trapdoor-cli

Catch and inspect HTTP requests from your terminal — and forward them to localhost, so a service on the public internet can reach a server that isn't.

npx trapdoor-cli

  trapdoor   https://trapdoor-three.vercel.app/t/94ry2mhcjp
  inspector  https://trapdoor-three.vercel.app/e/94ry2mhcjp

  waiting for requests… (ctrl-c to stop)

  05:04:37  POST    /webhooks/stripe                  49 B
  05:04:38  GET     /health                            0 B

No install, no account, no signup. Point a webhook at the URL and watch it arrive.

Receiving webhooks on a laptop

The reason this exists rather than just the website:

npx trapdoor-cli --forward http://localhost:3000/webhooks/stripe

  trapdoor   https://trapdoor-three.vercel.app/t/94ry2mhcjp
  forwarding http://localhost:3000/webhooks/stripe

  05:04:37  POST    /webhooks/stripe                  49 B  → 200 in 9ms
  05:04:38  POST    /webhooks/refund                 388 B  → 500 in 12ms

Every request that lands is replayed against your local server — same method, path, query string, headers, and body — and you see what your server answered.

The forwarding happens on your machine, not ours. Trapdoor's servers never make an outbound request on anyone's behalf; if they did, every URL a stranger could name would be reachable from our infrastructure, which is a server-side request forgery hole waiting to be found. This process pulls each capture and replays it locally, so the traffic stays inside your network and the service stays incapable of being pointed at anything.

Usage

npx trapdoor-cli                        open a trapdoor and watch it
npx trapdoor-cli --forward <url>        …and replay each request at <url>
npx trapdoor-cli tail <id>              watch a trapdoor you already have

| Flag | | |---|---| | --forward <url> | Replay every captured request against this URL, from this machine. | | --id <name> | Choose the trapdoor's id, so the URL in your config means something. Needs a Pro licence. | | --license <key> | Pro licence key. TRAPDOOR_LICENSE works too. | | --history | When tailing, replay what the trapdoor already caught. Off by default — otherwise attaching with --forward would fire every old webhook at your server at once. | | --json | One capture per line as JSON, for piping. |

TRAPDOOR_HOST points at a different deployment if you run your own.

Piping

--json prints each capture as a line of JSON, so the usual tools work:

npx trapdoor-cli --json | jq -r '.headers["stripe-signature"]'
npx trapdoor-cli --json | jq 'select(.method == "POST") | .body | fromjson'

What gets stored

Captures are held on the Trapdoor service so the web inspector can show them. Worth knowing before you point anything real at it:

• The URL is the password. Anyone holding a trapdoor link reads everything it caught. There are no accounts.
• Credential headers, and credential-looking fields in query strings and JSON or form bodies, are masked before storage — a fingerprint, not the value. It matches on names, so treat it as a safety net rather than a guarantee.
• Free trapdoors keep their last 200 requests and expire seven days after their last one.

Full detail: trapdoor-three.vercel.app/privacy

Don't send production traffic or real customer data through it. It's a debugging tool.

Related

• The web inspector, and everything else: https://trapdoor-three.vercel.app
• MCP server for AI coding agents: claude mcp add --transport http trapdoor https://trapdoor-three.vercel.app/api/mcp
• Source: https://github.com/SK000001/somethingnew

MIT.