@webhooks-cc/mcp 1.6.0 → 1.8.0

package/README.md

@@ -58,7 +58,7 @@ Get your API key at [webhooks.cc/account](https://webhooks.cc/account).
 
 ## What it exposes
 
-The server exposes `25` tools, `3` prompts, and `3` resource surfaces.
+The server exposes `35` tools, `3` prompts, and `3` resource surfaces.
 
 ### Endpoint tools
 
@@ -91,12 +91,32 @@ The server exposes `25` tools, `3` prompts, and `3` resource surfaces.
 - `preview_webhook`
 - `test_webhook_flow`
 
+### Team tools
+
+- `list_teams`
+- `list_team_members`
+- `share_endpoint`
+- `unshare_endpoint`
+
+Endpoints shared with you already appear in `list_endpoints` (with `fromTeam`) and work with every request tool except `clear_requests`, which stays with the owner. Invites are not exposed: accepting one claims a paid seat.
+
 ### Discovery and account tools
 
 - `list_provider_templates`
-- `get_usage`
+- `get_usage` (personal plan plus each subscribed team's pool)
 - `describe`
 
+### Agent registration tools
+
+Registered on every server, with or without an API key, so an agent that has no credential yet can obtain one (auth.md):
+
+- `how_to_register`
+- `register_agent`
+- `check_claim`
+- `register_agent_with_email`
+- `verify_agent_otp`
+- `register_agent_with_idjag`
+
 ## Prompts
 
 The server exposes MCP prompts for common workflows:
@@ -149,10 +169,14 @@ Provider template and signing support includes:
 - `mux`
 - `sentry`
 - `bitbucket`
+- `docusign`
+- `adyen`
+- `paypal`
+- `plaid`
 
 Signature verification also supports:
 
-- all template providers except `sendgrid`, which uses IP allowlisting instead of cryptographic signatures
+- all template providers except `sendgrid` (IP allowlisting) and `plaid` (JWT/JWK verification requires Plaid API credentials)
 
 Use `list_provider_templates` to inspect templates, default events, signature headers, and signing requirements from the agent.
 

package/dist/bin/mcp.js

@@ -559,11 +559,62 @@ function registerTools(server, client) {
   );
   server.tool(
     "list_endpoints",
-    "List all webhook endpoints for the authenticated user.",
+    "List webhook endpoints: those you own (with sharedWith) and those shared with you through teams (with fromTeam). Optionally keep only one team's endpoints.",
+    {
+      team: import_zod2.z.string().min(1).optional().describe(
+        "Team id or name (case-insensitive). Keeps endpoints shared with you from that team and endpoints you own that are shared with it."
+      )
+    },
+    withErrorHandling(async ({ team }) => {
+      const endpoints = await client.endpoints.list({ team });
+      return jsonContent(endpoints);
+    })
+  );
+  server.tool(
+    "list_teams",
+    "List the teams you own or belong to, with role, seats, pooled request usage (requestsUsed/requestLimit), period end, and whether the team is suspended for lack of a subscription.",
     {},
     withErrorHandling(async () => {
-      const endpoints = await client.endpoints.list();
-      return jsonContent(endpoints);
+      const teams = await client.teams.list();
+      return jsonContent(
+        teams.map((team) => ({
+          ...team,
+          periodEnd: team.periodEnd ? new Date(team.periodEnd).toISOString() : null
+        }))
+      );
+    })
+  );
+  server.tool(
+    "list_team_members",
+    "List a team's members and pending invites. Any member of the team may call this.",
+    { teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)") },
+    withErrorHandling(async ({ teamId }) => {
+      const result = await client.teams.members(teamId);
+      return jsonContent(result);
+    })
+  );
+  server.tool(
+    "share_endpoint",
+    "Share an endpoint you own with a team so its members can inspect, stream, and edit it. The team needs an active subscription; the endpoint's requests then bill the team's pooled quota.",
+    {
+      slug: import_zod2.z.string().describe("Slug of an endpoint you own"),
+      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)")
+    },
+    withErrorHandling(async ({ slug, teamId }) => {
+      await client.teams.share(teamId, slug);
+      return jsonContent({ shared: true, slug, teamId });
+    })
+  );
+  server.tool(
+    "unshare_endpoint",
+    "Stop sharing an endpoint you own with a team. Works even when the team is suspended.",
+    {
+      slug: import_zod2.z.string().describe("Slug of an endpoint you own"),
+      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)")
+    },
+    withErrorHandling(async ({ slug, teamId }) => {
+      await client.teams.unshare(teamId, slug);
+      return jsonContent({ shared: false, slug, teamId });
     })
   );
   server.tool(
@@ -687,15 +738,17 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(
       async ({ slug, method, headers, body, provider, template, event, secret }) => {
         let response;
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
-            throw new Error("send_webhook with provider templates requires a non-empty secret");
+          if (!templateSecret && import_sdk.TEMPLATE_METADATA[provider]?.secretRequired !== false) {
+            throw new Error(`send_webhook with provider "${provider}" requires a non-empty secret`);
           }
           response = await client.endpoints.sendTemplate(slug, {
             provider,
@@ -871,7 +924,7 @@ function registerTools(server, client) {
       requestId: import_zod2.z.string().describe("The captured request ID"),
       provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
       secret: import_zod2.z.string().optional().describe(
-        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+        "Provider credential for client-side verification (for example a shared signing secret, Adyen hex HMAC key, or PayPal webhook ID). Required for non-Discord providers."
       ),
       publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio, Square, and HubSpot verification."),
@@ -943,7 +996,9 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const response = await client.sendTo(url, {
@@ -974,7 +1029,9 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const preview = await client.buildRequest(url, {
@@ -1006,13 +1063,31 @@ function registerTools(server, client) {
   );
   server.tool(
     "get_usage",
-    "Check current request usage, remaining quota, plan, and period end.",
+    "Check current request usage, remaining quota, plan, and period end, plus the pooled quota of every subscribed team you belong to.",
     {},
     withErrorHandling(async () => {
-      const usage = await client.usage();
+      const [usageResult, teamsResult] = await Promise.allSettled([
+        client.usage(),
+        client.teams.list()
+      ]);
+      if (usageResult.status === "rejected") throw usageResult.reason;
+      const usage = usageResult.value;
+      const teams = teamsResult.status === "fulfilled" ? teamsResult.value : [];
+      const teamsError = teamsResult.status === "rejected" ? teamsResult.reason instanceof Error ? teamsResult.reason.message : String(teamsResult.reason) : void 0;
       return jsonContent({
         ...usage,
-        periodEnd: usage.periodEnd ? new Date(usage.periodEnd).toISOString() : null
+        periodEnd: usage.periodEnd ? new Date(usage.periodEnd).toISOString() : null,
+        ...teamsError ? { teamsError } : {},
+        teams: teams.filter((team) => !team.suspended).map((team) => ({
+          id: team.id,
+          name: team.name,
+          role: team.role,
+          seats: team.seats,
+          used: team.requestsUsed,
+          limit: team.requestLimit,
+          remaining: Math.max(0, team.requestLimit - team.requestsUsed),
+          periodEnd: team.periodEnd ? new Date(team.periodEnd).toISOString() : null
+        }))
       });
     })
   );
@@ -1050,9 +1125,9 @@ function registerTools(server, client) {
         }
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
+          if (!templateSecret && import_sdk.TEMPLATE_METADATA[provider]?.secretRequired !== false) {
             throw new Error(
-              "test_webhook_flow with provider templates requires a non-empty secret"
+              `test_webhook_flow with provider "${provider}" requires a non-empty secret`
             );
           }
           flow.sendTemplate({
@@ -1066,6 +1141,11 @@ function registerTools(server, client) {
                 "test_webhook_flow cannot verify Discord signatures (Ed25519 requires a public key, not a secret)"
               );
             }
+            if (!templateSecret) {
+              throw new Error(
+                `test_webhook_flow cannot verify "${provider}" signatures \u2014 this provider's templates are unsigned`
+              );
+            }
             flow.verifySignature({
               provider,
               secret: templateSecret
@@ -1208,7 +1288,7 @@ function registerAgentRegistrationTools(server) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.6.0" : "0.0.0-dev";
+var VERSION = true ? "1.8.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const server = new import_mcp2.McpServer({

package/dist/index.js

@@ -581,11 +581,62 @@ function registerTools(server, client) {
   );
   server.tool(
     "list_endpoints",
-    "List all webhook endpoints for the authenticated user.",
+    "List webhook endpoints: those you own (with sharedWith) and those shared with you through teams (with fromTeam). Optionally keep only one team's endpoints.",
+    {
+      team: import_zod2.z.string().min(1).optional().describe(
+        "Team id or name (case-insensitive). Keeps endpoints shared with you from that team and endpoints you own that are shared with it."
+      )
+    },
+    withErrorHandling(async ({ team }) => {
+      const endpoints = await client.endpoints.list({ team });
+      return jsonContent(endpoints);
+    })
+  );
+  server.tool(
+    "list_teams",
+    "List the teams you own or belong to, with role, seats, pooled request usage (requestsUsed/requestLimit), period end, and whether the team is suspended for lack of a subscription.",
     {},
     withErrorHandling(async () => {
-      const endpoints = await client.endpoints.list();
-      return jsonContent(endpoints);
+      const teams = await client.teams.list();
+      return jsonContent(
+        teams.map((team) => ({
+          ...team,
+          periodEnd: team.periodEnd ? new Date(team.periodEnd).toISOString() : null
+        }))
+      );
+    })
+  );
+  server.tool(
+    "list_team_members",
+    "List a team's members and pending invites. Any member of the team may call this.",
+    { teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)") },
+    withErrorHandling(async ({ teamId }) => {
+      const result = await client.teams.members(teamId);
+      return jsonContent(result);
+    })
+  );
+  server.tool(
+    "share_endpoint",
+    "Share an endpoint you own with a team so its members can inspect, stream, and edit it. The team needs an active subscription; the endpoint's requests then bill the team's pooled quota.",
+    {
+      slug: import_zod2.z.string().describe("Slug of an endpoint you own"),
+      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)")
+    },
+    withErrorHandling(async ({ slug, teamId }) => {
+      await client.teams.share(teamId, slug);
+      return jsonContent({ shared: true, slug, teamId });
+    })
+  );
+  server.tool(
+    "unshare_endpoint",
+    "Stop sharing an endpoint you own with a team. Works even when the team is suspended.",
+    {
+      slug: import_zod2.z.string().describe("Slug of an endpoint you own"),
+      teamId: import_zod2.z.string().min(1).describe("Team id (from list_teams)")
+    },
+    withErrorHandling(async ({ slug, teamId }) => {
+      await client.teams.unshare(teamId, slug);
+      return jsonContent({ shared: false, slug, teamId });
     })
   );
   server.tool(
@@ -709,15 +760,17 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(
       async ({ slug, method, headers, body, provider, template, event, secret }) => {
         let response;
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
-            throw new Error("send_webhook with provider templates requires a non-empty secret");
+          if (!templateSecret && import_sdk.TEMPLATE_METADATA[provider]?.secretRequired !== false) {
+            throw new Error(`send_webhook with provider "${provider}" requires a non-empty secret`);
           }
           response = await client.endpoints.sendTemplate(slug, {
             provider,
@@ -893,7 +946,7 @@ function registerTools(server, client) {
       requestId: import_zod2.z.string().describe("The captured request ID"),
       provider: import_zod2.z.enum(import_sdk.VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
       secret: import_zod2.z.string().optional().describe(
-        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+        "Provider credential for client-side verification (for example a shared signing secret, Adyen hex HMAC key, or PayPal webhook ID). Required for non-Discord providers."
       ),
       publicKey: import_zod2.z.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio, Square, and HubSpot verification."),
@@ -965,7 +1018,9 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const response = await client.sendTo(url, {
@@ -996,7 +1051,9 @@ function registerTools(server, client) {
       provider: import_zod2.z.enum(import_sdk.TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: import_zod2.z.string().optional().describe("Provider-specific template preset"),
       event: import_zod2.z.string().optional().describe("Provider event or topic name"),
-      secret: import_zod2.z.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: import_zod2.z.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const preview = await client.buildRequest(url, {
@@ -1028,13 +1085,31 @@ function registerTools(server, client) {
   );
   server.tool(
     "get_usage",
-    "Check current request usage, remaining quota, plan, and period end.",
+    "Check current request usage, remaining quota, plan, and period end, plus the pooled quota of every subscribed team you belong to.",
     {},
     withErrorHandling(async () => {
-      const usage = await client.usage();
+      const [usageResult, teamsResult] = await Promise.allSettled([
+        client.usage(),
+        client.teams.list()
+      ]);
+      if (usageResult.status === "rejected") throw usageResult.reason;
+      const usage = usageResult.value;
+      const teams = teamsResult.status === "fulfilled" ? teamsResult.value : [];
+      const teamsError = teamsResult.status === "rejected" ? teamsResult.reason instanceof Error ? teamsResult.reason.message : String(teamsResult.reason) : void 0;
       return jsonContent({
         ...usage,
-        periodEnd: usage.periodEnd ? new Date(usage.periodEnd).toISOString() : null
+        periodEnd: usage.periodEnd ? new Date(usage.periodEnd).toISOString() : null,
+        ...teamsError ? { teamsError } : {},
+        teams: teams.filter((team) => !team.suspended).map((team) => ({
+          id: team.id,
+          name: team.name,
+          role: team.role,
+          seats: team.seats,
+          used: team.requestsUsed,
+          limit: team.requestLimit,
+          remaining: Math.max(0, team.requestLimit - team.requestsUsed),
+          periodEnd: team.periodEnd ? new Date(team.periodEnd).toISOString() : null
+        }))
       });
     })
   );
@@ -1072,9 +1147,9 @@ function registerTools(server, client) {
         }
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
+          if (!templateSecret && import_sdk.TEMPLATE_METADATA[provider]?.secretRequired !== false) {
             throw new Error(
-              "test_webhook_flow with provider templates requires a non-empty secret"
+              `test_webhook_flow with provider "${provider}" requires a non-empty secret`
             );
           }
           flow.sendTemplate({
@@ -1088,6 +1163,11 @@ function registerTools(server, client) {
                 "test_webhook_flow cannot verify Discord signatures (Ed25519 requires a public key, not a secret)"
               );
             }
+            if (!templateSecret) {
+              throw new Error(
+                `test_webhook_flow cannot verify "${provider}" signatures \u2014 this provider's templates are unsigned`
+              );
+            }
             flow.verifySignature({
               provider,
               secret: templateSecret
@@ -1230,7 +1310,7 @@ function registerAgentRegistrationTools(server) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.6.0" : "0.0.0-dev";
+var VERSION = true ? "1.8.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const server = new import_mcp2.McpServer({

package/dist/index.mjs

@@ -250,6 +250,7 @@ import {
   MAX_GLOB_PATTERN_LEN,
   NotFoundError,
   RateLimitError,
+  TEMPLATE_METADATA,
   TEMPLATE_PROVIDERS,
   TimeoutError,
   UnauthorizedError,
@@ -574,11 +575,62 @@ function registerTools(server, client) {
   );
   server.tool(
     "list_endpoints",
-    "List all webhook endpoints for the authenticated user.",
+    "List webhook endpoints: those you own (with sharedWith) and those shared with you through teams (with fromTeam). Optionally keep only one team's endpoints.",
+    {
+      team: z2.string().min(1).optional().describe(
+        "Team id or name (case-insensitive). Keeps endpoints shared with you from that team and endpoints you own that are shared with it."
+      )
+    },
+    withErrorHandling(async ({ team }) => {
+      const endpoints = await client.endpoints.list({ team });
+      return jsonContent(endpoints);
+    })
+  );
+  server.tool(
+    "list_teams",
+    "List the teams you own or belong to, with role, seats, pooled request usage (requestsUsed/requestLimit), period end, and whether the team is suspended for lack of a subscription.",
     {},
     withErrorHandling(async () => {
-      const endpoints = await client.endpoints.list();
-      return jsonContent(endpoints);
+      const teams = await client.teams.list();
+      return jsonContent(
+        teams.map((team) => ({
+          ...team,
+          periodEnd: team.periodEnd ? new Date(team.periodEnd).toISOString() : null
+        }))
+      );
+    })
+  );
+  server.tool(
+    "list_team_members",
+    "List a team's members and pending invites. Any member of the team may call this.",
+    { teamId: z2.string().min(1).describe("Team id (from list_teams)") },
+    withErrorHandling(async ({ teamId }) => {
+      const result = await client.teams.members(teamId);
+      return jsonContent(result);
+    })
+  );
+  server.tool(
+    "share_endpoint",
+    "Share an endpoint you own with a team so its members can inspect, stream, and edit it. The team needs an active subscription; the endpoint's requests then bill the team's pooled quota.",
+    {
+      slug: z2.string().describe("Slug of an endpoint you own"),
+      teamId: z2.string().min(1).describe("Team id (from list_teams)")
+    },
+    withErrorHandling(async ({ slug, teamId }) => {
+      await client.teams.share(teamId, slug);
+      return jsonContent({ shared: true, slug, teamId });
+    })
+  );
+  server.tool(
+    "unshare_endpoint",
+    "Stop sharing an endpoint you own with a team. Works even when the team is suspended.",
+    {
+      slug: z2.string().describe("Slug of an endpoint you own"),
+      teamId: z2.string().min(1).describe("Team id (from list_teams)")
+    },
+    withErrorHandling(async ({ slug, teamId }) => {
+      await client.teams.unshare(teamId, slug);
+      return jsonContent({ shared: false, slug, teamId });
     })
   );
   server.tool(
@@ -702,15 +754,17 @@ function registerTools(server, client) {
       provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template to send with signed headers"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
-      secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: z2.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(
       async ({ slug, method, headers, body, provider, template, event, secret }) => {
         let response;
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
-            throw new Error("send_webhook with provider templates requires a non-empty secret");
+          if (!templateSecret && TEMPLATE_METADATA[provider]?.secretRequired !== false) {
+            throw new Error(`send_webhook with provider "${provider}" requires a non-empty secret`);
           }
           response = await client.endpoints.sendTemplate(slug, {
             provider,
@@ -886,7 +940,7 @@ function registerTools(server, client) {
       requestId: z2.string().describe("The captured request ID"),
       provider: z2.enum(VERIFY_PROVIDERS).optional().describe("Provider whose signature scheme should be verified. Omit to use stored result."),
       secret: z2.string().optional().describe(
-        "Shared signing secret. Required for non-Discord providers when doing client-side verification."
+        "Provider credential for client-side verification (for example a shared signing secret, Adyen hex HMAC key, or PayPal webhook ID). Required for non-Discord providers."
       ),
       publicKey: z2.string().optional().describe("Discord application public key. Required for provider=discord."),
       url: httpUrlSchema.optional().describe("Original signed URL. Required for Twilio, Square, and HubSpot verification."),
@@ -958,7 +1012,9 @@ function registerTools(server, client) {
       provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
-      secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: z2.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const response = await client.sendTo(url, {
@@ -989,7 +1045,9 @@ function registerTools(server, client) {
       provider: z2.enum(TEMPLATE_PROVIDERS).optional().describe("Optional provider template for signing"),
       template: z2.string().optional().describe("Provider-specific template preset"),
       event: z2.string().optional().describe("Provider event or topic name"),
-      secret: z2.string().optional().describe("Signing secret. Required when provider is set.")
+      secret: z2.string().optional().describe(
+        "Signing secret. Required for signed provider templates; omit for secretless providers (sendgrid, discord, plaid)."
+      )
     },
     withErrorHandling(async ({ url, method, headers, body, provider, template, event, secret }) => {
       const preview = await client.buildRequest(url, {
@@ -1021,13 +1079,31 @@ function registerTools(server, client) {
   );
   server.tool(
     "get_usage",
-    "Check current request usage, remaining quota, plan, and period end.",
+    "Check current request usage, remaining quota, plan, and period end, plus the pooled quota of every subscribed team you belong to.",
     {},
     withErrorHandling(async () => {
-      const usage = await client.usage();
+      const [usageResult, teamsResult] = await Promise.allSettled([
+        client.usage(),
+        client.teams.list()
+      ]);
+      if (usageResult.status === "rejected") throw usageResult.reason;
+      const usage = usageResult.value;
+      const teams = teamsResult.status === "fulfilled" ? teamsResult.value : [];
+      const teamsError = teamsResult.status === "rejected" ? teamsResult.reason instanceof Error ? teamsResult.reason.message : String(teamsResult.reason) : void 0;
       return jsonContent({
         ...usage,
-        periodEnd: usage.periodEnd ? new Date(usage.periodEnd).toISOString() : null
+        periodEnd: usage.periodEnd ? new Date(usage.periodEnd).toISOString() : null,
+        ...teamsError ? { teamsError } : {},
+        teams: teams.filter((team) => !team.suspended).map((team) => ({
+          id: team.id,
+          name: team.name,
+          role: team.role,
+          seats: team.seats,
+          used: team.requestsUsed,
+          limit: team.requestLimit,
+          remaining: Math.max(0, team.requestLimit - team.requestsUsed),
+          periodEnd: team.periodEnd ? new Date(team.periodEnd).toISOString() : null
+        }))
       });
     })
   );
@@ -1065,9 +1141,9 @@ function registerTools(server, client) {
         }
         if (provider) {
           const templateSecret = secret?.trim();
-          if (!templateSecret) {
+          if (!templateSecret && TEMPLATE_METADATA[provider]?.secretRequired !== false) {
             throw new Error(
-              "test_webhook_flow with provider templates requires a non-empty secret"
+              `test_webhook_flow with provider "${provider}" requires a non-empty secret`
             );
           }
           flow.sendTemplate({
@@ -1081,6 +1157,11 @@ function registerTools(server, client) {
                 "test_webhook_flow cannot verify Discord signatures (Ed25519 requires a public key, not a secret)"
               );
             }
+            if (!templateSecret) {
+              throw new Error(
+                `test_webhook_flow cannot verify "${provider}" signatures \u2014 this provider's templates are unsigned`
+              );
+            }
             flow.verifySignature({
               provider,
               secret: templateSecret
@@ -1223,7 +1304,7 @@ function registerAgentRegistrationTools(server) {
 }
 
 // src/index.ts
-var VERSION = true ? "1.6.0" : "0.0.0-dev";
+var VERSION = true ? "1.8.0" : "0.0.0-dev";
 function createServer(options = {}) {
   const apiKey = options.apiKey ?? process.env.WHK_API_KEY;
   const server = new McpServer2({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webhooks-cc/mcp",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "MCP server for webhooks.cc — AI agent integration for webhook testing",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -36,15 +36,15 @@
   },
   "homepage": "https://webhooks.cc",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^4.4.3",
-    "@webhooks-cc/sdk": "1.8.0"
+    "@webhooks-cc/sdk": "1.10.0"
   },
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "^26.4.0",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.11"
   },
   "scripts": {
     "build": "tsup",