@webhooks-cc/mcp 1.2.0 → 1.4.0

package/README.md

@@ -128,11 +128,17 @@ Provider template and signing support includes:
 - `slack`
 - `paddle`
 - `linear`
+- `sendgrid`
+- `clerk`
+- `discord`
+- `vercel`
+- `gitlab`
+- `typeform`
 - `standard-webhooks`
 
 Signature verification also supports:
 
-- `discord`
+- all template providers except `sendgrid`, which uses IP allowlisting instead of cryptographic signatures
 
 Use `list_provider_templates` to inspect templates, default events, signature headers, and signing requirements from the agent.
 

package/dist/bin/mcp.js

@@ -498,10 +498,38 @@ function registerTools(server, client) {
       ),
       notificationUrl: import_zod2.z.string().url().optional().describe(
         "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
-      )
+      ),
+      signingProvider: import_zod2.z.string().optional().describe(
+        "Signing provider for automatic signature verification (e.g. stripe, github, shopify)"
+      ),
+      signingSecret: import_zod2.z.string().optional().describe(
+        "Signing secret (encrypted server-side, never returned). Required when signingProvider is set."
+      ),
+      signingHeader: import_zod2.z.string().optional().describe("Custom signature header name. Only used with generic-hmac provider.")
     },
     withErrorHandling(
-      async ({ name, ephemeral, expiresIn, mockResponse, responseRules, notificationUrl }) => {
+      async ({
+        name,
+        ephemeral,
+        expiresIn,
+        mockResponse,
+        responseRules,
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        if (signingProvider) {
+          if (signingProvider !== "discord" && !signingSecret) {
+            throw new Error(`signingSecret is required for provider "${signingProvider}"`);
+          }
+          if (signingProvider === "generic-hmac" && !signingHeader) {
+            throw new Error("signingHeader is required for generic-hmac provider");
+          }
+        }
+        if (signingSecret && !signingProvider) {
+          throw new Error("signingProvider is required when signingSecret is set");
+        }
         const endpoint = await client.endpoints.create({
           name,
           ephemeral,
@@ -510,6 +538,20 @@ function registerTools(server, client) {
           responseRules,
           notificationUrl
         });
+        if (signingProvider && signingSecret) {
+          try {
+            await client.endpoints.update(endpoint.slug, {
+              signingProvider,
+              signingSecret,
+              signingHeader
+            });
+          } catch (err) {
+            return jsonContent({
+              ...endpoint,
+              warning: `Endpoint created but signing configuration failed: ${err instanceof Error ? err.message : String(err)}. Update endpoint "${endpoint.slug}" to add signing.`
+            });
+          }
+        }
         return jsonContent(endpoint);
       }
     )
@@ -534,23 +576,44 @@ function registerTools(server, client) {
   );
   server.tool(
     "update_endpoint",
-    "Update an endpoint name, mock response, or conditional response rules.",
+    "Update an endpoint name, mock response, conditional response rules, or signing configuration.",
     {
       slug: import_zod2.z.string().describe("The endpoint slug to update"),
       name: import_zod2.z.string().optional().describe("New display name"),
       mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
       responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
-      notificationUrl: import_zod2.z.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it")
+      notificationUrl: import_zod2.z.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it"),
+      signingProvider: import_zod2.z.string().nullable().optional().describe(
+        "Signing provider for automatic verification (e.g. stripe, github), or null to disable"
+      ),
+      signingSecret: import_zod2.z.string().nullable().optional().describe("New signing secret (encrypted server-side). Pass null to clear."),
+      signingHeader: import_zod2.z.string().nullable().optional().describe(
+        "Custom signature header name (only for generic-hmac provider), or null to clear"
+      )
     },
-    withErrorHandling(async ({ slug, name, mockResponse, responseRules, notificationUrl }) => {
-      const endpoint = await client.endpoints.update(slug, {
+    withErrorHandling(
+      async ({
+        slug,
         name,
         mockResponse,
         responseRules,
-        notificationUrl
-      });
-      return jsonContent(endpoint);
-    })
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        const endpoint = await client.endpoints.update(slug, {
+          name,
+          mockResponse,
+          responseRules,
+          notificationUrl,
+          signingProvider,
+          signingSecret,
+          signingHeader
+        });
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "delete_endpoint",
@@ -802,16 +865,43 @@ function registerTools(server, client) {
   );
   server.tool(
     "verify_signature",
-    "Verify the webhook signature on a captured request.",
+    "Verify the webhook signature on a captured request. When called without provider/secret, returns the server-side pre-computed result (if signing is configured on the endpoint). When called with provider+secret, performs client-side verification.",
     {
       requestId: import_zod2.z.string().describe("The captured request ID"),
-      provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).describe("Provider whose signature scheme should be verified"),
-      secret: import_zod2.z.string().optional().describe("Shared signing secret. Required for non-Discord providers."),
+      provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
+      secret: import_zod2.z.string().optional().describe(
+        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+      ),
       publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio verification.")
     },
     withErrorHandling(async ({ requestId, provider, secret, publicKey, url }) => {
       const request = await client.requests.get(requestId);
+      if (!provider && !secret && !publicKey) {
+        const verified = request.signatureVerified;
+        if (verified === null || verified === void 0) {
+          return jsonContent({
+            valid: null,
+            details: "No signature verification configured on this endpoint. Pass provider and secret to verify client-side."
+          });
+        }
+        let errorData = null;
+        if (request.signatureError) {
+          try {
+            errorData = JSON.parse(request.signatureError);
+          } catch {
+            errorData = null;
+          }
+        }
+        const isSkipped = !verified && errorData?.code && (errorData.code === "missing_header" || errorData.code === "unsupported");
+        return jsonContent({
+          valid: isSkipped ? null : verified,
+          provider: request.signingProvider ?? null,
+          details: verified ? "Signature verified by server." : isSkipped ? `Verification skipped: ${errorData?.message ?? errorData?.code}` : `Signature invalid: ${request.signatureError ?? "unknown error"}`,
+          error: request.signatureError ?? null,
+          skipped: isSkipped ?? false
+        });
+      }
       const verificationOptions = ensureVerifyArgs({ provider, secret, publicKey, url });
       const result = await (0, import_sdk.verifySignature)(request, verificationOptions);
       return jsonContent({
@@ -1006,7 +1096,7 @@ function registerTools(server, client) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.2.0" : "0.0.0-dev";
+var VERSION = true ? "1.4.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   if (!apiKey) {

package/dist/index.js

@@ -519,10 +519,38 @@ function registerTools(server, client) {
       ),
       notificationUrl: import_zod2.z.string().url().optional().describe(
         "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
-      )
+      ),
+      signingProvider: import_zod2.z.string().optional().describe(
+        "Signing provider for automatic signature verification (e.g. stripe, github, shopify)"
+      ),
+      signingSecret: import_zod2.z.string().optional().describe(
+        "Signing secret (encrypted server-side, never returned). Required when signingProvider is set."
+      ),
+      signingHeader: import_zod2.z.string().optional().describe("Custom signature header name. Only used with generic-hmac provider.")
     },
     withErrorHandling(
-      async ({ name, ephemeral, expiresIn, mockResponse, responseRules, notificationUrl }) => {
+      async ({
+        name,
+        ephemeral,
+        expiresIn,
+        mockResponse,
+        responseRules,
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        if (signingProvider) {
+          if (signingProvider !== "discord" && !signingSecret) {
+            throw new Error(`signingSecret is required for provider "${signingProvider}"`);
+          }
+          if (signingProvider === "generic-hmac" && !signingHeader) {
+            throw new Error("signingHeader is required for generic-hmac provider");
+          }
+        }
+        if (signingSecret && !signingProvider) {
+          throw new Error("signingProvider is required when signingSecret is set");
+        }
         const endpoint = await client.endpoints.create({
           name,
           ephemeral,
@@ -531,6 +559,20 @@ function registerTools(server, client) {
           responseRules,
           notificationUrl
         });
+        if (signingProvider && signingSecret) {
+          try {
+            await client.endpoints.update(endpoint.slug, {
+              signingProvider,
+              signingSecret,
+              signingHeader
+            });
+          } catch (err) {
+            return jsonContent({
+              ...endpoint,
+              warning: `Endpoint created but signing configuration failed: ${err instanceof Error ? err.message : String(err)}. Update endpoint "${endpoint.slug}" to add signing.`
+            });
+          }
+        }
         return jsonContent(endpoint);
       }
     )
@@ -555,23 +597,44 @@ function registerTools(server, client) {
   );
   server.tool(
     "update_endpoint",
-    "Update an endpoint name, mock response, or conditional response rules.",
+    "Update an endpoint name, mock response, conditional response rules, or signing configuration.",
     {
       slug: import_zod2.z.string().describe("The endpoint slug to update"),
       name: import_zod2.z.string().optional().describe("New display name"),
       mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
       responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
-      notificationUrl: import_zod2.z.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it")
+      notificationUrl: import_zod2.z.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it"),
+      signingProvider: import_zod2.z.string().nullable().optional().describe(
+        "Signing provider for automatic verification (e.g. stripe, github), or null to disable"
+      ),
+      signingSecret: import_zod2.z.string().nullable().optional().describe("New signing secret (encrypted server-side). Pass null to clear."),
+      signingHeader: import_zod2.z.string().nullable().optional().describe(
+        "Custom signature header name (only for generic-hmac provider), or null to clear"
+      )
     },
-    withErrorHandling(async ({ slug, name, mockResponse, responseRules, notificationUrl }) => {
-      const endpoint = await client.endpoints.update(slug, {
+    withErrorHandling(
+      async ({
+        slug,
         name,
         mockResponse,
         responseRules,
-        notificationUrl
-      });
-      return jsonContent(endpoint);
-    })
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        const endpoint = await client.endpoints.update(slug, {
+          name,
+          mockResponse,
+          responseRules,
+          notificationUrl,
+          signingProvider,
+          signingSecret,
+          signingHeader
+        });
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "delete_endpoint",
@@ -823,16 +886,43 @@ function registerTools(server, client) {
   );
   server.tool(
     "verify_signature",
-    "Verify the webhook signature on a captured request.",
+    "Verify the webhook signature on a captured request. When called without provider/secret, returns the server-side pre-computed result (if signing is configured on the endpoint). When called with provider+secret, performs client-side verification.",
     {
       requestId: import_zod2.z.string().describe("The captured request ID"),
-      provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).describe("Provider whose signature scheme should be verified"),
-      secret: import_zod2.z.string().optional().describe("Shared signing secret. Required for non-Discord providers."),
+      provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
+      secret: import_zod2.z.string().optional().describe(
+        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+      ),
       publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio verification.")
     },
     withErrorHandling(async ({ requestId, provider, secret, publicKey, url }) => {
       const request = await client.requests.get(requestId);
+      if (!provider && !secret && !publicKey) {
+        const verified = request.signatureVerified;
+        if (verified === null || verified === void 0) {
+          return jsonContent({
+            valid: null,
+            details: "No signature verification configured on this endpoint. Pass provider and secret to verify client-side."
+          });
+        }
+        let errorData = null;
+        if (request.signatureError) {
+          try {
+            errorData = JSON.parse(request.signatureError);
+          } catch {
+            errorData = null;
+          }
+        }
+        const isSkipped = !verified && errorData?.code && (errorData.code === "missing_header" || errorData.code === "unsupported");
+        return jsonContent({
+          valid: isSkipped ? null : verified,
+          provider: request.signingProvider ?? null,
+          details: verified ? "Signature verified by server." : isSkipped ? `Verification skipped: ${errorData?.message ?? errorData?.code}` : `Signature invalid: ${request.signatureError ?? "unknown error"}`,
+          error: request.signatureError ?? null,
+          skipped: isSkipped ?? false
+        });
+      }
       const verificationOptions = ensureVerifyArgs({ provider, secret, publicKey, url });
       const result = await (0, import_sdk.verifySignature)(request, verificationOptions);
       return jsonContent({
@@ -1027,7 +1117,7 @@ function registerTools(server, client) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.2.0" : "0.0.0-dev";
+var VERSION = true ? "1.4.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   if (!apiKey) {

package/dist/index.mjs

@@ -512,10 +512,38 @@ function registerTools(server, client) {
       ),
       notificationUrl: z2.string().url().optional().describe(
         "URL to POST a JSON summary to after each captured request (e.g. Slack/Discord webhook)"
-      )
+      ),
+      signingProvider: z2.string().optional().describe(
+        "Signing provider for automatic signature verification (e.g. stripe, github, shopify)"
+      ),
+      signingSecret: z2.string().optional().describe(
+        "Signing secret (encrypted server-side, never returned). Required when signingProvider is set."
+      ),
+      signingHeader: z2.string().optional().describe("Custom signature header name. Only used with generic-hmac provider.")
     },
     withErrorHandling(
-      async ({ name, ephemeral, expiresIn, mockResponse, responseRules, notificationUrl }) => {
+      async ({
+        name,
+        ephemeral,
+        expiresIn,
+        mockResponse,
+        responseRules,
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        if (signingProvider) {
+          if (signingProvider !== "discord" && !signingSecret) {
+            throw new Error(`signingSecret is required for provider "${signingProvider}"`);
+          }
+          if (signingProvider === "generic-hmac" && !signingHeader) {
+            throw new Error("signingHeader is required for generic-hmac provider");
+          }
+        }
+        if (signingSecret && !signingProvider) {
+          throw new Error("signingProvider is required when signingSecret is set");
+        }
         const endpoint = await client.endpoints.create({
           name,
           ephemeral,
@@ -524,6 +552,20 @@ function registerTools(server, client) {
           responseRules,
           notificationUrl
         });
+        if (signingProvider && signingSecret) {
+          try {
+            await client.endpoints.update(endpoint.slug, {
+              signingProvider,
+              signingSecret,
+              signingHeader
+            });
+          } catch (err) {
+            return jsonContent({
+              ...endpoint,
+              warning: `Endpoint created but signing configuration failed: ${err instanceof Error ? err.message : String(err)}. Update endpoint "${endpoint.slug}" to add signing.`
+            });
+          }
+        }
         return jsonContent(endpoint);
       }
     )
@@ -548,23 +590,44 @@ function registerTools(server, client) {
   );
   server.tool(
     "update_endpoint",
-    "Update an endpoint name, mock response, or conditional response rules.",
+    "Update an endpoint name, mock response, conditional response rules, or signing configuration.",
     {
       slug: z2.string().describe("The endpoint slug to update"),
       name: z2.string().optional().describe("New display name"),
       mockResponse: mockResponseSchema.nullable().optional().describe("Default mock response (used when no rule matches), or null to clear"),
       responseRules: responseRulesSchema.nullable().optional().describe("Conditional response rules (first match wins), or null to clear"),
-      notificationUrl: z2.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it")
+      notificationUrl: z2.string().url().nullable().optional().describe("Notification webhook URL, or null to clear it"),
+      signingProvider: z2.string().nullable().optional().describe(
+        "Signing provider for automatic verification (e.g. stripe, github), or null to disable"
+      ),
+      signingSecret: z2.string().nullable().optional().describe("New signing secret (encrypted server-side). Pass null to clear."),
+      signingHeader: z2.string().nullable().optional().describe(
+        "Custom signature header name (only for generic-hmac provider), or null to clear"
+      )
     },
-    withErrorHandling(async ({ slug, name, mockResponse, responseRules, notificationUrl }) => {
-      const endpoint = await client.endpoints.update(slug, {
+    withErrorHandling(
+      async ({
+        slug,
         name,
         mockResponse,
         responseRules,
-        notificationUrl
-      });
-      return jsonContent(endpoint);
-    })
+        notificationUrl,
+        signingProvider,
+        signingSecret,
+        signingHeader
+      }) => {
+        const endpoint = await client.endpoints.update(slug, {
+          name,
+          mockResponse,
+          responseRules,
+          notificationUrl,
+          signingProvider,
+          signingSecret,
+          signingHeader
+        });
+        return jsonContent(endpoint);
+      }
+    )
   );
   server.tool(
     "delete_endpoint",
@@ -816,16 +879,43 @@ function registerTools(server, client) {
   );
   server.tool(
     "verify_signature",
-    "Verify the webhook signature on a captured request.",
+    "Verify the webhook signature on a captured request. When called without provider/secret, returns the server-side pre-computed result (if signing is configured on the endpoint). When called with provider+secret, performs client-side verification.",
     {
       requestId: z2.string().describe("The captured request ID"),
-      provider: z2.enum(VERIFY_PROVIDERS).describe("Provider whose signature scheme should be verified"),
-      secret: z2.string().optional().describe("Shared signing secret. Required for non-Discord providers."),
+      provider: z2.enum(VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
+      secret: z2.string().optional().describe(
+        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+      ),
       publicKey: z2.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio verification.")
     },
     withErrorHandling(async ({ requestId, provider, secret, publicKey, url }) => {
       const request = await client.requests.get(requestId);
+      if (!provider && !secret && !publicKey) {
+        const verified = request.signatureVerified;
+        if (verified === null || verified === void 0) {
+          return jsonContent({
+            valid: null,
+            details: "No signature verification configured on this endpoint. Pass provider and secret to verify client-side."
+          });
+        }
+        let errorData = null;
+        if (request.signatureError) {
+          try {
+            errorData = JSON.parse(request.signatureError);
+          } catch {
+            errorData = null;
+          }
+        }
+        const isSkipped = !verified && errorData?.code && (errorData.code === "missing_header" || errorData.code === "unsupported");
+        return jsonContent({
+          valid: isSkipped ? null : verified,
+          provider: request.signingProvider ?? null,
+          details: verified ? "Signature verified by server." : isSkipped ? `Verification skipped: ${errorData?.message ?? errorData?.code}` : `Signature invalid: ${request.signatureError ?? "unknown error"}`,
+          error: request.signatureError ?? null,
+          skipped: isSkipped ?? false
+        });
+      }
       const verificationOptions = ensureVerifyArgs({ provider, secret, publicKey, url });
       const result = await verifySignature(request, verificationOptions);
       return jsonContent({
@@ -1020,7 +1110,7 @@ function registerTools(server, client) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.2.0" : "0.0.0-dev";
+var VERSION = true ? "1.4.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   if (!apiKey) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webhooks-cc/mcp",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "MCP server for webhooks.cc — AI agent integration for webhook testing",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -19,6 +19,13 @@
     "dist",
     "README.md"
   ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build"
+  },
   "keywords": [
     "webhook",
     "mcp",
@@ -37,19 +44,13 @@
   "homepage": "https://webhooks.cc",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "zod": "^3.25.76",
-    "@webhooks-cc/sdk": "1.3.0"
+    "@webhooks-cc/sdk": "workspace:*",
+    "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@types/node": "^24.0.0",
+    "@types/node": "^25.6.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.2",
-    "vitest": "^4.1.2"
-  },
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run"
+    "vitest": "^4.1.4"
   }
-}
+}