Webhook

io.github.rog0xPublished by GitHub account rog0xv1.0.2Updated Oct 24, 2026

Send, validate, debug webhooks for AI agents

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an AI assistant send, validate, generate and debug webhook requests, including Stripe, GitHub and Slack signatures.

What you can do
  • Send webhook payloads to any URL with custom headers, body and content type, with retries and attempt records
  • Validate HMAC-SHA256 or HMAC-SHA1 signatures, including Stripe, GitHub and Slack patterns
  • Generate realistic test payloads for Stripe, GitHub and Slack events with optional field overrides
  • Debug a webhook request end to end: header parsing, body checks, provider detection, signature and timestamp checks
  • Calculate retry schedules with exponential backoff, jitter and per-attempt timestamps
When to use it
Useful when building or testing webhook integrations and you want an assistant to fire test deliveries, check signatures, produce sample payloads, or diagnose why an incoming webhook fails validation.
Requirements
Runs as a local Node.js process installed from the npm package @rog0x/mcp-webhook-tools; the README's setup builds it and points the MCP client at the built entry file. No accounts, API keys or environment variables are declared. Network access is needed to reach the target URLs.
Before you install
webhook_send makes real outbound HTTP requests to any URL you give it, so payloads and headers leave your machine and reach third-party endpoints. Signature validation and debugging may require provider signing secrets, which are passed to the tool. Test deliveries can trigger real side effects on the receiving service.

Installation

In SourceWeft

  1. Open Webhook in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-webhook-tools

Webhook management and testing tools for AI agents, built on the Model Context Protocol.

Tools

webhook_send

Send a webhook payload to any URL with custom headers, body, and content-type. Supports automatic retry with exponential backoff and jitter. Returns detailed attempt records including status codes, timing, and errors.

webhook_validate

Validate webhook signatures using HMAC-SHA256 or HMAC-SHA1. Includes built-in patterns for:

  • Stripe — t=TIMESTAMP,v1=SIGNATURE format with timestamp tolerance
  • GitHub — sha256=SIGNATURE or sha1=SIGNATURE format
  • Slack — v0=SIGNATURE with v0:timestamp:body signing scheme

Uses timing-safe comparison to prevent timing attacks.

webhook_generate_payload

Generate realistic webhook payloads for testing. Supported events:

ServiceEvents
Stripepayment_intent.succeeded
GitHubpush, pull_request
Slackmessage

Each payload includes randomized IDs, current timestamps, and suggested headers. Use the overrides parameter to customize specific fields.

webhook_debug

Analyze a webhook request end-to-end:

  • Parse and categorize headers (content-type, signature, timestamp, delivery ID, custom)
  • Validate the request body (size, JSON validity, encoding)
  • Auto-detect the provider (Stripe, GitHub, Slack)
  • Verify the signature if a secret is provided
  • Check timestamp freshness (default 300s threshold)
  • Report all issues found

webhook_retry_schedule

Calculate a retry schedule with exponential backoff. Shows each attempt's delay, cumulative elapsed time, and scheduled ISO timestamp. Configurable base delay, max delay cap, multiplier, and jitter.

Setup

bash
npm installnpm run build

MCP Configuration

Add to your MCP client config:

json
{  "mcpServers": {    "webhook-tools": {      "command": "node",      "args": ["path/to/mcp-webhook-tools/dist/index.js"]    }  }}

License

MIT

Source: README.md at commit b5a04f8

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.2LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.