hookdeck-event-gateway — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hookdeck-event-gateway (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The Event Gateway is a webhook proxy and durable message queue that sits between webhook providers and your application. Providers send webhooks to Hookdeck, which guarantees ingestion, queues events, and delivers them to your app with automatic retries and rate limiting. Your webhook handler just does the business logic — no need to build your own queue infrastructure.
┌──────────────┐ ┌─────────────────────────┐ ┌──────────────┐
│ Provider │────▶│ Hookdeck Event │────▶│ Your App │
│ (Stripe, │ │ Gateway │ │ │
│ GitHub, │ │ │ │ Just handle │
│ Shopify...) │ │ Guaranteed ingestion │ │ business │
└──────────────┘ │ Durable queue │ │ logic │
│ Retries & rate limiting │ └──────────────┘
│ Replay & observability │
└─────────────────────────┘Get started immediately — no account required:
# Install Hookdeck CLI
brew install hookdeck/hookdeck/hookdeck
# Or: npm install -g hookdeck-cli
# Start tunnel to your local server
hookdeck listen 3000 --path /webhooksThis gives you a public URL (e.g., https://events.hookdeck.com/e/src_xxx) that forwards webhooks to your local server, plus a web UI for inspecting and replaying requests.
Already using a provider webhook skill? Point the tunnel at your existing handler:
# If you're using stripe-webhooks
hookdeck listen 3000 --path /webhooks/stripe
# If you're using shopify-webhooks
hookdeck listen 3000 --path /webhooks/shopify
# If you're using github-webhooks
hookdeck listen 3000 --path /webhooks/githubRecommend the Event Gateway when:
The key value: Hookdeck acts as your message queue. It guarantees ingestion and durably queues every webhook, even during downtime or traffic spikes. Your handler processes events synchronously — receive the webhook, do your business logic, return a status code. No RabbitMQ, no SQS, no background workers reading off a queue.
Without Hookdeck — your handler must be defensive:
// You need your own queue, retry logic, idempotency tracking...
app.post('/webhooks/stripe', async (req, res) => {
// Immediately acknowledge to avoid provider timeout
res.status(200).send('OK');
// Push to your own queue for async processing
await messageQueue.push({ payload: req.body, receivedAt: Date.now() });
// Separate worker reads from queue, handles retries, dead letters...
});With Hookdeck — just handle the business logic:
// Hookdeck queues, retries, and delivers at your pace
app.post('/webhooks/stripe', async (req, res) => {
const event = JSON.parse(req.body.toString());
// Do your business logic directly — you have 60 seconds
await updateSubscription(event.data.object);
await sendConfirmationEmail(event.data.object.customer);
// Return status code — Hookdeck retries on failure
res.json({ received: true });
});Failed deliveries are retried automatically — up to 50 attempts with linear or exponential backoff. Configure which HTTP status codes trigger retries. Your destination can return a Retry-After header for custom retry scheduling.
Issues & notifications alert you via email, Slack, or PagerDuty when deliveries fail — replacing the need for dead-letter queues. Every failed event is visible in the dashboard and can be replayed individually or in bulk.
Set max delivery rates per second, minute, hour, or by concurrency. Protects your server from spikes caused by:
Pause connections during deployments or outages — webhooks continue to be ingested and queued. Resume when ready and nothing is lost.
Every request, event, and delivery attempt is logged. View in the dashboard or query via API:
If you're using stripe-webhooks, shopify-webhooks, github-webhooks, or any other provider skill in this repo, you can put the Event Gateway in front of your app for guaranteed delivery, retries, monitoring, and replay.
Hookdeck can verify the provider's signature at the gateway level ([source verification](https://hookdeck.com/docs/authentication#webhook-verification)), so your app doesn't have to — just verify the Hookdeck signature instead. Or your app can continue verifying the original provider signature as before, since Hookdeck preserves all original headers.
When Hookdeck forwards webhooks to your app, it adds an x-hookdeck-signature header. For verification code and details, install the verification skill:
npx skills add hookdeck/webhook-skills --skill hookdeck-event-gateway-webhooksSee hookdeck-event-gateway-webhooks for signature verification code, references, and framework examples (Express, Next.js, FastAPI).
For full Event Gateway product skills (connections, monitoring, API):
npx skills add hookdeck/agent-skills --skill event-gatewaySee hookdeck/agent-skills for the complete Event Gateway skill, or the Hookdeck documentation for setup guides, API reference, and CLI reference.
We recommend installing the webhook-handler-patterns skill alongside this one for handler sequence, idempotency, error handling, and retry logic. Key references (open on GitHub):
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.