Skip to main content
Glama
boundarycraftlab

authority-webhook-mcp

by boundarycraftlab
OverviewSchemaRelated ServersScoreDiscussions
TypeScript
Remote

Authority Webhook MCP

A small, public-ready Node.js MCP server with one consequential boundary: publishing a normalized release notice to a configured webhook.

The server deliberately separates four concerns:

  1. MCP input validation.

  2. Exact action and target normalization.

  3. The host-owned ReleaseProvider boundary.

  4. Provider result evidence.

With no configuration it uses a deterministic dry-run provider. Set RELEASE_WEBHOOK_URL to use the HTTP provider; HTTPS is required except for localhost test endpoints. No production credential is needed to run or test the project.

Why this repository exists

Agent tools often place review or approval logic too early, before the final target and payload are known. Here the exact seam is explicit in ReleasePublisher.publish():

MCP request
  -> validate
  -> normalize action class + webhook target + exact input
  -> ReleaseProvider.send(action)   <-- consequential provider call
  -> correlate provider result

That seam makes the project suitable for evaluating a single-use authority gate without using a live external service.

Related MCP server: release-announcer-mcp

Requirements

  • Node.js 20 or newer

  • npm

Run the checks

npm install
npm run ci

Run as an MCP server

Dry-run mode:

npm run build
npm start

Local webhook sandbox:

RELEASE_WEBHOOK_URL=http://127.0.0.1:8787/releases npm start

The exposed tool is publish_release_notice:

{
  "repository": "example/agent-tools",
  "tag": "v1.2.0",
  "summary": "Add a sandboxed release-notification tool."
}

Run a deterministic evidence demo

The demo exercises the real normalization and provider boundary with the in-memory dry-run provider. It performs no network request and prints the exact action, its SHA-256 fingerprint, and the correlated provider result:

npm run demo

The dry-run provider request ID is derived from the action fingerprint, making the output reproducible and easy to compare without exposing credentials.

Current safety properties

  • Repository identifiers are normalized to owner/name.

  • Release tags and summaries have bounded formats.

  • Webhook URLs reject embedded credentials and non-HTTPS remote targets.

  • The action fingerprint covers the action class, exact target, and exact normalized input.

  • Invalid input fails before the provider runs.

  • Tests use an injected recording provider and make no external calls.

This baseline does not yet implement human approval, single-use consumption, tamper rejection, or replay protection. Those controls belong immediately before ReleaseProvider.send() and should be added only as a deliberate authority-gate integration, with tests that prove the provider remains untouched on every rejected path.

License

MIT

Available Tools

1 tool
publish_release_noticePublish release noticeA

Normalize and publish a release announcement to the configured webhook. Without RELEASE_WEBHOOK_URL, the provider is a local dry run.

ParametersJSON Schema
NameRequiredDescriptionDefault
tagYesRelease tag, for example v1.2.0
summaryYesShort human-readable release summary
repositoryYesRepository in owner/name format

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, etc.), the description discloses the crucial behavioral trait of the dry-run fallback when RELEASE_WEBHOOK_URL is missing. It also mentions 'Normalize,' implying input transformation. However, it does not mention error behavior or side effects of the webhook call itself.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loaded with the primary purpose, and includes an important conditional in the second sentence without any redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple parameter set and no output schema, the description covers the essential operational context (normalization, publishing, dry-run behavior) sufficiently. It doesn't discuss return values or failure modes, but these are less critical for a straightforward publish action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides full descriptions (100% coverage) for all three required parameters: repository, tag, and summary. The description adds no additional parameter-level detail or constraints, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Normalize and publish a release announcement') and the target (configured webhook). It also distinguishes behavior based on configuration (dry run without RELEASE_WEBHOOK_URL), making it specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when the tool publishes and when it performs a local dry run, but it does not explicitly compare against alternatives or state exclusion criteria. Since no sibling tools exist, this is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 1 tool updatev0.1.0
    • First observedpublish_release_notice
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.2/5.0
Disambiguation5/5

With only one tool, there is no possibility of confusion between tools. The single tool's purpose is clearly described, so agents can unambiguously select it.

Naming Consistency5/5

The sole tool follows a clear verb_noun pattern (publish_release_notice), making it predictable and consistent within the set.

Tool Count3/5

A single tool is minimal, which feels thin for a server named 'authority-webhook-mcp'. However, the tool is narrowly scoped to release notices, so the count is borderline rather than egregiously insufficient.

Completeness4/5

The tool covers the core action of normalizing and publishing a release notice, with a dry-run fallback. Missing are operations like configuration validation or history, but the primary workflow is complete.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/boundarycraftlab/authority-webhook-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server