one offline to a single application, an expiry date or an allowlist of actions. Each application also has secrets that work as Bearer tokens with full control of that application. No OAuth for API clients.", "pricing": "freemium", "pricingNotes": "Free Developer plan with no card, 100 events a day, one application and 7 days of retention, and a 429 once the quota is used. Startup is €59 a month for 30,000 events a day, then €0.003 an event. Pro is €190 a month for 100,000 events a day, then €0.0001 an event. Prices exclude VAT and are published in euros only. Subscriptions and retries aren't counted. Self-hosting is free, and a managed on-premise instance is €500 a month plus €1,000 setup (checked 2026-10-08).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation index, the OpenAPI document, the repository or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 23, "popularity": { "githubStars": 1494, "npmWeekly": 507, "pypiWeekly": 11, "asOf": "2026-10-08" }, "docsUrl": "https://documentation.hook0.com/", "llmsTxt": "https://documentation.hook0.com/llms.txt", "openapi": "https://app.hook0.com/api/v1/swagger.json", "capabilities": [ "events.webhooks-send" ], "tags": [ "hosted", "self-hosted", "source-available", "webhooks", "api-key", "openapi", "llms-txt", "mcp", "free-tier", "no-card", "status-page", "eu-hosted", "typescript", "python", "rust", "go" ], "lastRelease": "2026-09-21", "graded": true, "anchor": { "graded": true, "score": 64.6, "grade": "B", "agentReady": false, "rank": 313, "ranked": true, "rankOf": 842, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 87, "payments": 40, "reliability": 70, "schema": 79, "security": 64, "transparency": 84 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 70, "points": 14, "reason": "Graded as a hosted service, Hook0 Cloud. status.hook0.com on Better Stack lists twelve components with 90 days of daily history (20). Two incident reports fall in the 90 days to 8 October 2026. On 27 August the API and delivery were unavailable for about 18 minutes, and on 22 September an object storage outage at the host stopped ingestion and delivery, with the page recording 12 minutes on the API and 73 minutes on the delivery workers. The daily history also records about 18 minutes of API downtime on 13 July and 15 minutes on 8 October. We read the 22 September delivery outage as one major outage (10). Limits of 10 requests a second per token, 100 per IP and 1,000 overall are documented, with daily event quotas by plan (15). A 429 carries `Retry-After` and its problem text says the request is safe to resend, and a client `event_id` makes ingestion retries safe (15). The terms state that no uptime commitment exists outside a signed Enterprise agreement (0). The API is at version 1.0.2 and generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 79, "points": 12.84, "reason": "OpenAPI 3.0 document served without a login at app.hook0.com/api/v1/swagger.json, 56 operations on 38 paths (25). llms.txt on both the site and the documentation, listing every documentation page (10). Every operation has a summary and a description that states its purpose and often when to use it, with little on when not to (14). Required fields, UUID and date-time formats and length limits are typed, but the snapshot holds nine enums, `payload_content_type` lists its valid values only in prose and `labels` is a free map by design (10). Ten error statuses on every operation and a reference of 46 error codes with sample bodies, against two examples in the spec. The API introduction page shows a different error body and `limit`, `offset` and `sort` parameters that the spec doesn't have (10). The path carries `/api/v1`, each component has a changelog in the repository and tagged releases on GitLab, and the documentation's changelog page only links to GitHub Releases (10)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 65, "points": 10.56, "reason": "`GET /api/v1/events/` returns the 100 most recent events with no size or field parameter. The MCP server has 23 tools, or 13 in read-only mode (12). Only the delivery attempt list is paginated, by cursor through a `Link` header, with filters for event, subscription, date range and event type. Other lists take `application_id` alone (8). Errors are RFC 7807 problems with a stable `id` and a documentation URL per code, though the API introduction page describes another shape (18). A client-supplied `event_id` is rejected on reuse with `EventAlreadyIngested`, the SDKs mint the id before retrying and `POST /api/v1/events/{event_id}/replay` resends an event. The MCP tools carry no read-only or destructive annotations (15). An event needs six fields. Official clients exist for eleven languages (12)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 64, "points": 11.2, "reason": "Service tokens are Biscuit tokens, revocable from the dashboard or the API, which the holder can narrow offline to one application, an expiry date or an allowlist of actions. Revoking a root token invalidates every token derived from it. Application secrets can't be narrowed and control their whole application. No OAuth for API clients (28). A read-only token is documented with the claim to paste, and `HOOK0_READ_ONLY` hides the MCP server's ten write tools. Deletes need no confirmation (14). Delivery logs return subscriber endpoints' response bodies, which are third-party content, and no guidance for agents reading them was found (5). Every delivery attempt is stored with its response. The security model page shows an audit log record, but no audit log an operator can read was found in the API or the documentation (7). Valid security.txt, a disclosure policy with a discretionary reward for critical findings, a PGP key and advisories published with credits. Hook0 holds no SOC 2 or ISO 27001 certificate of its own and cites its host's (10)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "Graded on Hook0 Cloud. No x402, MPP or L402 (0). Plan prices and per-event overage (€0.003 on Startup, €0.0001 on Pro) are public (20). The Developer plan is free with no card, limited to 100 events a day (20). `POST /api/v1/register/` exists, but the cloud instance requires a Cloudflare Turnstile token and email verification, so a person has to sign up (0). The self-hosted server is free to run. We graded the hosted service." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 87, "points": 7.61, "reason": "The newest tagged release is `frontend/v1.2.1` on 21 September 2026, 17 days before this check, and the default branch had commits on 8 October (30). Since 10 July GitLab lists nine component releases, among them `mcp/v3.0.0` on 26 August and five output worker releases in early August, and the SDKs went from 2.0.0 to 2.0.3 between 25 and 28 August (20). GitLab shows eight open issues, the latest updated on 2 October 2026 and five untouched since December 2025. Six security reports were fixed and published between August and September. Support is by email and Discord (15). Clients for eleven languages are generated from the API snapshot, with `hook0-client` 2.0.3 on npm, PyPI and crates.io (15). Dependency update commits landed on 29 September and the repository has GitLab CI, OSV and Trivy configuration. We couldn't read the pipeline results (7)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 84, "points": 7.35, "note": "editorial 76, provenance 91", "reason": "The server's source is public under SSPL-1.0, which the terms themselves say the OSI hasn't approved, and the SDKs and MCP server are MIT. The cloud runs the same code (20). A privacy policy updated 9 September 2026, a published DPA and terms that agree on retention, 7, 14 and 30 days of event data by plan and 30 days after termination, with breach notice within 72 hours and a public Article 30 register (28). The terms of sale promise 90 days' notice before the free plan is cut and the terms 30 days for material changes. No deprecation policy for the API was found (8). Sub-processors are listed with countries, and the data plane is on Clever Cloud in France with Cloudflare in front (20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "`GET /api/v1/events/` returns the 100 most recent events with no size or field parameter. The MCP server has 23 tools, or 13 in read-only mode (12). Only the delivery attempt list is paginated, by cursor through a `Link` header, with filters for event, subscription, date range and event type. Other lists take `application_id` alone (8). Errors are RFC 7807 problems with a stable `id` and a documentation URL per code, though the API introduction page describes another shape (18). A client-supplied `event_id` is rejected on reuse with `EventAlreadyIngested`, the SDKs mint the id before retrying and `POST /api/v1/events/{event_id}/replay` resends an event. The MCP tools carry no read-only or destructive annotations (15). An event needs six fields. Official clients exist for eleven languages (12).", "maintenance": "The newest tagged release is `frontend/v1.2.1` on 21 September 2026, 17 days before this check, and the default branch had commits on 8 October (30). Since 10 July GitLab lists nine component releases, among them `mcp/v3.0.0` on 26 August and five output worker releases in early August, and the SDKs went from 2.0.0 to 2.0.3 between 25 and 28 August (20). GitLab shows eight open issues, the latest updated on 2 October 2026 and five untouched since December 2025. Six security reports were fixed and published between August and September. Support is by email and Discord (15). Clients for eleven languages are generated from the API snapshot, with `hook0-client` 2.0.3 on npm, PyPI and crates.io (15). Dependency update commits landed on 29 September and the repository has GitLab CI, OSV and Trivy configuration. We couldn't read the pipeline results (7).", "payments": "Graded on Hook0 Cloud. No x402, MPP or L402 (0). Plan prices and per-event overage (€0.003 on Startup, €0.0001 on Pro) are public (20). The Developer plan is free with no card, limited to 100 events a day (20). `POST /api/v1/register/` exists, but the cloud instance requires a Cloudflare Turnstile token and email verification, so a person has to sign up (0). The self-hosted server is free to run. We graded the hosted service.", "reliability": "Graded as a hosted service, Hook0 Cloud. status.hook0.com on Better Stack lists twelve components with 90 days of daily history (20). Two incident reports fall in the 90 days to 8 October 2026. On 27 August the API and delivery were unavailable for about 18 minutes, and on 22 September an object storage outage at the host stopped ingestion and delivery, with the page recording 12 minutes on the API and 73 minutes on the delivery workers. The daily history also records about 18 minutes of API downtime on 13 July and 15 minutes on 8 October. We read the 22 September delivery outage as one major outage (10). Limits of 10 requests a second per token, 100 per IP and 1,000 overall are documented, with daily event quotas by plan (15). A 429 carries `Retry-After` and its problem text says the request is safe to resend, and a client `event_id` makes ingestion retries safe (15). The terms state that no uptime commitment exists outside a signed Enterprise agreement (0). The API is at version 1.0.2 and generally available (10).", "schema": "OpenAPI 3.0 document served without a login at app.hook0.com/api/v1/swagger.json, 56 operations on 38 paths (25). llms.txt on both the site and the documentation, listing every documentation page (10). Every operation has a summary and a description that states its purpose and often when to use it, with little on when not to (14). Required fields, UUID and date-time formats and length limits are typed, but the snapshot holds nine enums, `payload_content_type` lists its valid values only in prose and `labels` is a free map by design (10). Ten error statuses on every operation and a reference of 46 error codes with sample bodies, against two examples in the spec. The API introduction page shows a different error body and `limit`, `offset` and `sort` parameters that the spec doesn't have (10). The path carries `/api/v1`, each component has a changelog in the repository and tagged releases on GitLab, and the documentation's changelog page only links to GitHub Releases (10).", "security": "Service tokens are Biscuit tokens, revocable from the dashboard or the API, which the holder can narrow offline to one application, an expiry date or an allowlist of actions. Revoking a root token invalidates every token derived from it. Application secrets can't be narrowed and control their whole application. No OAuth for API clients (28). A read-only token is documented with the claim to paste, and `HOOK0_READ_ONLY` hides the MCP server's ten write tools. Deletes need no confirmation (14). Delivery logs return subscriber endpoints' response bodies, which are third-party content, and no guidance for agents reading them was found (5). Every delivery attempt is stored with its response. The security model page shows an audit log record, but no audit log an operator can read was found in the API or the documentation (7). Valid security.txt, a disclosure policy with a discretionary reward for critical findings, a PGP key and advisories published with credits. Hook0 holds no SOC 2 or ISO 27001 certificate of its own and cites its host's (10).", "transparency": "The server's source is public under SSPL-1.0, which the terms themselves say the OSI hasn't approved, and the SDKs and MCP server are MIT. The cloud runs the same code (20). A privacy policy updated 9 September 2026, a published DPA and terms that agree on retention, 7, 14 and 30 days of event data by plan and 30 days after termination, with breach notice within 72 hours and a public Article 30 register (28). The terms of sale promise 90 days' notice before the free plan is cut and the terms 30 days for material changes. No deprecation policy for the API was found (8). Sub-processors are listed with countries, and the data plane is on Clever Cloud in France with Cloudflare in front (20)." }, "sources": [ { "what": "site index for assistants (llms.txt)", "url": "https://www.hook0.com/llms.txt", "seen": "2026-10-08" }, { "what": "documentation index (llms.txt)", "url": "https://documentation.hook0.com/llms.txt", "seen": "2026-10-08" }, { "what": "robots.txt, no Content-Signal line", "url": "https://www.hook0.com/robots.txt", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://www.hook0.com/pricing", "seen": "2026-10-08" }, { "what": "pricing and billing, quota behaviour", "url": "https://documentation.hook0.com/resources/pricing-billing", "seen": "2026-10-08" }, { "what": "terms of service", "url": "https://www.hook0.com/terms", "seen": "2026-10-08" }, { "what": "terms of sale", "url": "https://www.hook0.com/terms-of-sale", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://www.hook0.com/privacy-policy", "seen": "2026-10-08" }, { "what": "data processing addendum", "url": "https://www.hook0.com/data-processing-addendum", "seen": "2026-10-08" }, { "what": "security and compliance page", "url": "https://www.hook0.com/security", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.hook0.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "security advisories", "url": "https://documentation.hook0.com/resources/security-advisories", "seen": "2026-10-08" }, { "what": "vulnerability disclosure policy", "url": "https://documentation.hook0.com/resources/vulnerability-disclosure-policy", "seen": "2026-10-08" }, { "what": "security measures and rate limiters", "url": "https://documentation.hook0.com/resources/security", "seen": "2026-10-08" }, { "what": "live OpenAPI document", "url": "https://app.hook0.com/api/v1/swagger.json", "seen": "2026-10-08" }, { "what": "instance settings (registration, Turnstile)", "url": "https://app.hook0.com/api/v1/instance/", "seen": "2026-10-08" }, { "what": "API introduction (rate limits, pagination, error shape)", "url": "https://documentation.hook0.com/openapi/intro", "seen": "2026-10-08" }, { "what": "error codes reference", "url": "https://documentation.hook0.com/reference/error-codes", "seen": "2026-10-08" }, { "what": "service tokens and attenuation", "url": "https://documentation.hook0.com/how-to-guides/manage-service-tokens", "seen": "2026-10-08" }, { "what": "application secrets", "url": "https://documentation.hook0.com/concepts/application-secrets", "seen": "2026-10-08" }, { "what": "MCP server reference, tool table", "url": "https://documentation.hook0.com/reference/sdk/mcp", "seen": "2026-10-08" }, { "what": "MCP setup guide", "url": "https://documentation.hook0.com/reference/mcp", "seen": "2026-10-08" }, { "what": "retry schedule", "url": "https://documentation.hook0.com/explanation/webhook-retry-logic", "seen": "2026-10-08" }, { "what": "events and idempotency", "url": "https://documentation.hook0.com/concepts/events", "seen": "2026-10-08" }, { "what": "support and response times", "url": "https://documentation.hook0.com/resources/support", "seen": "2026-10-08" }, { "what": "status page as JSON, incident reports and daily history", "url": "https://status.hook0.com/index.json", "seen": "2026-10-08" }, { "what": "repository mirror (documentation, API snapshot, MCP source, changelogs), cloned", "url": "https://github.com/hook0/hook0", "seen": "2026-10-08" }, { "what": "GitLab releases", "url": "https://gitlab.com/hook0/hook0/-/releases", "seen": "2026-10-08" }, { "what": "GitLab open issues", "url": "https://gitlab.com/hook0/hook0/-/issues", "seen": "2026-10-08" }, { "what": "crates.io hook0-mcp", "url": "https://crates.io/crates/hook0-mcp", "seen": "2026-10-08" }, { "what": "npm hook0-client", "url": "https://registry.npmjs.org/hook0-client", "seen": "2026-10-08" }, { "what": "PyPI hook0-client", "url": "https://pypi.org/pypi/hook0-client/json", "seen": "2026-10-08" }, { "what": "RDAP for hook0.com", "url": "https://rdap.org/domain/hook0.com", "seen": "2026-10-08" } ], "openQuestions": [ "The lead called Hook0 open source. The server is under SSPL-1.0, which the OSI hasn't approved, and the vendor's terms say so. The SDKs and MCP server are MIT", "The lead named a CLI. It isn't on crates.io and installs from the GitLab repository with `cargo install --git`", "unchecked: whether the rate limits on Hook0 Cloud match the documented defaults (10 a second per token). We sent no authenticated request", "unchecked: the GitLab pipelines API answered 403, so the pass state of CI on the default branch wasn't read", "unchecked: whether `hook0-mcp` is in the official MCP registry. We didn't query it, and the repository has no `server.json`", "unchecked: GitHub's release list, which the documentation's changelog page points to. The clone carries three tags, all `frontend/`, and GitLab lists 17 releases", "Prices are published in euros only, so the listing has no unit prices in dollars", "The status page's daily history records 73 minutes of delivery worker downtime on 22 September 2026, while the incident updates report recovery after 12 minutes. We scored the longer figure", "No audit log of dashboard or API actions was found, although the security model page shows a sample audit record", "First release date not established. The GitLab project dates from 15 November 2020 and the GitHub mirror from 20 July 2021" ] }, "negative": -4, "negativeNotes": [ "2026-08-11. Server-side request forgery in the delivery worker, rated High by the vendor. An IPv6 transition address passed the filter on forbidden targets, so a tenant could make the worker reach internal addresses. Fixed in commit 3b27e932 and published with the reporter credited, so the deduction is reduced to 3 (https://documentation.hook0.com/resources/security-advisories).", "2026-08-24. A password reset link stayed usable after it had reset a password, rated Medium, which allowed account takeover by anyone holding a spent link. Fixed in commit 80fae0de and published, so the deduction is 1 (https://documentation.hook0.com/resources/security-advisories)." ], "verdict": "Hook0 Cloud sends signed webhooks from one REST call, with a public OpenAPI document, RFC 7807 errors and service tokens that can be narrowed offline to one application, an expiry or read-only actions. Six security advisories were published between August and September 2026, one rated High. Signup needs a browser check, and no uptime commitment exists below Enterprise.", "bestFor": "A product that has to send signed webhooks to its own customers' endpoints with retries, replay and a delivery log, and that wants EU hosting or the option to self-host the same code.", "strengths": [ "Public OpenAPI 3.0 document at `/api/v1/swagger.json` with 56 operations, each with a summary, a description and ten error statuses", "Service tokens are Biscuit tokens that the holder can narrow offline to one application, an expiry date or a read-only action list", "Errors follow RFC 7807 with a stable `id`, and the reference lists 46 codes generated from the API's own `/errors` endpoint", "Free Developer plan of 100 events a day with no card, and per-event overage prices published for both paid plans", "Retention by plan, sub-processors with countries, a DPA, a GDPR Article 30 register and a transfer impact assessment are all public" ], "weaknesses": [ "Six advisories were published between 6 August and 9 September 2026, including a High-rated SSRF in the delivery worker fixed on 11 August", "The status page records API and delivery downtime on 27 August and 22 September 2026, both traced to the hosting provider", "The terms give no uptime, latency or support commitment by default. Service levels exist only in a signed Enterprise agreement", "Cloud registration requires a Cloudflare Turnstile token and email verification, so an agent can't create an account alone", "The API introduction page documents an error shape and `limit` and `offset` pagination that the OpenAPI document doesn't contain" ], "agentNotes": [ "Use a service token narrowed to one application and an expiry. A root service token covers the whole organisation, and an application secret can delete its application", "Send your own UUID as `event_id` on `POST /api/v1/event/`. A repeat returns `EventAlreadyIngested` (409), which means the first call succeeded", "Create the event type before sending. Unknown types fail with `EventTypeDoesNotExist`, and `labels`, `occurred_at` and `payload_content_type` are required", "Send `payload` as a string, with JSON serialised inside it, up to 512 KiB", "Set `HOOK0_API_URL` for `hook0-mcp` to the origin without `/api/v1`, and set `HOOK0_READ_ONLY=true` to hide the ten write tools" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.6 } ], "editorialScores": { "ergonomics": 65, "maintenance": 87, "payments": 40, "reliability": 70, "schema": 79, "security": 64, "transparency": 76 }, "provenanceScore": 91 }, "connect": { "install": "cargo install hook0-mcp", "http": "curl -X POST \"https://app.hook0.com/api/v1/event\" \\\n -H \"Authorization: Bearer $HOOK0_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"application_id\": \"\u003capplication-id\u003e\", \"event_type\": \"user.account.created\", \"payload\": \"{\\\"user_id\\\": 123}\", \"payload_content_type\": \"application/json\", \"labels\": {\"environment\": \"tutorial\"}, \"occurred_at\": \"2026-10-08T12:00:00Z\"}'", "config": { "mcpServers": { "hook0": { "command": "hook0-mcp", "env": { "HOOK0_API_TOKEN": "your-service-token-here" } } } } }, "letme": { "capability": "https://letme.dev/events.webhooks-send", "tool": "https://letme.dev/hook0" }, "notable": [ "Service tokens are Biscuit tokens that can be narrowed offline to one application, an expiry or a read-only action list, and revoking the root revokes every derived token (https://documentation.hook0.com/how-to-guides/manage-service-tokens)", "The `hook0-mcp` server (stdio, MIT, version 3.0.0 of 26 August 2026) is generated from the API snapshot with 23 tools, 13 read and 10 write, and `HOOK0_READ_ONLY` hides the write tools (https://documentation.hook0.com/reference/sdk/mcp)", "Failed deliveries are retried on a schedule from 3 seconds to 10 hours, 24 retries by default, and deliveries carry an HMAC-SHA256 `X-Hook0-Signature` header (https://documentation.hook0.com/explanation/webhook-retry-logic)", "Six security advisories were published between 6 August and 9 September 2026, each with the fix commit and the reporter credited, the most severe a High-rated SSRF fixed on 11 August (https://documentation.hook0.com/resources/security-advisories)", "The terms state that no uptime, availability, latency or support response commitment applies by default, and that service levels exist only in a signed Enterprise agreement (https://www.hook0.com/terms)", "The site's llms.txt says the MCP server has 17 tools, while the MCP reference and the generated source list 23 (https://www.hook0.com/llms.txt)", "Hook0 sends webhooks only. Its own comparison pages say it has no production service for receiving third-party webhooks (https://www.hook0.com/llms.txt)" ], "area": "developer", "details": [ { "label": "API", "value": "REST at https://app.hook0.com/api/v1, version 1.0.2, OpenAPI 3.0 with 56 operations on 38 paths. 36 are tagged for the SDKs and 23 for the MCP server" }, { "label": "MCP server", "value": "`hook0-mcp` 3.0.0 on crates.io, stdio only, 23 tools named `\u003centity\u003e.\u003coperation\u003e`, eight `hook0://` resources and three prompts. It makes one attempt per call and no retries" }, { "label": "Credentials", "value": "Biscuit service tokens per organisation, narrowed offline by application, expiry or action list. Application secrets with full control of one application. Bearer header only" }, { "label": "Rate limits", "value": "10 requests a second per token, 100 per IP and 1,000 overall, per the API introduction. Daily event quotas of 100, 30,000 and 100,000 by plan" }, { "label": "Errors", "value": "RFC 7807 problems with `type`, `id`, `title`, `detail` and `status`. 46 codes in the reference. 429 carries `Retry-After`" }, { "label": "Idempotency", "value": "Optional client `event_id` (UUID). A repeat is rejected with `EventAlreadyIngested` (409). `POST /api/v1/events/{event_id}/replay` resends an event to matching subscriptions" }, { "label": "Retries", "value": "From 3 seconds to 10 hours between attempts, 24 retries by default, with slower delivery to subscriptions whose endpoints are failing" }, { "label": "Signatures", "value": "HMAC-SHA256 in `X-Hook0-Signature` with a timestamp, the signed header names and a `v1` signature, keyed by the subscription's secret" }, { "label": "SDKs", "value": "JavaScript and TypeScript, Rust, Python, Go, Ruby, PHP, C#, Java, Kotlin, Lua and Zig, generated from the API snapshot. `hook0-client` 2.0.3 on npm, PyPI and crates.io (28 August 2026), MIT" }, { "label": "CLI", "value": "`hook0`, installed with `cargo install --git https://gitlab.com/hook0/hook0.git hook0-cli`. It sends and replays events and tunnels webhooks to localhost with `hook0 listen`" }, { "label": "Retention", "value": "Event data for 7 days on Developer, 14 on Startup and 30 on Pro. Account data for 30 days after termination" }, { "label": "Hosting", "value": "Clever Cloud in France, with delivery workers on Clever Cloud and Scaleway and Cloudflare for DNS and DDoS protection" }, { "label": "Status", "value": "status.hook0.com on Better Stack, twelve components with 90 days of daily history, also served as JSON at `/index.json`" }, { "label": "Self-hosting", "value": "Docker Compose, Kubernetes or bare metal from the same repository, SSPL-1.0. Development happens on GitLab and GitHub is a mirror" } ], "provenance": { "legalEntity": "FGRibreau SARL", "domain": "hook0.com", "domainRegistered": "2020-09-02", "endpointOnVendorDomain": true, "terms": "https://www.hook0.com/terms", "privacy": "https://www.hook0.com/privacy-policy", "statusPage": "https://status.hook0.com", "changelog": "https://gitlab.com/hook0/hook0/-/releases", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The terms of service (last updated 27 June 2026) name FGRibreau SARL, a French limited liability company registered at La Roche-sur-Yon under number 850 824 350, with its office at 3 rue de l'Aubepine, 85110 Chantonnay, France.", "The API answers at app.hook0.com, a hook0.com subdomain, per the OpenAPI document's server entry.", "www.hook0.com/.well-known/security.txt names security@hook0.com, a disclosure policy and an acknowledgments page, and expires on 6 August 2027.", "The privacy policy (last updated 9 September 2026) covers the Hook0 service and lists sub-processors with countries. A data processing addendum is published at www.hook0.com/data-processing-addendum.", "The documentation's changelog page only links to GitHub Releases. Releases are tagged per component on GitLab, where development happens, and each component keeps a CHANGELOG.md.", "RDAP for hook0.com gives a registration date of 2020-09-02." ], "score": 91, "checks": [ { "check": "Legal entity named", "value": "FGRibreau SARL", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "hook0.com, registered 2020-09-02 (6 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "hook0.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 6, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.hook0.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.hook0.com/terms", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-06-27", "words": 3999, "points": 6, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: June 27, 2026", "says": "Last updated 2026-06-27" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "…dispute arising out of or in connection with these Terms to the exclusive jurisdiction of the competent courts of La Roche-sur-Yon (tribunaux de La Roche-sur-Yon), France, where Hook0 has its registered jurisdiction, subject to any mandatory jurisdiction rules applicable to the subject matter of the dispute.", "says": "Disputes go to the courts of La Roche" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…with these Terms or the Service, whether in contract, tort (including negligence), or otherwise, shall not exceed the total fees paid by you to Hook0 during the twelve (12) months immediately preceding the event giving rise to the claim.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Hook0 may suspend or terminate your Account if it discovers that information provided is false or misleading." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Hook0 may terminate your access to the Service upon 15 days' written notice if you materially breach these Terms and fail to cure that breach within the notice period.", "says": "Gives 15 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "IF YOU DO NOT AGREE, YOU MUST NOT ACCESS OR USE THE SERVICE." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "No uptime, availability, latency, or support response guarantee is provided by default." } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "(g) use automated means to access or scrape the Service except through the official API and in accordance with the Documentation;", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "Hook0 may modify these Terms without prior notice for changes that are purely administrative (such as corrections of typographical errors or updated contact information) or that are required by law.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Hook0 may terminate these Terms for any reason upon 30 days' written notice." } ], "notes": [ { "date": "2026-10-08", "text": "After termination Hook0 keeps customer Content for 30 days, during which an export can be requested, and may then delete it permanently.", "quote": "(c) Hook0 will retain your Content for 30 days after the effective date of termination, during which period you may request an export of your data by contacting [email protected];" }, { "date": "2026-10-08", "text": "Each legal entity may hold only one Account unless Hook0 agrees otherwise in writing.", "quote": "Each legal entity may maintain only one Account unless expressly agreed otherwise by Hook0 in writing." }, { "date": "2026-10-08", "text": "The licence over customer Content is limited to processing and storing it as needed to run the Service, and Hook0 states it will not use Content for any other purpose.", "quote": "By submitting Content through the Service, you grant Hook0 a limited, worldwide license to process and store your Content solely to the extent necessary to provide the Service." } ] }, { "kind": "privacy", "url": "https://www.hook0.com/privacy-policy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-09", "words": 2466, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: September 9, 2026", "says": "Last updated 2026-09-09" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Hook0 does not process special categories of personal data (Article 9 GDPR) and does not perform automated decision-making or profiling with legal or similarly significant effects." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Consent preferences are stored in localStorage with a validity of 13 months, in line with CNIL guidelines.", "says": "Names a period of 13 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We share data with our subprocessors strictly as needed to provide the Service." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Under the GDPR, you have the following rights with respect to your personal data:" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Handling support requests sent to [email protected] or [email protected]", "says": "Gives an email address, hidden from our reader by the page" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "These transfers are governed by the Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914) and a documented Transfer Impact Assessment, and where applicable by the EU-US Data Privacy Framework (Cloudflare, Stripe and Google LLC are DPF-certified).", "says": "Relies on standard contractual clauses and the Data Privacy Framework" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/hook0.json", "live": { "slug": "hook0", "vendorStatus": { "page": "https://status.hook0.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:58:03.331943028Z" }, "updatedAt": "2026-10-09T07:58:03.331943028Z" } }, "verify": { "accepts": "a page on hook0.com or one of its subdomains, or the README of github.com/hook0/hook0", "badgeUrl": "https://www.anchorterminal.com/badges/hook0.svg", "body": { "slug": "hook0", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/hook0", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/hook0\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/hook0.svg\" alt=\"Hook0 on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Hook0 on Anchor Terminal](https://www.anchorterminal.com/badges/hook0.svg)](https://www.anchorterminal.com/tools/hook0)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/hook0\"\u003eHook0 on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/hook0", "json": "https://www.anchorterminal.com/tools/hook0.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/hook0.md", "slim": "https://www.anchorterminal.com/tools/hook0.min.md" }, "markdown": "## Overview\n\n**Grade B · 64.6/100 · rank #313 of 842 · #5 in Event delivery \u0026 webhooks · not agent-ready · confidence medium**\n\n\n## Assessment\n\nHook0 Cloud sends signed webhooks from one REST call, with a public OpenAPI document, RFC 7807 errors and service tokens that can be narrowed offline to one application, an expiry or read-only actions. Six security advisories were published between August and September 2026, one rated High. Signup needs a browser check, and no uptime commitment exists below Enterprise.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | FGRibreau SARL (https://www.hook0.com) |\n| Kind | HTTP API |\n| Category | Event delivery \u0026 webhooks (https://www.anchorterminal.com/categories/webhooks) |\n| Transport | HTTP, stdio |\n| Auth | API key · Every call takes `Authorization: Bearer \u003ctoken\u003e` at https://app.hook0.com/api/v1. A person signs up in a browser, passes a Cloudflare Turnstile check and verifies an email address, then creates a service token in the dashboard. Service tokens are Biscuit tokens scoped to one organisation, and the holder can narrow one offline to a single application, an expiry date or an allowlist of actions. Each application also has secrets that work as Bearer tokens with full control of that application. No OAuth for API clients. |\n| Pricing | Freemium (Freemium) · Free Developer plan with no card, 100 events a day, one application and 7 days of retention, and a 429 once the quota is used. Startup is €59 a month for 30,000 events a day, then €0.003 an event. Pro is €190 a month for 100,000 events a day, then €0.0001 an event. Prices exclude VAT and are published in euros only. Subscriptions and retries aren't counted. Self-hosting is free, and a managed on-premise instance is €500 a month plus €1,000 setup (checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the documentation index, the OpenAPI document, the repository or the pricing page (checked 2026-10-08). |\n| Licence | SSPL-1.0 for the server (source available, not an OSI licence). The SDKs and the `hook0-mcp` server are MIT per crates.io and npm. Hook0 Cloud is a hosted service under Hook0's terms of service |\n| Tools exposed | 23 |\n| Packages | npm: `hook0-client`; pypi: `hook0-client`; cargo: `hook0-mcp` |\n| Source | https://github.com/hook0/hook0 |\n| Docs | https://documentation.hook0.com/ |\n| llms.txt | https://documentation.hook0.com/llms.txt |\n| Last release | 2026-09-21 |\n| GitHub stars | 1,494 (as of 2026-10-08) |\n| npm downloads / week | 507 |\n| PyPI downloads / week | 11 |\n| API | REST at https://app.hook0.com/api/v1, version 1.0.2, OpenAPI 3.0 with 56 operations on 38 paths. 36 are tagged for the SDKs and 23 for the MCP server |\n| MCP server | `hook0-mcp` 3.0.0 on crates.io, stdio only, 23 tools named `\u003centity\u003e.\u003coperation\u003e`, eight `hook0://` resources and three prompts. It makes one attempt per call and no retries |\n| Credentials | Biscuit service tokens per organisation, narrowed offline by application, expiry or action list. Application secrets with full control of one application. Bearer header only |\n| Rate limits | 10 requests a second per token, 100 per IP and 1,000 overall, per the API introduction. Daily event quotas of 100, 30,000 and 100,000 by plan |\n| Errors | RFC 7807 problems with `type`, `id`, `title`, `detail` and `status`. 46 codes in the reference. 429 carries `Retry-After` |\n| Idempotency | Optional client `event_id` (UUID). A repeat is rejected with `EventAlreadyIngested` (409). `POST /api/v1/events/{event_id}/replay` resends an event to matching subscriptions |\n| Retries | From 3 seconds to 10 hours between attempts, 24 retries by default, with slower delivery to subscriptions whose endpoints are failing |\n| Signatures | HMAC-SHA256 in `X-Hook0-Signature` with a timestamp, the signed header names and a `v1` signature, keyed by the subscription's secret |\n| SDKs | JavaScript and TypeScript, Rust, Python, Go, Ruby, PHP, C#, Java, Kotlin, Lua and Zig, generated from the API snapshot. `hook0-client` 2.0.3 on npm, PyPI and crates.io (28 August 2026), MIT |\n| CLI | `hook0`, installed with `cargo install --git https://gitlab.com/hook0/hook0.git hook0-cli`. It sends and replays events and tunnels webhooks to localhost with `hook0 listen` |\n| Retention | Event data for 7 days on Developer, 14 on Startup and 30 on Pro. Account data for 30 days after termination |\n| Hosting | Clever Cloud in France, with delivery workers on Clever Cloud and Scaleway and Cloudflare for DNS and DDoS protection |\n| Status | status.hook0.com on Better Stack, twelve components with 90 days of daily history, also served as JSON at `/index.json` |\n| Self-hosting | Docker Compose, Kubernetes or bare metal from the same repository, SSPL-1.0. Development happens on GitLab and GitHub is a mirror |\n| Capabilities | events.webhooks-send |\n| Tags | hosted, self-hosted, source-available, webhooks, api-key, openapi, llms-txt, mcp, free-tier, no-card, status-page, eu-hosted, typescript, python, rust, go |\n| JSON | https://www.anchorterminal.com/api/v1/tools/hook0.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 70 | 14.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 79 | 12.8 |\n| Agent ergonomics | 13% | 16.2 | 65 | 10.6 |\n| Security \u0026 auth | 14% | 17.5 | 64 | 11.2 |\n| Payments \u0026 pricing | 10% | 12.5 | 40 | 5.0 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 87 | 7.6 |\n| Transparency \u0026 trust (editorial 76, provenance 91) | 7% | 8.8 | 84 | 7.3 |\n| Negative events | up to −15 | up to −15 | 2026-08-11. Server-side request forgery in the delivery worker, rated High by the vendor. An IPv6 transition address passed the filter on forbidden targets, so a tenant could make the worker reach internal addresses. Fixed in commit 3b27e932 and published with the reporter credited, so the deduction is reduced to 3 (https://documentation.hook0.com/resources/security-advisories). 2026-08-24. A password reset link stayed usable after it had reset a password, rated Medium, which allowed account takeover by anyone holding a spent link. Fixed in commit 80fae0de and published, so the deduction is 1 (https://documentation.hook0.com/resources/security-advisories). | -4 |\n| **Total** | | | | **64.6 → B** |\n\n### Why each score\n\n- Reliability 70: Graded as a hosted service, Hook0 Cloud. status.hook0.com on Better Stack lists twelve components with 90 days of daily history (20). Two incident reports fall in the 90 days to 8 October 2026. On 27 August the API and delivery were unavailable for about 18 minutes, and on 22 September an object storage outage at the host stopped ingestion and delivery, with the page recording 12 minutes on the API and 73 minutes on the delivery workers. The daily history also records about 18 minutes of API downtime on 13 July and 15 minutes on 8 October. We read the 22 September delivery outage as one major outage (10). Limits of 10 requests a second per token, 100 per IP and 1,000 overall are documented, with daily event quotas by plan (15). A 429 carries `Retry-After` and its problem text says the request is safe to resend, and a client `event_id` makes ingestion retries safe (15). The terms state that no uptime commitment exists outside a signed Enterprise agreement (0). The API is at version 1.0.2 and generally available (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 79: OpenAPI 3.0 document served without a login at app.hook0.com/api/v1/swagger.json, 56 operations on 38 paths (25). llms.txt on both the site and the documentation, listing every documentation page (10). Every operation has a summary and a description that states its purpose and often when to use it, with little on when not to (14). Required fields, UUID and date-time formats and length limits are typed, but the snapshot holds nine enums, `payload_content_type` lists its valid values only in prose and `labels` is a free map by design (10). Ten error statuses on every operation and a reference of 46 error codes with sample bodies, against two examples in the spec. The API introduction page shows a different error body and `limit`, `offset` and `sort` parameters that the spec doesn't have (10). The path carries `/api/v1`, each component has a changelog in the repository and tagged releases on GitLab, and the documentation's changelog page only links to GitHub Releases (10).\n- Agent ergonomics 65: `GET /api/v1/events/` returns the 100 most recent events with no size or field parameter. The MCP server has 23 tools, or 13 in read-only mode (12). Only the delivery attempt list is paginated, by cursor through a `Link` header, with filters for event, subscription, date range and event type. Other lists take `application_id` alone (8). Errors are RFC 7807 problems with a stable `id` and a documentation URL per code, though the API introduction page describes another shape (18). A client-supplied `event_id` is rejected on reuse with `EventAlreadyIngested`, the SDKs mint the id before retrying and `POST /api/v1/events/{event_id}/replay` resends an event. The MCP tools carry no read-only or destructive annotations (15). An event needs six fields. Official clients exist for eleven languages (12).\n- Security \u0026 auth 64: Service tokens are Biscuit tokens, revocable from the dashboard or the API, which the holder can narrow offline to one application, an expiry date or an allowlist of actions. Revoking a root token invalidates every token derived from it. Application secrets can't be narrowed and control their whole application. No OAuth for API clients (28). A read-only token is documented with the claim to paste, and `HOOK0_READ_ONLY` hides the MCP server's ten write tools. Deletes need no confirmation (14). Delivery logs return subscriber endpoints' response bodies, which are third-party content, and no guidance for agents reading them was found (5). Every delivery attempt is stored with its response. The security model page shows an audit log record, but no audit log an operator can read was found in the API or the documentation (7). Valid security.txt, a disclosure policy with a discretionary reward for critical findings, a PGP key and advisories published with credits. Hook0 holds no SOC 2 or ISO 27001 certificate of its own and cites its host's (10).\n- Payments \u0026 pricing 40: Graded on Hook0 Cloud. No x402, MPP or L402 (0). Plan prices and per-event overage (€0.003 on Startup, €0.0001 on Pro) are public (20). The Developer plan is free with no card, limited to 100 events a day (20). `POST /api/v1/register/` exists, but the cloud instance requires a Cloudflare Turnstile token and email verification, so a person has to sign up (0). The self-hosted server is free to run. We graded the hosted service.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 87: The newest tagged release is `frontend/v1.2.1` on 21 September 2026, 17 days before this check, and the default branch had commits on 8 October (30). Since 10 July GitLab lists nine component releases, among them `mcp/v3.0.0` on 26 August and five output worker releases in early August, and the SDKs went from 2.0.0 to 2.0.3 between 25 and 28 August (20). GitLab shows eight open issues, the latest updated on 2 October 2026 and five untouched since December 2025. Six security reports were fixed and published between August and September. Support is by email and Discord (15). Clients for eleven languages are generated from the API snapshot, with `hook0-client` 2.0.3 on npm, PyPI and crates.io (15). Dependency update commits landed on 29 September and the repository has GitLab CI, OSV and Trivy configuration. We couldn't read the pipeline results (7).\n- Transparency \u0026 trust 84: The server's source is public under SSPL-1.0, which the terms themselves say the OSI hasn't approved, and the SDKs and MCP server are MIT. The cloud runs the same code (20). A privacy policy updated 9 September 2026, a published DPA and terms that agree on retention, 7, 14 and 30 days of event data by plan and 30 days after termination, with breach notice within 72 hours and a public Article 30 register (28). The terms of sale promise 90 days' notice before the free plan is cut and the terms 30 days for material changes. No deprecation policy for the API was found (8). Sub-processors are listed with countries, and the data plane is on Clever Cloud in France with Cloudflare in front (20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (22 items): https://www.anchorterminal.com/fixes/hook0.md (JSON https://www.anchorterminal.com/fixes/hook0.json)\n\n### What we couldn't check\n\n- The lead called Hook0 open source. The server is under SSPL-1.0, which the OSI hasn't approved, and the vendor's terms say so. The SDKs and MCP server are MIT\n- The lead named a CLI. It isn't on crates.io and installs from the GitLab repository with `cargo install --git`\n- unchecked: whether the rate limits on Hook0 Cloud match the documented defaults (10 a second per token). We sent no authenticated request\n- unchecked: the GitLab pipelines API answered 403, so the pass state of CI on the default branch wasn't read\n- unchecked: whether `hook0-mcp` is in the official MCP registry. We didn't query it, and the repository has no `server.json`\n- unchecked: GitHub's release list, which the documentation's changelog page points to. The clone carries three tags, all `frontend/`, and GitLab lists 17 releases\n- Prices are published in euros only, so the listing has no unit prices in dollars\n- The status page's daily history records 73 minutes of delivery worker downtime on 22 September 2026, while the incident updates report recovery after 12 minutes. We scored the longer figure\n- No audit log of dashboard or API actions was found, although the security model page shows a sample audit record\n- First release date not established. The GitLab project dates from 15 November 2020 and the GitHub mirror from 20 July 2021\n\n### Sources\n\n- site index for assistants (llms.txt): \u003chttps://www.hook0.com/llms.txt\u003e (seen 2026-10-08)\n- documentation index (llms.txt): \u003chttps://documentation.hook0.com/llms.txt\u003e (seen 2026-10-08)\n- robots.txt, no Content-Signal line: \u003chttps://www.hook0.com/robots.txt\u003e (seen 2026-10-08)\n- pricing: \u003chttps://www.hook0.com/pricing\u003e (seen 2026-10-08)\n- pricing and billing, quota behaviour: \u003chttps://documentation.hook0.com/resources/pricing-billing\u003e (seen 2026-10-08)\n- terms of service: \u003chttps://www.hook0.com/terms\u003e (seen 2026-10-08)\n- terms of sale: \u003chttps://www.hook0.com/terms-of-sale\u003e (seen 2026-10-08)\n- privacy policy: \u003chttps://www.hook0.com/privacy-policy\u003e (seen 2026-10-08)\n- data processing addendum: \u003chttps://www.hook0.com/data-processing-addendum\u003e (seen 2026-10-08)\n- security and compliance page: \u003chttps://www.hook0.com/security\u003e (seen 2026-10-08)\n- security.txt: \u003chttps://www.hook0.com/.well-known/security.txt\u003e (seen 2026-10-08)\n- security advisories: \u003chttps://documentation.hook0.com/resources/security-advisories\u003e (seen 2026-10-08)\n- vulnerability disclosure policy: \u003chttps://documentation.hook0.com/resources/vulnerability-disclosure-policy\u003e (seen 2026-10-08)\n- security measures and rate limiters: \u003chttps://documentation.hook0.com/resources/security\u003e (seen 2026-10-08)\n- live OpenAPI document: \u003chttps://app.hook0.com/api/v1/swagger.json\u003e (seen 2026-10-08)\n- instance settings (registration, Turnstile): \u003chttps://app.hook0.com/api/v1/instance/\u003e (seen 2026-10-08)\n- API introduction (rate limits, pagination, error shape): \u003chttps://documentation.hook0.com/openapi/intro\u003e (seen 2026-10-08)\n- error codes reference: \u003chttps://documentation.hook0.com/reference/error-codes\u003e (seen 2026-10-08)\n- service tokens and attenuation: \u003chttps://documentation.hook0.com/how-to-guides/manage-service-tokens\u003e (seen 2026-10-08)\n- application secrets: \u003chttps://documentation.hook0.com/concepts/application-secrets\u003e (seen 2026-10-08)\n- MCP server reference, tool table: \u003chttps://documentation.hook0.com/reference/sdk/mcp\u003e (seen 2026-10-08)\n- MCP setup guide: \u003chttps://documentation.hook0.com/reference/mcp\u003e (seen 2026-10-08)\n- retry schedule: \u003chttps://documentation.hook0.com/explanation/webhook-retry-logic\u003e (seen 2026-10-08)\n- events and idempotency: \u003chttps://documentation.hook0.com/concepts/events\u003e (seen 2026-10-08)\n- support and response times: \u003chttps://documentation.hook0.com/resources/support\u003e (seen 2026-10-08)\n- status page as JSON, incident reports and daily history: \u003chttps://status.hook0.com/index.json\u003e (seen 2026-10-08)\n- repository mirror (documentation, API snapshot, MCP source, changelogs), cloned: \u003chttps://github.com/hook0/hook0\u003e (seen 2026-10-08)\n- GitLab releases: \u003chttps://gitlab.com/hook0/hook0/-/releases\u003e (seen 2026-10-08)\n- GitLab open issues: \u003chttps://gitlab.com/hook0/hook0/-/issues\u003e (seen 2026-10-08)\n- crates.io hook0-mcp: \u003chttps://crates.io/crates/hook0-mcp\u003e (seen 2026-10-08)\n- npm hook0-client: \u003chttps://registry.npmjs.org/hook0-client\u003e (seen 2026-10-08)\n- PyPI hook0-client: \u003chttps://pypi.org/pypi/hook0-client/json\u003e (seen 2026-10-08)\n- RDAP for hook0.com: \u003chttps://rdap.org/domain/hook0.com\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 91/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | FGRibreau SARL | 20/20 |\n| Domain age | hook0.com, registered 2020-09-02 (6 years) | 11/15 |\n| Endpoint on the vendor's domain | hook0.com | 15/15 |\n| Terms of service | read, states 7 of the 7 things a reader expects, and has 2 clauses that cost points | 6/10 |\n| Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 |\n| Status page | status.hook0.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nThe terms of service (last updated 27 June 2026) name FGRibreau SARL, a French limited liability company registered at La Roche-sur-Yon under number 850 824 350, with its office at 3 rue de l'Aubepine, 85110 Chantonnay, France.\n\nThe API answers at app.hook0.com, a hook0.com subdomain, per the OpenAPI document's server entry.\n\nwww.hook0.com/.well-known/security.txt names security@hook0.com, a disclosure policy and an acknowledgments page, and expires on 6 August 2027.\n\nThe privacy policy (last updated 9 September 2026) covers the Hook0 service and lists sub-processors with countries. A data processing addendum is published at www.hook0.com/data-processing-addendum.\n\nThe documentation's changelog page only links to GitHub Releases. Releases are tagged per component on GitLab, where development happens, and each component keeps a CHANGELOG.md.\n\nRDAP for hook0.com gives a registration date of 2020-09-02.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.hook0.com/terms), read 2026-10-08, dated 2026-06-27, states 7 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"(g) use automated means to access or scrape the Service except through the official API and in accordance with the Documentation;\"\n- To know. Says the terms or the service can change without notice (costs points). \"Hook0 may modify these Terms without prior notice for changes that are purely administrative (such as corrections of typographical errors or updated contact information) or that are required by law.\"\n- To know. Says access can be ended without notice or for any reason. \"Hook0 may terminate these Terms for any reason upon 30 days' written notice.\"\n- Gives the date it was last updated. Last updated 2026-06-27.\n- Names the governing law or courts. Disputes go to the courts of La Roche.\n- States a limit on its liability. Capped at the fees paid in the 12 months before the claim.\n- Says how changes to the terms are announced. Gives 15 days of notice before a change.\n- Also in the text (2026-10-08). After termination Hook0 keeps customer Content for 30 days, during which an export can be requested, and may then delete it permanently. \"(c) Hook0 will retain your Content for 30 days after the effective date of termination, during which period you may request an export of your data by contacting [email protected];\"\n- Also in the text (2026-10-08). Each legal entity may hold only one Account unless Hook0 agrees otherwise in writing. \"Each legal entity may maintain only one Account unless expressly agreed otherwise by Hook0 in writing.\"\n- Also in the text (2026-10-08). The licence over customer Content is limited to processing and storing it as needed to run the Service, and Hook0 states it will not use Content for any other purpose. \"By submitting Content through the Service, you grant Hook0 a limited, worldwide license to process and store your Content solely to the extent necessary to provide the Service.\"\n\n**Privacy policy** (https://www.hook0.com/privacy-policy), read 2026-10-08, dated 2026-09-09, states 7 of the 8 things a reader expects.\n\n- Gives the date it was last updated. Last updated 2026-09-09.\n- Says how long data is kept. Names a period of 13 months.\n- Not found in the text. Says whether personal data is sold or shared for advertising.\n- Gives a privacy contact. Gives an email address, hidden from our reader by the page.\n- Says where data is transferred or stored. Relies on standard contractual clauses and the Data Privacy Framework.\n\n## Live (updated 2026-10-09 07:58 UTC)\n\n- Vendor status page: unknown, no machine-readable status found\n- Always current: https://www.anchorterminal.com/api/v1/live/hook0.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- Public OpenAPI 3.0 document at `/api/v1/swagger.json` with 56 operations, each with a summary, a description and ten error statuses\n- Service tokens are Biscuit tokens that the holder can narrow offline to one application, an expiry date or a read-only action list\n- Errors follow RFC 7807 with a stable `id`, and the reference lists 46 codes generated from the API's own `/errors` endpoint\n- Free Developer plan of 100 events a day with no card, and per-event overage prices published for both paid plans\n- Retention by plan, sub-processors with countries, a DPA, a GDPR Article 30 register and a transfer impact assessment are all public\n\n## Weaknesses\n\n- Six advisories were published between 6 August and 9 September 2026, including a High-rated SSRF in the delivery worker fixed on 11 August\n- The status page records API and delivery downtime on 27 August and 22 September 2026, both traced to the hosting provider\n- The terms give no uptime, latency or support commitment by default. Service levels exist only in a signed Enterprise agreement\n- Cloud registration requires a Cloudflare Turnstile token and email verification, so an agent can't create an account alone\n- The API introduction page documents an error shape and `limit` and `offset` pagination that the OpenAPI document doesn't contain\n\n## Before you call it (notes for agents)\n\n1. Use a service token narrowed to one application and an expiry. A root service token covers the whole organisation, and an application secret can delete its application\n2. Send your own UUID as `event_id` on `POST /api/v1/event/`. A repeat returns `EventAlreadyIngested` (409), which means the first call succeeded\n3. Create the event type before sending. Unknown types fail with `EventTypeDoesNotExist`, and `labels`, `occurred_at` and `payload_content_type` are required\n4. Send `payload` as a string, with JSON serialised inside it, up to 512 KiB\n5. Set `HOOK0_API_URL` for `hook0-mcp` to the origin without `/api/v1`, and set `HOOK0_READ_ONLY=true` to hide the ten write tools\n\n## Connect\n\nInstall:\n\n```bash\ncargo install hook0-mcp\n```\n\nFirst request:\n\n```bash\ncurl -X POST \"https://app.hook0.com/api/v1/event\" \\\n -H \"Authorization: Bearer $HOOK0_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"application_id\": \"\u003capplication-id\u003e\", \"event_type\": \"user.account.created\", \"payload\": \"{\\\"user_id\\\": 123}\", \"payload_content_type\": \"application/json\", \"labels\": {\"environment\": \"tutorial\"}, \"occurred_at\": \"2026-10-08T12:00:00Z\"}'\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"hook0\": {\n \"command\": \"hook0-mcp\",\n \"env\": {\n \"HOOK0_API_TOKEN\": \"your-service-token-here\"\n }\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/hook0. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Hookdeck | BB | 76.9 | 24 | events.webhooks-send | no | https://www.anchorterminal.com/tools/hookdeck.md |\n| Ably | BB | 75 | 58 | events.webhooks-send | no | https://www.anchorterminal.com/tools/ably.md |\n| Svix | BB | 74 | 78 | events.webhooks-send | no | https://www.anchorterminal.com/tools/svix.md |\n| Upstash QStash | BB | 72.3 | 105 | events.webhooks-send | no | https://www.anchorterminal.com/tools/upstash-qstash.md |\n| Basecamp | B | 67.9 | 220 | events.webhooks-send | no | https://www.anchorterminal.com/tools/basecamp.md |\n| Plane | B | 67.6 | 229 | events.webhooks-send | no | https://www.anchorterminal.com/tools/plane.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Service tokens are Biscuit tokens that can be narrowed offline to one application, an expiry or a read-only action list, and revoking the root revokes every derived token (source: \u003chttps://documentation.hook0.com/how-to-guides/manage-service-tokens\u003e)\n- The `hook0-mcp` server (stdio, MIT, version 3.0.0 of 26 August 2026) is generated from the API snapshot with 23 tools, 13 read and 10 write, and `HOOK0_READ_ONLY` hides the write tools (source: \u003chttps://documentation.hook0.com/reference/sdk/mcp\u003e)\n- Failed deliveries are retried on a schedule from 3 seconds to 10 hours, 24 retries by default, and deliveries carry an HMAC-SHA256 `X-Hook0-Signature` header (source: \u003chttps://documentation.hook0.com/explanation/webhook-retry-logic\u003e)\n- Six security advisories were published between 6 August and 9 September 2026, each with the fix commit and the reporter credited, the most severe a High-rated SSRF fixed on 11 August (source: \u003chttps://documentation.hook0.com/resources/security-advisories\u003e)\n- The terms state that no uptime, availability, latency or support response commitment applies by default, and that service levels exist only in a signed Enterprise agreement (source: \u003chttps://www.hook0.com/terms\u003e)\n- The site's llms.txt says the MCP server has 17 tools, while the MCP reference and the generated source list 23 (source: \u003chttps://www.hook0.com/llms.txt\u003e)\n- Hook0 sends webhooks only. Its own comparison pages say it has no production service for receiving third-party webhooks (source: \u003chttps://www.hook0.com/llms.txt\u003e)\n\n## Compare\n\n- [Ably vs Hook0](https://www.anchorterminal.com/compare/ably-vs-hook0.md): BB 75 vs B 64.6\n- [Convoy vs Hook0](https://www.anchorterminal.com/compare/convoy-vs-hook0.md): B 62.2 vs B 64.6\n- [Hook0 vs Hookdeck](https://www.anchorterminal.com/compare/hook0-vs-hookdeck.md): B 64.6 vs BB 76.9\n- [Hook0 vs Pusher Channels](https://www.anchorterminal.com/compare/hook0-vs-pusher-channels.md): B 64.6 vs D 51.9\n- [Hook0 vs Svix](https://www.anchorterminal.com/compare/hook0-vs-svix.md): B 64.6 vs BB 74\n- [Hook0 vs Upstash QStash](https://www.anchorterminal.com/compare/hook0-vs-upstash-qstash.md): B 64.6 vs BB 72.3\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on hook0.com or one of its subdomains, or the README of github.com/hook0/hook0. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"hook0\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/hook0\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/hook0.svg\" alt=\"Hook0 on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Hook0 on Anchor Terminal](https://www.anchorterminal.com/badges/hook0.svg)](https://www.anchorterminal.com/tools/hook0)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/hook0\"\u003eHook0 on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Hook0 is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/hook0-dark.png\n- Light: https://www.anchorterminal.com/assets/share/hook0-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Event delivery \u0026 webhooks", "url": "https://www.anchorterminal.com/categories/webhooks" }, { "name": "Hook0", "url": "" } ], "description": "Hook0 is a webhook sending service from FGRibreau SARL in France. An application posts events to a REST API and Hook0 signs, retries and logs deliveries to subscriber endpoints. It runs as an EU-hosted cloud or self-hosted under SSPL-1.0.", "facts": [ "rank #313 of 842", "API key auth", "0 desk reviews" ], "h1": "Hook0", "image": "https://www.anchorterminal.com/assets/og/tools-hook0.png", "path": "/tools/hook0", "published": "2026-10-01", "section": "tools", "title": "Hook0 review for AI agents, grade B (64.6/100) | Anchor Terminal", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/tools/hook0" }, "tokens": { "markdown": 7850, "slim": 1830 }, "version": 1 }