Webhook Crash Lab

webhook-crash-lab-mcp

[CI] [npm] [downloads]

Coding agents write webhook handlers that work for one test event and break in production on retries, duplicates and forged signatures. This package gives them a loop: run webhook-crash-lab → read structured failures with fix hints → fix → re-run.

It ships three things:

Tools

Every result comes back as text for the model and structuredContent (with an outputSchema) for clients. Errors such as a missing or invalid config come back as isError results, not crashes.

60-second start

[Install in VS Code] [Install in Cursor]

Claude Code

claude mcp add webhook-crash-lab -- npx -y [email protected]# or the full plugin (MCP server + skill):#   /plugin marketplace add Krrishkumar125/webhook-crash-lab-mcp#   /plugin install webhook-crash-lab@webhook-crash-lab

Codex

codex mcp add webhook-crash-lab -- npx -y [email protected]mkdir -p .agents/skills && cp -r node_modules/webhook-crash-lab-mcp/.agents/skills/webhook-crash-lab .agents/skills/

Cursor / other MCP clients

{  "mcpServers": {    "webhook-crash-lab": { "command": "npx", "args": ["-y", "[email protected]"] }  }}

The examples pin the version so npx never silently runs a newer release. To update, check the latest with npm view webhook-crash-lab-mcp version, read the releases, then change @0.2.4 to the new version in your MCP config and restart the client.

Then ask: "Run the webhook crash lab demo", or "Make my Stripe webhook pass webhook-crash-lab". Paste docs/AGENTS-snippet.md into AGENTS.md / CLAUDE.md to make it a standing rule.

Safety

run_crash_lab imports your crash-lab config (.mjs/.js/.cjs, or .ts/.mts/.cts via the bundled jiti) (it is code, like any config file) and sends requests to its target. Point configs at a local server and a test database and secret only. The skill tells agents never to use production URLs or live secrets.

Related

• webhook-crash-lab: the CLI/library this wraps
• eslint-plugin-webhook-safety and eslint-plugin-bullmq: the same bugs, caught statically

Sibling packages

Other tools by the same author:

• secret-blast-radius: what a malicious npm install could steal, plus a rotation plan
• zod-india: Zod schemas for GSTIN, PAN, IFSC, UPI and Aadhaar
• create-bullmq-app: scaffold a production BullMQ + TypeScript service
• webhook-crash-lab: crash-test webhook handlers against duplicates and races
• eslint-plugin-bullmq: lint rules for BullMQ production pitfalls
• eslint-plugin-webhook-safety: lint rules for unsafe Stripe webhook handlers

License

MIT © Krrish Kumar