What
HTTP hooks, previously stubbed with "HTTP hooks are not yet supported," are now fully implemented and operational.
Usage
{
"hooks": {
"PostToolUse": [{
"matcher": "Write",
"hooks": [{
"type": "http",
"url": "https://hooks.example.com/on-write",
"headers": { "Authorization": "Bearer $MY_TOKEN" },
"allowedEnvVars": ["MY_TOKEN"]
}]
}]
}
}Details
- Sends POST requests with hook input as JSON body
- Supports environment variable interpolation in headers via
$VAR_NAMEor${VAR_NAME}syntax - SSRF protection: private/link-local addresses are blocked; loopback (127.0.0.1, ::1) is allowed for local development
- New managed setting
allowedHttpHookUrlsfor organization-level URL allowlisting with wildcard support (e.g.,"https://hooks.example.com/*") - New managed setting
httpHookAllowedEnvVarsrestricts which environment variables hooks can interpolate, intersecting with per-hookallowedEnvVars - Responses must be valid JSON
Evidence
HTTP hook execution code (search for "Hooks: HTTP hook POST to", "ERR_HTTP_HOOK_BLOCKED_ADDRESS", "allowedHttpHookUrls")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.