@webhooks-cc/mcp 1.1.0 → 1.3.0

package/dist/bin/mcp.js

@@ -245,35 +245,6 @@ var import_zod2 = require("zod");
 var import_sdk = require("@webhooks-cc/sdk");
 var MAX_BODY_SIZE = 32768;
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
-var TEMPLATE_PROVIDER_VALUES = [
-  "stripe",
-  "github",
-  "shopify",
-  "twilio",
-  "slack",
-  "paddle",
-  "linear",
-  "sendgrid",
-  "clerk",
-  "discord",
-  "vercel",
-  "gitlab",
-  "standard-webhooks"
-];
-var VERIFY_PROVIDER_VALUES = [
-  "stripe",
-  "github",
-  "shopify",
-  "twilio",
-  "slack",
-  "paddle",
-  "linear",
-  "clerk",
-  "discord",
-  "vercel",
-  "gitlab",
-  "standard-webhooks"
-];
 var TIME_SEPARATOR = " \u2014 ";
 var httpUrlSchema = import_zod2.z.string().url().refine(
   (value) => {
@@ -288,11 +259,43 @@ var httpUrlSchema = import_zod2.z.string().url().refine(
 );
 var methodSchema = import_zod2.z.enum(HTTP_METHODS).default("POST").describe("HTTP method (default: POST)");
 var durationOrTimestampSchema = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number()]);
+var ruleConditionSchema = import_zod2.z.object({
+  field: import_zod2.z.enum(["method", "path", "header", "body_contains", "body_path", "query"]).describe("Request field to match against"),
+  op: import_zod2.z.enum(["eq", "contains", "starts_with", "matches", "exists"]).describe("Comparison operator"),
+  value: import_zod2.z.string().max(import_sdk.MAX_CONDITION_VALUE_LEN).optional().describe(
+    `Value to compare against (required unless op is "exists", max ${import_sdk.MAX_CONDITION_VALUE_LEN} chars)`
+  ),
+  name: import_zod2.z.string().max(import_sdk.MAX_CONDITION_NAME_LEN).optional().describe(
+    `Header name or query param name (required for header/query, max ${import_sdk.MAX_CONDITION_NAME_LEN} chars)`
+  ),
+  path: import_zod2.z.string().max(import_sdk.MAX_CONDITION_PATH_LEN).optional().describe(
+    `JSON dot-notation path (required for body_path, max ${import_sdk.MAX_CONDITION_PATH_LEN} chars)`
+  )
+}).refine((c) => c.op === "exists" || c.value !== void 0 && c.value.length > 0, {
+  message: 'value is required when op is not "exists"'
+}).refine(
+  (c) => !(c.field === "header" || c.field === "query") || c.name !== void 0 && c.name.length > 0,
+  { message: "name is required for header and query conditions" }
+).refine((c) => c.field !== "body_path" || c.path !== void 0 && c.path.length > 0, {
+  message: "path is required for body_path conditions"
+}).refine((c) => c.op !== "matches" || !c.value || c.value.length <= import_sdk.MAX_GLOB_PATTERN_LEN, {
+  message: `matches pattern must be ${import_sdk.MAX_GLOB_PATTERN_LEN} chars or less`
+});
+var responseRuleSchema = import_zod2.z.object({
+  name: import_zod2.z.string().max(import_sdk.MAX_RULE_NAME_LEN).optional().describe(`Human-readable rule name (max ${import_sdk.MAX_RULE_NAME_LEN} chars)`),
+  enabled: import_zod2.z.boolean().optional().default(true).describe("Whether this rule is active"),
+  logic: import_zod2.z.enum(["and", "or"]).optional().default("and").describe('How to combine conditions: "and" (all match) or "or" (any match)'),
+  conditions: import_zod2.z.array(ruleConditionSchema).min(1).max(10).describe("Conditions to evaluate (1-10)"),
+  response: import_zod2.z.lazy(() => mockResponseSchema).describe("Response when conditions match")
+});
+var responseRulesSchema = import_zod2.z.array(responseRuleSchema).max(50).describe("Ordered conditional response rules (first match wins, max 50)");
 var mockResponseSchema = import_zod2.z.object({
-  status: import_zod2.z.number().int().min(100).max(599).describe("HTTP status code (100-599)"),
+  status: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_STATUS_MIN).max(import_sdk.MOCK_RESPONSE_STATUS_MAX).describe(`HTTP status code (${import_sdk.MOCK_RESPONSE_STATUS_MIN}-${import_sdk.MOCK_RESPONSE_STATUS_MAX})`),
   body: import_zod2.z.string().default("").describe("Response body string (default: empty)"),
   headers: import_zod2.z.record(import_zod2.z.string()).default({}).describe("Response headers (default: none)"),
-  delay: import_zod2.z.number().int().min(0).max(3e4).optional().describe("Response delay in milliseconds (0-30000, default: none)")
+  delay: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_DELAY_MIN).max(import_sdk.MOCK_RESPONSE_DELAY_MAX).optional().describe(
+    `Response delay in milliseconds (${import_sdk.MOCK_RESPONSE_DELAY_MIN}-${import_sdk.MOCK_RESPONSE_DELAY_MAX}, default: none)`
+  )
 });
 function textContent(text) {
   return { content: [{ type: "text", text }] };
@@ -489,12 +492,69 @@ function registerTools(server, client) {
       name: import_zod2.z.string().optional().describe("Display name for the endpoint"),
       ephemeral: import_zod2.z.boolean().optional().describe("Create a temporary endpoint that auto-expires"),
       expiresIn: durationOrTimestampSchema.optional().describe('Auto-expire after this duration, for example "12h"'),
-      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request")
+      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request"),
+      responseRules: responseRulesSchema.optional().describe(
+        "Conditional response rules. Each rule has conditions and a response. First matching rule wins."
+      ),
+      notificationUrl: import_zod2.z.string().url().optional().describe(
+        "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
+      ),
+      signingProvider: import_zod2.z.string().optional().describe(
+        "Signing provider for automatic signature verification (e.g. stripe, github, shopify)"
+      ),
+      signingSecret: import_zod2.z.string().optional().describe(
+        "Signing secret (encrypted server-side, never returned). Required when signingProvider is set."
+      ),
+      signingHeader: import_zod2.z.string().optional().describe("Custom signature header name. Only used with generic-hmac provider.")
     },
-    withErrorHandling(async ({ name, ephemeral, expiresIn, mockResponse }) => {
-      const endpoint = await client.endpoints.create({ name, ephemeral, expiresIn, mockResponse });
-      return jsonContent(endpoint);
-    })
+    withErrorHandling(
+      async ({
+        name,
+        ephemeral,
+        expiresIn,
+        mockResponse,
+        responseRules,
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        if (signingProvider) {
+          if (signingProvider !== "discord" && !signingSecret) {
+            throw new Error(`signingSecret is required for provider "${signingProvider}"`);
+          }
+          if (signingProvider === "generic-hmac" && !signingHeader) {
+            throw new Error("signingHeader is required for generic-hmac provider");
+          }
+        }
+        if (signingSecret && !signingProvider) {
+          throw new Error("signingProvider is required when signingSecret is set");
+        }
+        const endpoint = await client.endpoints.create({
+          name,
+          ephemeral,
+          expiresIn,
+          mockResponse,
+          responseRules,
+          notificationUrl
+        });
+        if (signingProvider && signingSecret) {
+          try {
+            await client.endpoints.update(endpoint.slug, {
+              signingProvider,
+              signingSecret,
+              signingHeader
+            });
+          } catch (err) {
+            return jsonContent({
+              ...endpoint,
+              warning: `Endpoint created but signing configuration failed: ${err instanceof Error ? err.message : String(err)}. Update endpoint "${endpoint.slug}" to add signing.`
+            });
+          }
+        }
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "list_endpoints",
@@ -516,16 +576,44 @@ function registerTools(server, client) {
   );
   server.tool(
     "update_endpoint",
-    "Update an endpoint name or mock response configuration.",
+    "Update an endpoint name, mock response, conditional response rules, or signing configuration.",
     {
       slug: import_zod2.z.string().describe("The endpoint slug to update"),
       name: import_zod2.z.string().optional().describe("New display name"),
-      mockResponse: mockResponseSchema.nullable().optional().describe("Mock response config, or null to clear it")
+      mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
+      responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
+      notificationUrl: import_zod2.z.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it"),
+      signingProvider: import_zod2.z.string().nullable().optional().describe(
+        "Signing provider for automatic verification (e.g. stripe, github), or null to disable"
+      ),
+      signingSecret: import_zod2.z.string().nullable().optional().describe("New signing secret (encrypted server-side). Pass null to clear."),
+      signingHeader: import_zod2.z.string().nullable().optional().describe(
+        "Custom signature header name (only for generic-hmac provider), or null to clear"
+      )
     },
-    withErrorHandling(async ({ slug, name, mockResponse }) => {
-      const endpoint = await client.endpoints.update(slug, { name, mockResponse });
-      return jsonContent(endpoint);
-    })
+    withErrorHandling(
+      async ({
+        slug,
+        name,
+        mockResponse,
+        responseRules,
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        const endpoint = await client.endpoints.update(slug, {
+          name,
+          mockResponse,
+          responseRules,
+          notificationUrl,
+          signingProvider,
+          signingSecret,
+          signingHeader
+        });
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "delete_endpoint",
@@ -595,7 +683,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to send with signed headers"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -777,16 +865,43 @@ function registerTools(server, client) {
   );
   server.tool(
     "verify_signature",
-    "Verify the webhook signature on a captured request.",
+    "Verify the webhook signature on a captured request. When called without provider/secret, returns the server-side pre-computed result (if signing is configured on the endpoint). When called with provider+secret, performs client-side verification.",
     {
       requestId: import_zod2.z.string().describe("The captured request ID"),
-      provider: import_zod2.z.enum(VERIFY_PROVIDER_VALUES).describe("Provider whose signature scheme should be verified"),
-      secret: import_zod2.z.string().optional().describe("Shared signing secret. Required for non-Discord providers."),
+      provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
+      secret: import_zod2.z.string().optional().describe(
+        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+      ),
       publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio verification.")
     },
     withErrorHandling(async ({ requestId, provider, secret, publicKey, url }) => {
       const request = await client.requests.get(requestId);
+      if (!provider && !secret && !publicKey) {
+        const verified = request.signatureVerified;
+        if (verified === null || verified === void 0) {
+          return jsonContent({
+            valid: null,
+            details: "No signature verification configured on this endpoint. Pass provider and secret to verify client-side."
+          });
+        }
+        let errorData = null;
+        if (request.signatureError) {
+          try {
+            errorData = JSON.parse(request.signatureError);
+          } catch {
+            errorData = null;
+          }
+        }
+        const isSkipped = !verified && errorData?.code && (errorData.code === "missing_header" || errorData.code === "unsupported");
+        return jsonContent({
+          valid: isSkipped ? null : verified,
+          provider: request.signingProvider ?? null,
+          details: verified ? "Signature verified by server." : isSkipped ? `Verification skipped: ${errorData?.message ?? errorData?.code}` : `Signature invalid: ${request.signatureError ?? "unknown error"}`,
+          error: request.signatureError ?? null,
+          skipped: isSkipped ?? false
+        });
+      }
       const verificationOptions = ensureVerifyArgs({ provider, secret, publicKey, url });
       const result = await (0, import_sdk.verifySignature)(request, verificationOptions);
       return jsonContent({
@@ -815,7 +930,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -846,7 +961,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -868,7 +983,7 @@ function registerTools(server, client) {
     "list_provider_templates",
     "List supported webhook providers, templates, and signing metadata.",
     {
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Filter to a single provider")
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Filter to a single provider")
     },
     withErrorHandling(async ({ provider }) => {
       if (provider) {
@@ -895,7 +1010,7 @@ function registerTools(server, client) {
     "test_webhook_flow",
     "Run a full webhook test flow: create endpoint, optionally mock, send, wait, verify, replay, and clean up.",
     {
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to use when sending the webhook"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to use when sending the webhook"),
       event: import_zod2.z.string().optional().describe("Optional provider event or topic name"),
       secret: import_zod2.z.string().optional().describe(
         "Signing secret. Required when provider is set or signature verification is enabled."
@@ -981,7 +1096,7 @@ function registerTools(server, client) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.1.0" : "0.0.0-dev";
+var VERSION = true ? "1.3.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   if (!apiKey) {

package/dist/index.js

@@ -266,35 +266,6 @@ var import_zod2 = require("zod");
 var import_sdk = require("@webhooks-cc/sdk");
 var MAX_BODY_SIZE = 32768;
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
-var TEMPLATE_PROVIDER_VALUES = [
-  "stripe",
-  "github",
-  "shopify",
-  "twilio",
-  "slack",
-  "paddle",
-  "linear",
-  "sendgrid",
-  "clerk",
-  "discord",
-  "vercel",
-  "gitlab",
-  "standard-webhooks"
-];
-var VERIFY_PROVIDER_VALUES = [
-  "stripe",
-  "github",
-  "shopify",
-  "twilio",
-  "slack",
-  "paddle",
-  "linear",
-  "clerk",
-  "discord",
-  "vercel",
-  "gitlab",
-  "standard-webhooks"
-];
 var TIME_SEPARATOR = " \u2014 ";
 var httpUrlSchema = import_zod2.z.string().url().refine(
   (value) => {
@@ -309,11 +280,43 @@ var httpUrlSchema = import_zod2.z.string().url().refine(
 );
 var methodSchema = import_zod2.z.enum(HTTP_METHODS).default("POST").describe("HTTP method (default: POST)");
 var durationOrTimestampSchema = import_zod2.z.union([import_zod2.z.string(), import_zod2.z.number()]);
+var ruleConditionSchema = import_zod2.z.object({
+  field: import_zod2.z.enum(["method", "path", "header", "body_contains", "body_path", "query"]).describe("Request field to match against"),
+  op: import_zod2.z.enum(["eq", "contains", "starts_with", "matches", "exists"]).describe("Comparison operator"),
+  value: import_zod2.z.string().max(import_sdk.MAX_CONDITION_VALUE_LEN).optional().describe(
+    `Value to compare against (required unless op is "exists", max ${import_sdk.MAX_CONDITION_VALUE_LEN} chars)`
+  ),
+  name: import_zod2.z.string().max(import_sdk.MAX_CONDITION_NAME_LEN).optional().describe(
+    `Header name or query param name (required for header/query, max ${import_sdk.MAX_CONDITION_NAME_LEN} chars)`
+  ),
+  path: import_zod2.z.string().max(import_sdk.MAX_CONDITION_PATH_LEN).optional().describe(
+    `JSON dot-notation path (required for body_path, max ${import_sdk.MAX_CONDITION_PATH_LEN} chars)`
+  )
+}).refine((c) => c.op === "exists" || c.value !== void 0 && c.value.length > 0, {
+  message: 'value is required when op is not "exists"'
+}).refine(
+  (c) => !(c.field === "header" || c.field === "query") || c.name !== void 0 && c.name.length > 0,
+  { message: "name is required for header and query conditions" }
+).refine((c) => c.field !== "body_path" || c.path !== void 0 && c.path.length > 0, {
+  message: "path is required for body_path conditions"
+}).refine((c) => c.op !== "matches" || !c.value || c.value.length <= import_sdk.MAX_GLOB_PATTERN_LEN, {
+  message: `matches pattern must be ${import_sdk.MAX_GLOB_PATTERN_LEN} chars or less`
+});
+var responseRuleSchema = import_zod2.z.object({
+  name: import_zod2.z.string().max(import_sdk.MAX_RULE_NAME_LEN).optional().describe(`Human-readable rule name (max ${import_sdk.MAX_RULE_NAME_LEN} chars)`),
+  enabled: import_zod2.z.boolean().optional().default(true).describe("Whether this rule is active"),
+  logic: import_zod2.z.enum(["and", "or"]).optional().default("and").describe('How to combine conditions: "and" (all match) or "or" (any match)'),
+  conditions: import_zod2.z.array(ruleConditionSchema).min(1).max(10).describe("Conditions to evaluate (1-10)"),
+  response: import_zod2.z.lazy(() => mockResponseSchema).describe("Response when conditions match")
+});
+var responseRulesSchema = import_zod2.z.array(responseRuleSchema).max(50).describe("Ordered conditional response rules (first match wins, max 50)");
 var mockResponseSchema = import_zod2.z.object({
-  status: import_zod2.z.number().int().min(100).max(599).describe("HTTP status code (100-599)"),
+  status: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_STATUS_MIN).max(import_sdk.MOCK_RESPONSE_STATUS_MAX).describe(`HTTP status code (${import_sdk.MOCK_RESPONSE_STATUS_MIN}-${import_sdk.MOCK_RESPONSE_STATUS_MAX})`),
   body: import_zod2.z.string().default("").describe("Response body string (default: empty)"),
   headers: import_zod2.z.record(import_zod2.z.string()).default({}).describe("Response headers (default: none)"),
-  delay: import_zod2.z.number().int().min(0).max(3e4).optional().describe("Response delay in milliseconds (0-30000, default: none)")
+  delay: import_zod2.z.number().int().min(import_sdk.MOCK_RESPONSE_DELAY_MIN).max(import_sdk.MOCK_RESPONSE_DELAY_MAX).optional().describe(
+    `Response delay in milliseconds (${import_sdk.MOCK_RESPONSE_DELAY_MIN}-${import_sdk.MOCK_RESPONSE_DELAY_MAX}, default: none)`
+  )
 });
 function textContent(text) {
   return { content: [{ type: "text", text }] };
@@ -510,12 +513,69 @@ function registerTools(server, client) {
       name: import_zod2.z.string().optional().describe("Display name for the endpoint"),
       ephemeral: import_zod2.z.boolean().optional().describe("Create a temporary endpoint that auto-expires"),
       expiresIn: durationOrTimestampSchema.optional().describe('Auto-expire after this duration, for example "12h"'),
-      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request")
+      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request"),
+      responseRules: responseRulesSchema.optional().describe(
+        "Conditional response rules. Each rule has conditions and a response. First matching rule wins."
+      ),
+      notificationUrl: import_zod2.z.string().url().optional().describe(
+        "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
+      ),
+      signingProvider: import_zod2.z.string().optional().describe(
+        "Signing provider for automatic signature verification (e.g. stripe, github, shopify)"
+      ),
+      signingSecret: import_zod2.z.string().optional().describe(
+        "Signing secret (encrypted server-side, never returned). Required when signingProvider is set."
+      ),
+      signingHeader: import_zod2.z.string().optional().describe("Custom signature header name. Only used with generic-hmac provider.")
     },
-    withErrorHandling(async ({ name, ephemeral, expiresIn, mockResponse }) => {
-      const endpoint = await client.endpoints.create({ name, ephemeral, expiresIn, mockResponse });
-      return jsonContent(endpoint);
-    })
+    withErrorHandling(
+      async ({
+        name,
+        ephemeral,
+        expiresIn,
+        mockResponse,
+        responseRules,
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        if (signingProvider) {
+          if (signingProvider !== "discord" && !signingSecret) {
+            throw new Error(`signingSecret is required for provider "${signingProvider}"`);
+          }
+          if (signingProvider === "generic-hmac" && !signingHeader) {
+            throw new Error("signingHeader is required for generic-hmac provider");
+          }
+        }
+        if (signingSecret && !signingProvider) {
+          throw new Error("signingProvider is required when signingSecret is set");
+        }
+        const endpoint = await client.endpoints.create({
+          name,
+          ephemeral,
+          expiresIn,
+          mockResponse,
+          responseRules,
+          notificationUrl
+        });
+        if (signingProvider && signingSecret) {
+          try {
+            await client.endpoints.update(endpoint.slug, {
+              signingProvider,
+              signingSecret,
+              signingHeader
+            });
+          } catch (err) {
+            return jsonContent({
+              ...endpoint,
+              warning: `Endpoint created but signing configuration failed: ${err instanceof Error ? err.message : String(err)}. Update endpoint "${endpoint.slug}" to add signing.`
+            });
+          }
+        }
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "list_endpoints",
@@ -537,16 +597,44 @@ function registerTools(server, client) {
   );
   server.tool(
     "update_endpoint",
-    "Update an endpoint name or mock response configuration.",
+    "Update an endpoint name, mock response, conditional response rules, or signing configuration.",
     {
       slug: import_zod2.z.string().describe("The endpoint slug to update"),
       name: import_zod2.z.string().optional().describe("New display name"),
-      mockResponse: mockResponseSchema.nullable().optional().describe("Mock response config, or null to clear it")
+      mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
+      responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
+      notificationUrl: import_zod2.z.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it"),
+      signingProvider: import_zod2.z.string().nullable().optional().describe(
+        "Signing provider for automatic verification (e.g. stripe, github), or null to disable"
+      ),
+      signingSecret: import_zod2.z.string().nullable().optional().describe("New signing secret (encrypted server-side). Pass null to clear."),
+      signingHeader: import_zod2.z.string().nullable().optional().describe(
+        "Custom signature header name (only for generic-hmac provider), or null to clear"
+      )
     },
-    withErrorHandling(async ({ slug, name, mockResponse }) => {
-      const endpoint = await client.endpoints.update(slug, { name, mockResponse });
-      return jsonContent(endpoint);
-    })
+    withErrorHandling(
+      async ({
+        slug,
+        name,
+        mockResponse,
+        responseRules,
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        const endpoint = await client.endpoints.update(slug, {
+          name,
+          mockResponse,
+          responseRules,
+          notificationUrl,
+          signingProvider,
+          signingSecret,
+          signingHeader
+        });
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "delete_endpoint",
@@ -616,7 +704,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to send with signed headers"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -798,16 +886,43 @@ function registerTools(server, client) {
   );
   server.tool(
     "verify_signature",
-    "Verify the webhook signature on a captured request.",
+    "Verify the webhook signature on a captured request. When called without provider/secret, returns the server-side pre-computed result (if signing is configured on the endpoint). When called with provider+secret, performs client-side verification.",
     {
       requestId: import_zod2.z.string().describe("The captured request ID"),
-      provider: import_zod2.z.enum(VERIFY_PROVIDER_VALUES).describe("Provider whose signature scheme should be verified"),
-      secret: import_zod2.z.string().optional().describe("Shared signing secret. Required for non-Discord providers."),
+      provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
+      secret: import_zod2.z.string().optional().describe(
+        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+      ),
       publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio verification.")
     },
     withErrorHandling(async ({ requestId, provider, secret, publicKey, url }) => {
       const request = await client.requests.get(requestId);
+      if (!provider && !secret && !publicKey) {
+        const verified = request.signatureVerified;
+        if (verified === null || verified === void 0) {
+          return jsonContent({
+            valid: null,
+            details: "No signature verification configured on this endpoint. Pass provider and secret to verify client-side."
+          });
+        }
+        let errorData = null;
+        if (request.signatureError) {
+          try {
+            errorData = JSON.parse(request.signatureError);
+          } catch {
+            errorData = null;
+          }
+        }
+        const isSkipped = !verified && errorData?.code && (errorData.code === "missing_header" || errorData.code === "unsupported");
+        return jsonContent({
+          valid: isSkipped ? null : verified,
+          provider: request.signingProvider ?? null,
+          details: verified ? "Signature verified by server." : isSkipped ? `Verification skipped: ${errorData?.message ?? errorData?.code}` : `Signature invalid: ${request.signatureError ?? "unknown error"}`,
+          error: request.signatureError ?? null,
+          skipped: isSkipped ?? false
+        });
+      }
       const verificationOptions = ensureVerifyArgs({ provider, secret, publicKey, url });
       const result = await (0, import_sdk.verifySignature)(request, verificationOptions);
       return jsonContent({
@@ -836,7 +951,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -867,7 +982,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: import_zod2.z.record(import_zod2.z.string()).optional().describe("HTTP headers to include"),
       body: import_zod2.z.unknown().optional().describe("Request body"),
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
       secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
@@ -889,7 +1004,7 @@ function registerTools(server, client) {
     "list_provider_templates",
     "List supported webhook providers, templates, and signing metadata.",
     {
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Filter to a single provider")
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Filter to a single provider")
     },
     withErrorHandling(async ({ provider }) => {
       if (provider) {
@@ -916,7 +1031,7 @@ function registerTools(server, client) {
     "test_webhook_flow",
     "Run a full webhook test flow: create endpoint, optionally mock, send, wait, verify, replay, and clean up.",
     {
-      provider: import_zod2.z.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to use when sending the webhook"),
+      provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to use when sending the webhook"),
       event: import_zod2.z.string().optional().describe("Optional provider event or topic name"),
       secret: import_zod2.z.string().optional().describe(
         "Signing secret. Required when provider is set or signature verification is enabled."
@@ -1002,7 +1117,7 @@ function registerTools(server, client) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.1.0" : "0.0.0-dev";
+var VERSION = true ? "1.3.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   if (!apiKey) {

package/dist/index.mjs

@@ -239,44 +239,26 @@ import { z as z2 } from "zod";
 import {
   diffRequests,
   extractJsonField,
+  MOCK_RESPONSE_DELAY_MAX,
+  MOCK_RESPONSE_DELAY_MIN,
+  MOCK_RESPONSE_STATUS_MAX,
+  MOCK_RESPONSE_STATUS_MIN,
+  MAX_CONDITION_VALUE_LEN,
+  MAX_CONDITION_NAME_LEN,
+  MAX_CONDITION_PATH_LEN,
+  MAX_RULE_NAME_LEN,
+  MAX_GLOB_PATTERN_LEN,
   NotFoundError,
   RateLimitError,
+  TEMPLATE_PROVIDERS,
   TimeoutError,
   UnauthorizedError,
+  VERIFY_PROVIDERS,
   verifySignature,
   WebhooksCCError
 } from "@webhooks-cc/sdk";
 var MAX_BODY_SIZE = 32768;
 var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
-var TEMPLATE_PROVIDER_VALUES = [
-  "stripe",
-  "github",
-  "shopify",
-  "twilio",
-  "slack",
-  "paddle",
-  "linear",
-  "sendgrid",
-  "clerk",
-  "discord",
-  "vercel",
-  "gitlab",
-  "standard-webhooks"
-];
-var VERIFY_PROVIDER_VALUES = [
-  "stripe",
-  "github",
-  "shopify",
-  "twilio",
-  "slack",
-  "paddle",
-  "linear",
-  "clerk",
-  "discord",
-  "vercel",
-  "gitlab",
-  "standard-webhooks"
-];
 var TIME_SEPARATOR = " \u2014 ";
 var httpUrlSchema = z2.string().url().refine(
   (value) => {
@@ -291,11 +273,43 @@ var httpUrlSchema = z2.string().url().refine(
 );
 var methodSchema = z2.enum(HTTP_METHODS).default("POST").describe("HTTP method (default: POST)");
 var durationOrTimestampSchema = z2.union([z2.string(), z2.number()]);
+var ruleConditionSchema = z2.object({
+  field: z2.enum(["method", "path", "header", "body_contains", "body_path", "query"]).describe("Request field to match against"),
+  op: z2.enum(["eq", "contains", "starts_with", "matches", "exists"]).describe("Comparison operator"),
+  value: z2.string().max(MAX_CONDITION_VALUE_LEN).optional().describe(
+    `Value to compare against (required unless op is "exists", max ${MAX_CONDITION_VALUE_LEN} chars)`
+  ),
+  name: z2.string().max(MAX_CONDITION_NAME_LEN).optional().describe(
+    `Header name or query param name (required for header/query, max ${MAX_CONDITION_NAME_LEN} chars)`
+  ),
+  path: z2.string().max(MAX_CONDITION_PATH_LEN).optional().describe(
+    `JSON dot-notation path (required for body_path, max ${MAX_CONDITION_PATH_LEN} chars)`
+  )
+}).refine((c) => c.op === "exists" || c.value !== void 0 && c.value.length > 0, {
+  message: 'value is required when op is not "exists"'
+}).refine(
+  (c) => !(c.field === "header" || c.field === "query") || c.name !== void 0 && c.name.length > 0,
+  { message: "name is required for header and query conditions" }
+).refine((c) => c.field !== "body_path" || c.path !== void 0 && c.path.length > 0, {
+  message: "path is required for body_path conditions"
+}).refine((c) => c.op !== "matches" || !c.value || c.value.length <= MAX_GLOB_PATTERN_LEN, {
+  message: `matches pattern must be ${MAX_GLOB_PATTERN_LEN} chars or less`
+});
+var responseRuleSchema = z2.object({
+  name: z2.string().max(MAX_RULE_NAME_LEN).optional().describe(`Human-readable rule name (max ${MAX_RULE_NAME_LEN} chars)`),
+  enabled: z2.boolean().optional().default(true).describe("Whether this rule is active"),
+  logic: z2.enum(["and", "or"]).optional().default("and").describe('How to combine conditions: "and" (all match) or "or" (any match)'),
+  conditions: z2.array(ruleConditionSchema).min(1).max(10).describe("Conditions to evaluate (1-10)"),
+  response: z2.lazy(() => mockResponseSchema).describe("Response when conditions match")
+});
+var responseRulesSchema = z2.array(responseRuleSchema).max(50).describe("Ordered conditional response rules (first match wins, max 50)");
 var mockResponseSchema = z2.object({
-  status: z2.number().int().min(100).max(599).describe("HTTP status code (100-599)"),
+  status: z2.number().int().min(MOCK_RESPONSE_STATUS_MIN).max(MOCK_RESPONSE_STATUS_MAX).describe(`HTTP status code (${MOCK_RESPONSE_STATUS_MIN}-${MOCK_RESPONSE_STATUS_MAX})`),
   body: z2.string().default("").describe("Response body string (default: empty)"),
   headers: z2.record(z2.string()).default({}).describe("Response headers (default: none)"),
-  delay: z2.number().int().min(0).max(3e4).optional().describe("Response delay in milliseconds (0-30000, default: none)")
+  delay: z2.number().int().min(MOCK_RESPONSE_DELAY_MIN).max(MOCK_RESPONSE_DELAY_MAX).optional().describe(
+    `Response delay in milliseconds (${MOCK_RESPONSE_DELAY_MIN}-${MOCK_RESPONSE_DELAY_MAX}, default: none)`
+  )
 });
 function textContent(text) {
   return { content: [{ type: "text", text }] };
@@ -492,12 +506,69 @@ function registerTools(server, client) {
       name: z2.string().optional().describe("Display name for the endpoint"),
       ephemeral: z2.boolean().optional().describe("Create a temporary endpoint that auto-expires"),
       expiresIn: durationOrTimestampSchema.optional().describe('Auto-expire after this duration, for example "12h"'),
-      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request")
+      mockResponse: mockResponseSchema.optional().describe("Optional mock response to return when the endpoint receives a request"),
+      responseRules: responseRulesSchema.optional().describe(
+        "Conditional response rules. Each rule has conditions and a response. First matching rule wins."
+      ),
+      notificationUrl: z2.string().url().optional().describe(
+        "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
+      ),
+      signingProvider: z2.string().optional().describe(
+        "Signing provider for automatic signature verification (e.g. stripe, github, shopify)"
+      ),
+      signingSecret: z2.string().optional().describe(
+        "Signing secret (encrypted server-side, never returned). Required when signingProvider is set."
+      ),
+      signingHeader: z2.string().optional().describe("Custom signature header name. Only used with generic-hmac provider.")
     },
-    withErrorHandling(async ({ name, ephemeral, expiresIn, mockResponse }) => {
-      const endpoint = await client.endpoints.create({ name, ephemeral, expiresIn, mockResponse });
-      return jsonContent(endpoint);
-    })
+    withErrorHandling(
+      async ({
+        name,
+        ephemeral,
+        expiresIn,
+        mockResponse,
+        responseRules,
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        if (signingProvider) {
+          if (signingProvider !== "discord" && !signingSecret) {
+            throw new Error(`signingSecret is required for provider "${signingProvider}"`);
+          }
+          if (signingProvider === "generic-hmac" && !signingHeader) {
+            throw new Error("signingHeader is required for generic-hmac provider");
+          }
+        }
+        if (signingSecret && !signingProvider) {
+          throw new Error("signingProvider is required when signingSecret is set");
+        }
+        const endpoint = await client.endpoints.create({
+          name,
+          ephemeral,
+          expiresIn,
+          mockResponse,
+          responseRules,
+          notificationUrl
+        });
+        if (signingProvider && signingSecret) {
+          try {
+            await client.endpoints.update(endpoint.slug, {
+              signingProvider,
+              signingSecret,
+              signingHeader
+            });
+          } catch (err) {
+            return jsonContent({
+              ...endpoint,
+              warning: `Endpoint created but signing configuration failed: ${err instanceof Error ? err.message : String(err)}. Update endpoint "${endpoint.slug}" to add signing.`
+            });
+          }
+        }
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "list_endpoints",
@@ -519,16 +590,44 @@ function registerTools(server, client) {
   );
   server.tool(
     "update_endpoint",
-    "Update an endpoint name or mock response configuration.",
+    "Update an endpoint name, mock response, conditional response rules, or signing configuration.",
     {
       slug: z2.string().describe("The endpoint slug to update"),
       name: z2.string().optional().describe("New display name"),
-      mockResponse: mockResponseSchema.nullable().optional().describe("Mock response config, or null to clear it")
+      mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
+      responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
+      notificationUrl: z2.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it"),
+      signingProvider: z2.string().nullable().optional().describe(
+        "Signing provider for automatic verification (e.g. stripe, github), or null to disable"
+      ),
+      signingSecret: z2.string().nullable().optional().describe("New signing secret (encrypted server-side). Pass null to clear."),
+      signingHeader: z2.string().nullable().optional().describe(
+        "Custom signature header name (only for generic-hmac provider), or null to clear"
+      )
     },
-    withErrorHandling(async ({ slug, name, mockResponse }) => {
-      const endpoint = await client.endpoints.update(slug, { name, mockResponse });
-      return jsonContent(endpoint);
-    })
+    withErrorHandling(
+      async ({
+        slug,
+        name,
+        mockResponse,
+        responseRules,
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        const endpoint = await client.endpoints.update(slug, {
+          name,
+          mockResponse,
+          responseRules,
+          notificationUrl,
+          signingProvider,
+          signingSecret,
+          signingHeader
+        });
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "delete_endpoint",
@@ -598,7 +697,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: z2.record(z2.string()).optional().describe("HTTP headers to include"),
       body: z2.unknown().optional().describe("Request body"),
-      provider: z2.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to send with signed headers"),
+      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
       secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
@@ -780,16 +879,43 @@ function registerTools(server, client) {
   );
   server.tool(
     "verify_signature",
-    "Verify the webhook signature on a captured request.",
+    "Verify the webhook signature on a captured request. When called without provider/secret, returns the server-side pre-computed result (if signing is configured on the endpoint). When called with provider+secret, performs client-side verification.",
     {
       requestId: z2.string().describe("The captured request ID"),
-      provider: z2.enum(VERIFY_PROVIDER_VALUES).describe("Provider whose signature scheme should be verified"),
-      secret: z2.string().optional().describe("Shared signing secret. Required for non-Discord providers."),
+      provider: z2.enum(VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
+      secret: z2.string().optional().describe(
+        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+      ),
       publicKey: z2.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio verification.")
     },
     withErrorHandling(async ({ requestId, provider, secret, publicKey, url }) => {
       const request = await client.requests.get(requestId);
+      if (!provider && !secret && !publicKey) {
+        const verified = request.signatureVerified;
+        if (verified === null || verified === void 0) {
+          return jsonContent({
+            valid: null,
+            details: "No signature verification configured on this endpoint. Pass provider and secret to verify client-side."
+          });
+        }
+        let errorData = null;
+        if (request.signatureError) {
+          try {
+            errorData = JSON.parse(request.signatureError);
+          } catch {
+            errorData = null;
+          }
+        }
+        const isSkipped = !verified && errorData?.code && (errorData.code === "missing_header" || errorData.code === "unsupported");
+        return jsonContent({
+          valid: isSkipped ? null : verified,
+          provider: request.signingProvider ?? null,
+          details: verified ? "Signature verified by server." : isSkipped ? `Verification skipped: ${errorData?.message ?? errorData?.code}` : `Signature invalid: ${request.signatureError ?? "unknown error"}`,
+          error: request.signatureError ?? null,
+          skipped: isSkipped ?? false
+        });
+      }
       const verificationOptions = ensureVerifyArgs({ provider, secret, publicKey, url });
       const result = await verifySignature(request, verificationOptions);
       return jsonContent({
@@ -818,7 +944,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: z2.record(z2.string()).optional().describe("HTTP headers to include"),
       body: z2.unknown().optional().describe("Request body"),
-      provider: z2.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
       secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
@@ -849,7 +975,7 @@ function registerTools(server, client) {
       method: methodSchema,
       headers: z2.record(z2.string()).optional().describe("HTTP headers to include"),
       body: z2.unknown().optional().describe("Request body"),
-      provider: z2.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template for signing"),
+      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
       secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
@@ -871,7 +997,7 @@ function registerTools(server, client) {
     "list_provider_templates",
     "List supported webhook providers, templates, and signing metadata.",
     {
-      provider: z2.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Filter to a single provider")
+      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Filter to a single provider")
     },
     withErrorHandling(async ({ provider }) => {
       if (provider) {
@@ -898,7 +1024,7 @@ function registerTools(server, client) {
     "test_webhook_flow",
     "Run a full webhook test flow: create endpoint, optionally mock, send, wait, verify, replay, and clean up.",
     {
-      provider: z2.enum(TEMPLATE_PROVIDER_VALUES).optional().describe("Optional provider template to use when sending the webhook"),
+      provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template to use when sending the webhook"),
       event: z2.string().optional().describe("Optional provider event or topic name"),
       secret: z2.string().optional().describe(
         "Signing secret. Required when provider is set or signature verification is enabled."
@@ -984,7 +1110,7 @@ function registerTools(server, client) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.1.0" : "0.0.0-dev";
+var VERSION = true ? "1.3.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   if (!apiKey) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webhooks-cc/mcp",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "MCP server for webhooks.cc — AI agent integration for webhook testing",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -36,14 +36,15 @@
   },
   "homepage": "https://webhooks.cc",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^3.25.76",
-    "@webhooks-cc/sdk": "1.1.0"
+    "@webhooks-cc/sdk": "1.4.0"
   },
   "devDependencies": {
+    "@types/node": "^24.12.2",
     "tsup": "^8.5.1",
-    "typescript": "^5.9.3",
-    "vitest": "^3.2.4"
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.4"
   },
   "scripts": {
     "build": "tsup",