@webhooks-cc/mcp 1.6.0 → 1.7.0

package/README.md

@@ -149,10 +149,14 @@ Provider template and signing support includes:
 - `mux`
 - `sentry`
 - `bitbucket`
+- `docusign`
+- `adyen`
+- `paypal`
+- `plaid`
 
 Signature verification also supports:
 
-- all template providers except `sendgrid`, which uses IP allowlisting instead of cryptographic signatures
+- all template providers except `sendgrid` (IP allowlisting) and `plaid` (JWT/JWK verification requires Plaid API credentials)
 
 Use `list_provider_templates` to inspect templates, default events, signature headers, and signing requirements from the agent.
 

package/dist/bin/mcp.js

@@ -687,15 +687,17 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(
       async ({ slug, method, headers, body, provider, template, event, secret }) => {
         let response;
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
-            throw new Error("send_webhook with provider templates requires a non-empty secret");
+          if (!templateSecret && import_sdk.TEMPLATE_METADATA[provider]?.secretRequired !== false) {
+            throw new Error(`send_webhook with provider "${provider}" requires a non-empty secret`);
           }
           response = await client.endpoints.sendTemplate(slug, {
             provider,
@@ -871,7 +873,7 @@ function registerTools(server, client) {
       requestId: import_zod2.z.string().describe("The captured request ID"),
       provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
       secret: import_zod2.z.string().optional().describe(
-        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+        "Provider credential for client-side verification (for example a shared signing secret, Adyen hex HMAC key, or PayPal webhook ID). Required for non-Discord providers."
       ),
       publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio, Square, and HubSpot verification."),
@@ -943,7 +945,9 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const response = await client.sendTo(url, {
@@ -974,7 +978,9 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const preview = await client.buildRequest(url, {
@@ -1050,9 +1056,9 @@ function registerTools(server, client) {
         }
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
+          if (!templateSecret && import_sdk.TEMPLATE_METADATA[provider]?.secretRequired !== false) {
             throw new Error(
-              "test_webhook_flow with provider templates requires a non-empty secret"
+              `test_webhook_flow with provider "${provider}" requires a non-empty secret`
             );
           }
           flow.sendTemplate({
@@ -1066,6 +1072,11 @@ function registerTools(server, client) {
                 "test_webhook_flow cannot verify Discord signatures (Ed25519 requires a public key, not a secret)"
               );
             }
+            if (!templateSecret) {
+              throw new Error(
+                `test_webhook_flow cannot verify "${provider}" signatures \u2014 this provider's templates are unsigned`
+              );
+            }
             flow.verifySignature({
               provider,
               secret: templateSecret
@@ -1208,7 +1219,7 @@ function registerAgentRegistrationTools(server) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.6.0" : "0.0.0-dev";
+var VERSION = true ? "1.7.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const server = new import_mcp2.McpServer({

package/dist/index.js

@@ -709,15 +709,17 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(
       async ({ slug, method, headers, body, provider, template, event, secret }) => {
         let response;
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
-            throw new Error("send_webhook with provider templates requires a non-empty secret");
+          if (!templateSecret && import_sdk.TEMPLATE_METADATA[provider]?.secretRequired !== false) {
+            throw new Error(`send_webhook with provider "${provider}" requires a non-empty secret`);
           }
           response = await client.endpoints.sendTemplate(slug, {
             provider,
@@ -893,7 +895,7 @@ function registerTools(server, client) {
       requestId: import_zod2.z.string().describe("The captured request ID"),
       provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
       secret: import_zod2.z.string().optional().describe(
-        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+        "Provider credential for client-side verification (for example a shared signing secret, Adyen hex HMAC key, or PayPal webhook ID). Required for non-Discord providers."
       ),
       publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio, Square, and HubSpot verification."),
@@ -965,7 +967,9 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const response = await client.sendTo(url, {
@@ -996,7 +1000,9 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const preview = await client.buildRequest(url, {
@@ -1072,9 +1078,9 @@ function registerTools(server, client) {
         }
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
+          if (!templateSecret && import_sdk.TEMPLATE_METADATA[provider]?.secretRequired !== false) {
             throw new Error(
-              "test_webhook_flow with provider templates requires a non-empty secret"
+              `test_webhook_flow with provider "${provider}" requires a non-empty secret`
             );
           }
           flow.sendTemplate({
@@ -1088,6 +1094,11 @@ function registerTools(server, client) {
                 "test_webhook_flow cannot verify Discord signatures (Ed25519 requires a public key, not a secret)"
               );
             }
+            if (!templateSecret) {
+              throw new Error(
+                `test_webhook_flow cannot verify "${provider}" signatures \u2014 this provider's templates are unsigned`
+              );
+            }
             flow.verifySignature({
               provider,
               secret: templateSecret
@@ -1230,7 +1241,7 @@ function registerAgentRegistrationTools(server) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.6.0" : "0.0.0-dev";
+var VERSION = true ? "1.7.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const server = new import_mcp2.McpServer({

package/dist/index.mjs

@@ -250,6 +250,7 @@ import {
   MAX_GLOB_PATTERN_LEN,
   NotFoundError,
   RateLimitError,
+  TEMPLATE_METADATA,
   TEMPLATE_PROVIDERS,
   TimeoutError,
   UnauthorizedError,
@@ -702,15 +703,17 @@ function registerTools(server, client) {
       provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
-      secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: z2.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(
       async ({ slug, method, headers, body, provider, template, event, secret }) => {
         let response;
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
-            throw new Error("send_webhook with provider templates requires a non-empty secret");
+          if (!templateSecret && TEMPLATE_METADATA[provider]?.secretRequired !== false) {
+            throw new Error(`send_webhook with provider "${provider}" requires a non-empty secret`);
           }
           response = await client.endpoints.sendTemplate(slug, {
             provider,
@@ -886,7 +889,7 @@ function registerTools(server, client) {
       requestId: z2.string().describe("The captured request ID"),
       provider: z2.enum(VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
       secret: z2.string().optional().describe(
-        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+        "Provider credential for client-side verification (for example a shared signing secret, Adyen hex HMAC key, or PayPal webhook ID). Required for non-Discord providers."
       ),
       publicKey: z2.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio, Square, and HubSpot verification."),
@@ -958,7 +961,9 @@ function registerTools(server, client) {
       provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
-      secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: z2.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const response = await client.sendTo(url, {
@@ -989,7 +994,9 @@ function registerTools(server, client) {
       provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
-      secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: z2.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const preview = await client.buildRequest(url, {
@@ -1065,9 +1072,9 @@ function registerTools(server, client) {
         }
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
+          if (!templateSecret && TEMPLATE_METADATA[provider]?.secretRequired !== false) {
             throw new Error(
-              "test_webhook_flow with provider templates requires a non-empty secret"
+              `test_webhook_flow with provider "${provider}" requires a non-empty secret`
             );
           }
           flow.sendTemplate({
@@ -1081,6 +1088,11 @@ function registerTools(server, client) {
                 "test_webhook_flow cannot verify Discord signatures (Ed25519 requires a public key, not a secret)"
               );
             }
+            if (!templateSecret) {
+              throw new Error(
+                `test_webhook_flow cannot verify "${provider}" signatures \u2014 this provider's templates are unsigned`
+              );
+            }
             flow.verifySignature({
               provider,
               secret: templateSecret
@@ -1223,7 +1235,7 @@ function registerAgentRegistrationTools(server) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.6.0" : "0.0.0-dev";
+var VERSION = true ? "1.7.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const server = new McpServer2({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webhooks-cc/mcp",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "MCP server for webhooks.cc — AI agent integration for webhook testing",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -36,15 +36,15 @@
   },
   "homepage": "https://webhooks.cc",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^4.4.3",
-    "@webhooks-cc/sdk": "1.8.0"
+    "@webhooks-cc/sdk": "1.9.1"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "^26.2.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.10"
   },
   "scripts": {
     "build": "tsup",