settings — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited settings (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Real-time GitHub webhook notifications for Claude via Cloudflare Worker + Durable Object.
GitHub ──POST──▶ Cloudflare Worker ──▶ Durable Object (SQLite)
│
├── MCP tools (Streamable HTTP)
├── WebSocket real-time stream
│
┌────────────────┘
│
Desktop / Codex: .mcpb local bridge ──▶ polling via MCP tools
Claude Code CLI: .mcpb local bridge ──▶ WebSocket → channel notifications| Component | Required |
|---|---|
| Node.js 18+ | MCP server |
| Cloudflare account | Worker deployment (self-hosting) |
Install the GitHub Webhook MCP app on your GitHub organization or account:
Note: When the app requests new permissions after an update, you must approve them in your GitHub notification or the app's installation settings. Webhooks will not be delivered until permissions are accepted.
Important: Do not create a separate repository webhook for the same endpoint. The GitHub App handles all webhook delivery — a repository webhook would cause duplicate or malformed requests.
Continue to the Installation guide to connect your AI assistant to the webhook service.
See the Installation wiki page for the full setup guide, including:
User prompt:
"Are there any new GitHub notifications?"
Expected output: The AI calls get_pending_status and returns a summary:
You have 3 pending webhook events:
- 2 push events
- 1 pull_request eventUser prompt:
"Show me the details of the latest pull request event."
Expected output: The AI calls list_pending_events to find the PR event, then get_event with the event ID to retrieve the full payload:
PR #42 "Fix login timeout" was opened by @alice in repo acme/web-app
Branch: fix/login-timeout → main
Status: open
Changed files: 3User prompt:
"I've reviewed all the push notifications, mark them as done."
Expected output: The AI calls list_pending_events to find push events, then mark_processed for each one:
Marked 2 push events as processed:
- Push to main by @bob (3 commits)
- Push to develop by @alice (1 commit)User prompt:
"Did the CI checks pass on my latest PR?"
Expected output: The AI calls list_pending_events to find check_run events related to the PR, then get_event for details:
CI results for PR #42 "Fix login timeout":
- build (ubuntu-latest): ✓ passed
- lint: ✓ passed
- test (node-18): ✓ passed
All checks passed.| Tool | Description |
|---|---|
get_pending_status | Lightweight snapshot of pending event counts by type |
list_pending_events | Summaries of pending events (no full payloads) |
get_event | Full payload for a single event by ID |
get_webhook_events | Full payloads for all pending events |
mark_processed | Mark an event as processed |
worker/ — Cloudflare Worker + Durable Objects
local-mcp/ — Local stdio MCP bridge (TypeScript, dev)
mcp-server/ — .mcpb package for Claude Desktop
shared/ — Shared types and utilitiesEvents are stored in a Cloudflare Durable Object (edge storage). The local MCP bridge proxies tool calls to the Worker and does not store event data locally.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.