trapdoorpricingsource ↗

A URL that catches whatever you throw at it.

Point a webhook, a cron job, a misbehaving client — anything that speaks HTTP — at a trapdoor and watch the request land: method, path, query, every header, the raw body, where it came from. Live, with no setup and no account.

no signup · ready in about a second

Live, not refresh

Requests stream in over SSE the moment they arrive. Leave the tab open next to your terminal.

Answer back

Set the status code, content type, body, and an artificial delay — then see how your client copes with a 500 or a slow reply.

Or stand in the middle

Point a trapdoor at your real endpoint and it relays each request onward, answering the sender with whatever came back. You get the transcript; nothing downstream notices.

Built for agents too

A plain JSON API, a long poll that blocks until the next request lands, and an MCP server — so a coding agent can check its own webhook actually fired.

For AI agents

Trapdoor speaks MCP. Point any MCP client at the endpoint below and an agent gets seven tools — the useful ones being wait_for_request, which blocks until something lands instead of making it guess a polling interval, and set_response, which makes a trapdoor return a 500 or stall for five seconds so retry logic can be tested on purpose rather than by waiting for a real outage.

https://trapdoor-three.vercel.app/api/mcp

claude mcp add --transport http trapdoor https://trapdoor-three.vercel.app/api/mcp

Try it

# open a trapdoor
curl -sX POST https://trapdoor-three.vercel.app/api/endpoints

# drop something through it
curl -X POST https://trapdoor-three.vercel.app/t/<id>/orders \
  -H 'content-type: application/json' \
  -d '{"hello":"world"}'

# read the captures back
curl -s https://trapdoor-three.vercel.app/api/endpoints/<id>/requests

What you should know

  • The URL is the password. Anyone holding a trapdoor link can read everything it caught. Treat it as a secret, and don't send real production traffic through it.
  • Credentials are masked on the way in. Authorization, Cookie, and API-key headers are stored as a fingerprint — scheme, first and last four characters, length — so you can confirm they arrived without leaving a usable token in a database. The same goes for credential-looking fields in a query string or a JSON or form body: ?api_key=, access_token, password and friends.
  • Replies are sandboxed. A trapdoor set to return HTML cannot run script against this origin, so nobody can turn one into a phishing page on this domain. HTTP clients ignore the header, so testing is unaffected.
  • Free trapdoors keep their last 200 requests, truncate bodies over 256 KB, and expire a week after their last request. Pro raises those to 5,000, 5 MB, and 90 days, and adds chosen ids and server-side forwarding. The inspector, the API, the MCP server and the exports are the same on both.