@webhooks-cc/mcp 1.0.1 → 1.2.0

package/dist/bin/mcp.js

@@ -245,20 +245,6 @@ var import_zod2 = require("zod");
 var import_sdk = require("@webhooks-cc/sdk");
 var MAX_BODY_SIZE = 32768;
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
-var TEMPLATE_PROVIDER_VALUES = [
-  "stripe",
-  "github",
-  "shopify",
-  "twilio",
-  "slack",
-  "paddle",
-  "linear",
-  "standard-webhooks"
-];
-var VERIFY_PROVIDER_VALUES = [
-  ...TEMPLATE_PROVIDER_VALUES,
-  "discord"
-];
 var TIME_SEPARATOR = " \u2014 ";
 var httpUrlSchema = import_zod2.z.string().url().refine(
   (value) => {
@@ -273,11 +259,43 @@ var httpUrlSchema = import_zod2.z.string().url().refine(
 );
 var methodSchema = import_zod2.z.enum(HTTP_METHODS).default("POST").describe("HTTP method (default: POST)");
 var durationOrTimestampSchema = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number()]);
+var ruleConditionSchema = import_zod2.z.object({
+  field: import_zod2.z.enum(["method", "path", "header", "body_contains", "body_path", "query"]).describe("Request field to match against"),
+  op: import_zod2.z.enum(["eq", "contains", "starts_with", "matches", "exists"]).describe("Comparison operator"),
+  value: import_zod2.z.string().max(import_sdk.MAX_CONDITION_VALUE_LEN).optional().describe(
+    `Value to compare against (required unless op is "exists", max ${import_sdk.MAX_CONDITION_VALUE_LEN} chars)`
+  ),
+  name: import_zod2.z.string().max(import_sdk.MAX_CONDITION_NAME_LEN).optional().describe(
+    `Header name or query param name (required for header/query, max ${import_sdk.MAX_CONDITION_NAME_LEN} chars)`
+  ),
+  path: import_zod2.z.string().max(import_sdk.MAX_CONDITION_PATH_LEN).optional().describe(
+    `JSON dot-notation path (required for body_path, max ${import_sdk.MAX_CONDITION_PATH_LEN} chars)`
+  )
+}).refine((c) => c.op === "exists" || c.value !== void 0 && c.value.length > 0, {
+  message: 'value is required when op is not "exists"'
+}).refine(
+  (c) => !(c.field === "header" || c.field === "query") || c.name !== void 0 && c.name.length > 0,
+  { message: "name is required for header and query conditions" }
+).refine((c) => c.field !== "body_path" || c.path !== void 0 && c.path.length > 0, {
+  message: "path is required for body_path conditions"
+}).refine((c) => c.op !== "matches" || !c.value || c.value.length <= import_sdk.MAX_GLOB_PATTERN_LEN, {
+  message: `matches pattern must be ${import_sdk.MAX_GLOB_PATTERN_LEN} chars or less`
+});
+var responseRuleSchema = import_zod2.z.object({
+  name: import_zod2.z.string().max(import_sdk.MAX_RULE_NAME_LEN).optional().describe(`Human-readable rule name (max ${import_sdk.MAX_RULE_NAME_LEN} chars)`),
+  enabled: import_zod2.z.boolean().optional().default(true).describe("Whether this rule is active"),
+  logic: import_zod2.z.enum(["and", "or"]).optional().default("and").describe('How to combine conditions: "and" (all match) or "or" (any match)'),
+  conditions: import_zod2.z.array(ruleConditionSchema).min(1).max(10).describe("Conditions to evaluate (1-10)"),
+  response: import_zod2.z.lazy(() => mockResponseSchema).describe("Response when conditions match")
+});
+var responseRulesSchema = import_zod2.z.array(responseRuleSchema).max(50).describe("Ordered conditional response rules (first match wins, max 50)");
 var mockResponseSchema = import_zod2.z.object({
-  status: import_zod2.z.number().int().min(100).max(599).describe("HTTP status code (100-599)"),
+  status: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_STATUS_MIN).max(import_sdk.MOCK_RESPONSE_STATUS_MAX).describe(`HTTP status code (${import_sdk.MOCK_RESPONSE_STATUS_MIN}-${import_sdk.MOCK_RESPONSE_STATUS_MAX})`),
   body: import_zod2.z.string().default("").describe("Response body string (default: empty)"),
   headers: import_zod2.z.record(import_zod2.z.string()).default({}).describe("Response headers (default: none)"),
-  delay: import_zod2.z.number().int().min(0).max(3e4).optional().describe("Response delay in milliseconds (0-30000, default: none)")
+  delay: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_DELAY_MIN).max(import_sdk.MOCK_RESPONSE_DELAY_MAX).optional().describe(
+    `Response delay in milliseconds (${import_sdk.MOCK_RESPONSE_DELAY_MIN}-${import_sdk.MOCK_RESPONSE_DELAY_MAX}, default: none)`
+  )
 });
 function textContent(text) {
   return { content: [{ type: "text", text }] };
@@ -474,12 +492,27 @@ function registerTools(server, client) {
       name: import_zod2.z.string().optional().describe("Display name for the endpoint"),
       ephemeral: import_zod2.z.boolean().optional().describe("Create a temporary endpoint that auto-expires"),
       expiresIn: durationOrTimestampSchema.optional().describe('Auto-expire after this duration, for example "12h"'),
-      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request")
+      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request"),
+      responseRules: responseRulesSchema.optional().describe(
+        "Conditional response rules. Each rule has conditions and a response. First matching rule wins."
+      ),
+      notificationUrl: import_zod2.z.string().url().optional().describe(
+        "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
+      )
     },
-    withErrorHandling(async ({ name, ephemeral, expiresIn, mockResponse }) => {
-      const endpoint = await client.endpoints.create({ name, ephemeral, expiresIn, mockResponse });
-      return jsonContent(endpoint);
-    })
+    withErrorHandling(
+      async ({ name, ephemeral, expiresIn, mockResponse, responseRules, notificationUrl }) => {
+        const endpoint = await client.endpoints.create({
+          name,
+          ephemeral,
+          expiresIn,
+          mockResponse,
+          responseRules,
+          notificationUrl
+        });
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "list_endpoints",
@@ -501,14 +534,21 @@ function registerTools(server, client) {
   );
   server.tool(
     "update_endpoint",
-    "Update an endpoint name or mock response configuration.",
+    "Update an endpoint name, mock response, or conditional response rules.",
     {
       slug: import_zod2.z.string().describe("The endpoint slug to update"),
       name: import_zod2.z.string().optional().describe("New display name"),
-      mockResponse: mockResponseSchema.nullable().optional().describe("Mock response config, or null to clear it")
+      mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
+      responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
+      notificationUrl: import_zod2.z.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it")
     },
-    withErrorHandling(async ({ slug, name, mockResponse }) => {
-      const endpoint = await client.endpoints.update(slug, { name, mockResponse });
+    withErrorHandling(async ({ slug, name, mockResponse, responseRules, notificationUrl }) => {
+      const endpoint = await client.endpoints.update(slug, {
+        name,
+        mockResponse,
+        responseRules,
+        notificationUrl
+      });
       return jsonContent(endpoint);
     })
   );
@@ -580,7 +620,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to send with signed headers"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -765,7 +805,7 @@ function registerTools(server, client) {
     "Verify the webhook signature on a captured request.",
     {
       requestId: import_zod2.z.string().describe("The captured request ID"),
-      provider: import_zod2.z.enum(VERIFY_PROVIDER_VALUES).describe("Provider whose signature scheme should be verified"),
+      provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).describe("Provider whose signature scheme should be verified"),
       secret: import_zod2.z.string().optional().describe("Shared signing secret. Required for non-Discord providers."),
       publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio verification.")
@@ -800,7 +840,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -831,7 +871,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -853,7 +893,7 @@ function registerTools(server, client) {
     "list_provider_templates",
     "List supported webhook providers, templates, and signing metadata.",
     {
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Filter to a single provider")
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Filter to a single provider")
     },
     withErrorHandling(async ({ provider }) => {
       if (provider) {
@@ -880,7 +920,7 @@ function registerTools(server, client) {
     "test_webhook_flow",
     "Run a full webhook test flow: create endpoint, optionally mock, send, wait, verify, replay, and clean up.",
     {
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to use when sending the webhook"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to use when sending the webhook"),
       event: import_zod2.z.string().optional().describe("Optional provider event or topic name"),
       secret: import_zod2.z.string().optional().describe(
         "Signing secret. Required when provider is set or signature verification is enabled."
@@ -921,6 +961,11 @@ function registerTools(server, client) {
             secret: templateSecret
           });
           if (shouldVerify) {
+            if (provider === "discord") {
+              throw new Error(
+                "test_webhook_flow cannot verify Discord signatures (Ed25519 requires a public key, not a secret)"
+              );
+            }
             flow.verifySignature({
               provider,
               secret: templateSecret
@@ -961,7 +1006,7 @@ function registerTools(server, client) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.0.1" : "0.0.0-dev";
+var VERSION = true ? "1.2.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   if (!apiKey) {

package/dist/index.js

@@ -266,20 +266,6 @@ var import_zod2 = require("zod");
 var import_sdk = require("@webhooks-cc/sdk");
 var MAX_BODY_SIZE = 32768;
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
-var TEMPLATE_PROVIDER_VALUES = [
-  "stripe",
-  "github",
-  "shopify",
-  "twilio",
-  "slack",
-  "paddle",
-  "linear",
-  "standard-webhooks"
-];
-var VERIFY_PROVIDER_VALUES = [
-  ...TEMPLATE_PROVIDER_VALUES,
-  "discord"
-];
 var TIME_SEPARATOR = " \u2014 ";
 var httpUrlSchema = import_zod2.z.string().url().refine(
   (value) => {
@@ -294,11 +280,43 @@ var httpUrlSchema = import_zod2.z.string().url().refine(
 );
 var methodSchema = import_zod2.z.enum(HTTP_METHODS).default("POST").describe("HTTP method (default: POST)");
 var durationOrTimestampSchema = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number()]);
+var ruleConditionSchema = import_zod2.z.object({
+  field: import_zod2.z.enum(["method", "path", "header", "body_contains", "body_path", "query"]).describe("Request field to match against"),
+  op: import_zod2.z.enum(["eq", "contains", "starts_with", "matches", "exists"]).describe("Comparison operator"),
+  value: import_zod2.z.string().max(import_sdk.MAX_CONDITION_VALUE_LEN).optional().describe(
+    `Value to compare against (required unless op is "exists", max ${import_sdk.MAX_CONDITION_VALUE_LEN} chars)`
+  ),
+  name: import_zod2.z.string().max(import_sdk.MAX_CONDITION_NAME_LEN).optional().describe(
+    `Header name or query param name (required for header/query, max ${import_sdk.MAX_CONDITION_NAME_LEN} chars)`
+  ),
+  path: import_zod2.z.string().max(import_sdk.MAX_CONDITION_PATH_LEN).optional().describe(
+    `JSON dot-notation path (required for body_path, max ${import_sdk.MAX_CONDITION_PATH_LEN} chars)`
+  )
+}).refine((c) => c.op === "exists" || c.value !== void 0 && c.value.length > 0, {
+  message: 'value is required when op is not "exists"'
+}).refine(
+  (c) => !(c.field === "header" || c.field === "query") || c.name !== void 0 && c.name.length > 0,
+  { message: "name is required for header and query conditions" }
+).refine((c) => c.field !== "body_path" || c.path !== void 0 && c.path.length > 0, {
+  message: "path is required for body_path conditions"
+}).refine((c) => c.op !== "matches" || !c.value || c.value.length <= import_sdk.MAX_GLOB_PATTERN_LEN, {
+  message: `matches pattern must be ${import_sdk.MAX_GLOB_PATTERN_LEN} chars or less`
+});
+var responseRuleSchema = import_zod2.z.object({
+  name: import_zod2.z.string().max(import_sdk.MAX_RULE_NAME_LEN).optional().describe(`Human-readable rule name (max ${import_sdk.MAX_RULE_NAME_LEN} chars)`),
+  enabled: import_zod2.z.boolean().optional().default(true).describe("Whether this rule is active"),
+  logic: import_zod2.z.enum(["and", "or"]).optional().default("and").describe('How to combine conditions: "and" (all match) or "or" (any match)'),
+  conditions: import_zod2.z.array(ruleConditionSchema).min(1).max(10).describe("Conditions to evaluate (1-10)"),
+  response: import_zod2.z.lazy(() => mockResponseSchema).describe("Response when conditions match")
+});
+var responseRulesSchema = import_zod2.z.array(responseRuleSchema).max(50).describe("Ordered conditional response rules (first match wins, max 50)");
 var mockResponseSchema = import_zod2.z.object({
-  status: import_zod2.z.number().int().min(100).max(599).describe("HTTP status code (100-599)"),
+  status: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_STATUS_MIN).max(import_sdk.MOCK_RESPONSE_STATUS_MAX).describe(`HTTP status code (${import_sdk.MOCK_RESPONSE_STATUS_MIN}-${import_sdk.MOCK_RESPONSE_STATUS_MAX})`),
   body: import_zod2.z.string().default("").describe("Response body string (default: empty)"),
   headers: import_zod2.z.record(import_zod2.z.string()).default({}).describe("Response headers (default: none)"),
-  delay: import_zod2.z.number().int().min(0).max(3e4).optional().describe("Response delay in milliseconds (0-30000, default: none)")
+  delay: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_DELAY_MIN).max(import_sdk.MOCK_RESPONSE_DELAY_MAX).optional().describe(
+    `Response delay in milliseconds (${import_sdk.MOCK_RESPONSE_DELAY_MIN}-${import_sdk.MOCK_RESPONSE_DELAY_MAX}, default: none)`
+  )
 });
 function textContent(text) {
   return { content: [{ type: "text", text }] };
@@ -495,12 +513,27 @@ function registerTools(server, client) {
       name: import_zod2.z.string().optional().describe("Display name for the endpoint"),
       ephemeral: import_zod2.z.boolean().optional().describe("Create a temporary endpoint that auto-expires"),
       expiresIn: durationOrTimestampSchema.optional().describe('Auto-expire after this duration, for example "12h"'),
-      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request")
+      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request"),
+      responseRules: responseRulesSchema.optional().describe(
+        "Conditional response rules. Each rule has conditions and a response. First matching rule wins."
+      ),
+      notificationUrl: import_zod2.z.string().url().optional().describe(
+        "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
+      )
     },
-    withErrorHandling(async ({ name, ephemeral, expiresIn, mockResponse }) => {
-      const endpoint = await client.endpoints.create({ name, ephemeral, expiresIn, mockResponse });
-      return jsonContent(endpoint);
-    })
+    withErrorHandling(
+      async ({ name, ephemeral, expiresIn, mockResponse, responseRules, notificationUrl }) => {
+        const endpoint = await client.endpoints.create({
+          name,
+          ephemeral,
+          expiresIn,
+          mockResponse,
+          responseRules,
+          notificationUrl
+        });
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "list_endpoints",
@@ -522,14 +555,21 @@ function registerTools(server, client) {
   );
   server.tool(
     "update_endpoint",
-    "Update an endpoint name or mock response configuration.",
+    "Update an endpoint name, mock response, or conditional response rules.",
     {
       slug: import_zod2.z.string().describe("The endpoint slug to update"),
       name: import_zod2.z.string().optional().describe("New display name"),
-      mockResponse: mockResponseSchema.nullable().optional().describe("Mock response config, or null to clear it")
+      mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
+      responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
+      notificationUrl: import_zod2.z.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it")
     },
-    withErrorHandling(async ({ slug, name, mockResponse }) => {
-      const endpoint = await client.endpoints.update(slug, { name, mockResponse });
+    withErrorHandling(async ({ slug, name, mockResponse, responseRules, notificationUrl }) => {
+      const endpoint = await client.endpoints.update(slug, {
+        name,
+        mockResponse,
+        responseRules,
+        notificationUrl
+      });
       return jsonContent(endpoint);
     })
   );
@@ -601,7 +641,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to send with signed headers"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -786,7 +826,7 @@ function registerTools(server, client) {
     "Verify the webhook signature on a captured request.",
     {
       requestId: import_zod2.z.string().describe("The captured request ID"),
-      provider: import_zod2.z.enum(VERIFY_PROVIDER_VALUES).describe("Provider whose signature scheme should be verified"),
+      provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).describe("Provider whose signature scheme should be verified"),
       secret: import_zod2.z.string().optional().describe("Shared signing secret. Required for non-Discord providers."),
       publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio verification.")
@@ -821,7 +861,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -852,7 +892,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -874,7 +914,7 @@ function registerTools(server, client) {
     "list_provider_templates",
     "List supported webhook providers, templates, and signing metadata.",
     {
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Filter to a single provider")
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Filter to a single provider")
     },
     withErrorHandling(async ({ provider }) => {
       if (provider) {
@@ -901,7 +941,7 @@ function registerTools(server, client) {
     "test_webhook_flow",
     "Run a full webhook test flow: create endpoint, optionally mock, send, wait, verify, replay, and clean up.",
     {
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to use when sending the webhook"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to use when sending the webhook"),
       event: import_zod2.z.string().optional().describe("Optional provider event or topic name"),
       secret: import_zod2.z.string().optional().describe(
         "Signing secret. Required when provider is set or signature verification is enabled."
@@ -942,6 +982,11 @@ function registerTools(server, client) {
             secret: templateSecret
           });
           if (shouldVerify) {
+            if (provider === "discord") {
+              throw new Error(
+                "test_webhook_flow cannot verify Discord signatures (Ed25519 requires a public key, not a secret)"
+              );
+            }
             flow.verifySignature({
               provider,
               secret: templateSecret
@@ -982,7 +1027,7 @@ function registerTools(server, client) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.0.1" : "0.0.0-dev";
+var VERSION = true ? "1.2.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   if (!apiKey) {

package/dist/index.mjs

@@ -239,29 +239,26 @@ import { z as z2 } from "zod";
 import {
   diffRequests,
   extractJsonField,
+  MOCK_RESPONSE_DELAY_MAX,
+  MOCK_RESPONSE_DELAY_MIN,
+  MOCK_RESPONSE_STATUS_MAX,
+  MOCK_RESPONSE_STATUS_MIN,
+  MAX_CONDITION_VALUE_LEN,
+  MAX_CONDITION_NAME_LEN,
+  MAX_CONDITION_PATH_LEN,
+  MAX_RULE_NAME_LEN,
+  MAX_GLOB_PATTERN_LEN,
   NotFoundError,
   RateLimitError,
+  TEMPLATE_PROVIDERS,
   TimeoutError,
   UnauthorizedError,
+  VERIFY_PROVIDERS,
   verifySignature,
   WebhooksCCError
 } from "@webhooks-cc/sdk";
 var MAX_BODY_SIZE = 32768;
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
-var TEMPLATE_PROVIDER_VALUES = [
-  "stripe",
-  "github",
-  "shopify",
-  "twilio",
-  "slack",
-  "paddle",
-  "linear",
-  "standard-webhooks"
-];
-var VERIFY_PROVIDER_VALUES = [
-  ...TEMPLATE_PROVIDER_VALUES,
-  "discord"
-];
 var TIME_SEPARATOR = " \u2014 ";
 var httpUrlSchema = z2.string().url().refine(
   (value) => {
@@ -276,11 +273,43 @@ var httpUrlSchema = z2.string().url().refine(
 );
 var methodSchema = z2.enum(HTTP_METHODS).default("POST").describe("HTTP method (default: POST)");
 var durationOrTimestampSchema = z2.union([z2.string(), z2.number()]);
+var ruleConditionSchema = z2.object({
+  field: z2.enum(["method", "path", "header", "body_contains", "body_path", "query"]).describe("Request field to match against"),
+  op: z2.enum(["eq", "contains", "starts_with", "matches", "exists"]).describe("Comparison operator"),
+  value: z2.string().max(MAX_CONDITION_VALUE_LEN).optional().describe(
+    `Value to compare against (required unless op is "exists", max ${MAX_CONDITION_VALUE_LEN} chars)`
+  ),
+  name: z2.string().max(MAX_CONDITION_NAME_LEN).optional().describe(
+    `Header name or query param name (required for header/query, max ${MAX_CONDITION_NAME_LEN} chars)`
+  ),
+  path: z2.string().max(MAX_CONDITION_PATH_LEN).optional().describe(
+    `JSON dot-notation path (required for body_path, max ${MAX_CONDITION_PATH_LEN} chars)`
+  )
+}).refine((c) => c.op === "exists" || c.value !== void 0 && c.value.length > 0, {
+  message: 'value is required when op is not "exists"'
+}).refine(
+  (c) => !(c.field === "header" || c.field === "query") || c.name !== void 0 && c.name.length > 0,
+  { message: "name is required for header and query conditions" }
+).refine((c) => c.field !== "body_path" || c.path !== void 0 && c.path.length > 0, {
+  message: "path is required for body_path conditions"
+}).refine((c) => c.op !== "matches" || !c.value || c.value.length <= MAX_GLOB_PATTERN_LEN, {
+  message: `matches pattern must be ${MAX_GLOB_PATTERN_LEN} chars or less`
+});
+var responseRuleSchema = z2.object({
+  name: z2.string().max(MAX_RULE_NAME_LEN).optional().describe(`Human-readable rule name (max ${MAX_RULE_NAME_LEN} chars)`),
+  enabled: z2.boolean().optional().default(true).describe("Whether this rule is active"),
+  logic: z2.enum(["and", "or"]).optional().default("and").describe('How to combine conditions: "and" (all match) or "or" (any match)'),
+  conditions: z2.array(ruleConditionSchema).min(1).max(10).describe("Conditions to evaluate (1-10)"),
+  response: z2.lazy(() => mockResponseSchema).describe("Response when conditions match")
+});
+var responseRulesSchema = z2.array(responseRuleSchema).max(50).describe("Ordered conditional response rules (first match wins, max 50)");
 var mockResponseSchema = z2.object({
-  status: z2.number().int().min(100).max(599).describe("HTTP status code (100-599)"),
+  status: z2.number().int().min(MOCK_RESPONSE_STATUS_MIN).max(MOCK_RESPONSE_STATUS_MAX).describe(`HTTP status code (${MOCK_RESPONSE_STATUS_MIN}-${MOCK_RESPONSE_STATUS_MAX})`),
   body: z2.string().default("").describe("Response body string (default: empty)"),
   headers: z2.record(z2.string()).default({}).describe("Response headers (default: none)"),
-  delay: z2.number().int().min(0).max(3e4).optional().describe("Response delay in milliseconds (0-30000, default: none)")
+  delay: z2.number().int().min(MOCK_RESPONSE_DELAY_MIN).max(MOCK_RESPONSE_DELAY_MAX).optional().describe(
+    `Response delay in milliseconds (${MOCK_RESPONSE_DELAY_MIN}-${MOCK_RESPONSE_DELAY_MAX}, default: none)`
+  )
 });
 function textContent(text) {
   return { content: [{ type: "text", text }] };
@@ -477,12 +506,27 @@ function registerTools(server, client) {
       name: z2.string().optional().describe("Display name for the endpoint"),
       ephemeral: z2.boolean().optional().describe("Create a temporary endpoint that auto-expires"),
       expiresIn: durationOrTimestampSchema.optional().describe('Auto-expire after this duration, for example "12h"'),
-      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request")
+      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request"),
+      responseRules: responseRulesSchema.optional().describe(
+        "Conditional response rules. Each rule has conditions and a response. First matching rule wins."
+      ),
+      notificationUrl: z2.string().url().optional().describe(
+        "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
+      )
     },
-    withErrorHandling(async ({ name, ephemeral, expiresIn, mockResponse }) => {
-      const endpoint = await client.endpoints.create({ name, ephemeral, expiresIn, mockResponse });
-      return jsonContent(endpoint);
-    })
+    withErrorHandling(
+      async ({ name, ephemeral, expiresIn, mockResponse, responseRules, notificationUrl }) => {
+        const endpoint = await client.endpoints.create({
+          name,
+          ephemeral,
+          expiresIn,
+          mockResponse,
+          responseRules,
+          notificationUrl
+        });
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "list_endpoints",
@@ -504,14 +548,21 @@ function registerTools(server, client) {
   );
   server.tool(
     "update_endpoint",
-    "Update an endpoint name or mock response configuration.",
+    "Update an endpoint name, mock response, or conditional response rules.",
     {
       slug: z2.string().describe("The endpoint slug to update"),
       name: z2.string().optional().describe("New display name"),
-      mockResponse: mockResponseSchema.nullable().optional().describe("Mock response config, or null to clear it")
+      mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
+      responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
+      notificationUrl: z2.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it")
     },
-    withErrorHandling(async ({ slug, name, mockResponse }) => {
-      const endpoint = await client.endpoints.update(slug, { name, mockResponse });
+    withErrorHandling(async ({ slug, name, mockResponse, responseRules, notificationUrl }) => {
+      const endpoint = await client.endpoints.update(slug, {
+        name,
+        mockResponse,
+        responseRules,
+        notificationUrl
+      });
       return jsonContent(endpoint);
     })
   );
@@ -583,7 +634,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: z2.record(z2.string()).optional().describe("HTTP headers to include"),
       body: z2.unknown().optional().describe("Request body"),
-      provider: z2.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to send with signed headers"),
+      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
       secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
@@ -768,7 +819,7 @@ function registerTools(server, client) {
     "Verify the webhook signature on a captured request.",
     {
       requestId: z2.string().describe("The captured request ID"),
-      provider: z2.enum(VERIFY_PROVIDER_VALUES).describe("Provider whose signature scheme should be verified"),
+      provider: z2.enum(VERIFY_PROVIDERS).describe("Provider whose signature scheme should be verified"),
       secret: z2.string().optional().describe("Shared signing secret. Required for non-Discord providers."),
       publicKey: z2.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio verification.")
@@ -803,7 +854,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: z2.record(z2.string()).optional().describe("HTTP headers to include"),
       body: z2.unknown().optional().describe("Request body"),
-      provider: z2.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
       secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
@@ -834,7 +885,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: z2.record(z2.string()).optional().describe("HTTP headers to include"),
       body: z2.unknown().optional().describe("Request body"),
-      provider: z2.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
       secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
@@ -856,7 +907,7 @@ function registerTools(server, client) {
     "list_provider_templates",
     "List supported webhook providers, templates, and signing metadata.",
     {
-      provider: z2.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Filter to a single provider")
+      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Filter to a single provider")
     },
     withErrorHandling(async ({ provider }) => {
       if (provider) {
@@ -883,7 +934,7 @@ function registerTools(server, client) {
     "test_webhook_flow",
     "Run a full webhook test flow: create endpoint, optionally mock, send, wait, verify, replay, and clean up.",
     {
-      provider: z2.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to use when sending the webhook"),
+      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template to use when sending the webhook"),
       event: z2.string().optional().describe("Optional provider event or topic name"),
       secret: z2.string().optional().describe(
         "Signing secret. Required when provider is set or signature verification is enabled."
@@ -924,6 +975,11 @@ function registerTools(server, client) {
             secret: templateSecret
           });
           if (shouldVerify) {
+            if (provider === "discord") {
+              throw new Error(
+                "test_webhook_flow cannot verify Discord signatures (Ed25519 requires a public key, not a secret)"
+              );
+            }
             flow.verifySignature({
               provider,
               secret: templateSecret
@@ -964,7 +1020,7 @@ function registerTools(server, client) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.0.1" : "0.0.0-dev";
+var VERSION = true ? "1.2.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   if (!apiKey) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webhooks-cc/mcp",
-  "version": "1.0.1",
+  "version": "1.2.0",
   "description": "MCP server for webhooks.cc — AI agent integration for webhook testing",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -36,14 +36,15 @@
   },
   "homepage": "https://webhooks.cc",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^3.25.76",
-    "@webhooks-cc/sdk": "1.0.1"
+    "@webhooks-cc/sdk": "1.3.0"
   },
   "devDependencies": {
+    "@types/node": "^24.0.0",
     "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
-    "vitest": "^3.2.4"
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.2"
   },
   "scripts": {
     "build": "tsup",