Provides webhook signature validation, realistic payload generation for events like push and pull_request, and automatic provider detection for webhook debugging.
Provides webhook signature validation, realistic payload generation for events like message, and automatic provider detection for webhook debugging.
Provides webhook signature validation, realistic payload generation for events like payment_intent.succeeded, and automatic provider detection for webhook debugging.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-webhook-tools Send a test webhook to https://example.com/hook"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Webhook management and testing tools for AI agents, built on the Model Context Protocol.
Send a webhook payload to any URL with custom headers, body, and content-type. Supports automatic retry with exponential backoff and jitter. Returns detailed attempt records including status codes, timing, and errors.
Validate webhook signatures using HMAC-SHA256 or HMAC-SHA1. Includes built-in patterns for:
Stripe — t=TIMESTAMP,v1=SIGNATURE format with timestamp tolerance
GitHub — sha256=SIGNATURE or sha1=SIGNATURE format
Slack — v0=SIGNATURE with v0:timestamp:body signing scheme
Uses timing-safe comparison to prevent timing attacks.
Generate realistic webhook payloads for testing. Supported events:
Service | Events |
Stripe |
|
GitHub |
|
Slack |
|
Each payload includes randomized IDs, current timestamps, and suggested headers. Use the overrides parameter to customize specific fields.
Analyze a webhook request end-to-end:
Parse and categorize headers (content-type, signature, timestamp, delivery ID, custom)
Validate the request body (size, JSON validity, encoding)
Auto-detect the provider (Stripe, GitHub, Slack)
Verify the signature if a secret is provided
Check timestamp freshness (default 300s threshold)
Report all issues found
Calculate a retry schedule with exponential backoff. Shows each attempt's delay, cumulative elapsed time, and scheduled ISO timestamp. Configurable base delay, max delay cap, multiplier, and jitter.
Related MCP server: hookray-mcp
npm install
npm run buildAdd to your MCP client config:
{
"mcpServers": {
"webhook-tools": {
"command": "node",
"args": ["path/to/mcp-webhook-tools/dist/index.js"]
}
}
}MIT
Analyze a webhook request: parse headers, validate signature, decode body, check content-type, verify timestamp freshness, and detect the provider.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | The webhook endpoint URL (for reference) | |
| body | Yes | Raw request body | |
| method | No | HTTP method used | |
| secret | No | Signing secret for signature verification (optional) | |
| headers | Yes | Request headers as key-value pairs |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It lists non-destructive analytical actions, suggesting read-only behavior, but it does not explicitly state that the tool has no side effects, nor does it describe what happens when the optional secret is omitted or how results are returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no redundant wording. Each listed action ('parse', 'validate', 'decode', 'check', 'verify', 'detect') earns its place, making it concise and easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has five parameters, no output schema, and no annotations. The description gives a useful high-level overview but omits critical details such as the output format, error behavior, and conditional handling (e.g., signature validation only when a secret is provided). For a multi-step debugging tool, this is a moderate gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds some context by linking actions to parameters (e.g., 'validate signature' implies use of 'secret'), but it does not provide substantial value beyond the schema's own parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with a specific verb 'Analyze' and detailed scope ('parse headers, validate signature, decode body, check content-type, verify timestamp freshness, and detect the provider'). It distinguishes itself from sibling tools like webhook_validate by covering a broader analysis workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for debugging webhook requests, but it does not explicitly state when to choose this tool over alternatives like webhook_validate or webhook_send. No exclusions or comparison are provided, leaving the selection largely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Generate a realistic webhook payload for common services. Supports Stripe (payment_intent.succeeded), GitHub (push, pull_request), and Slack (message).
| Name | Required | Description | Default |
|---|---|---|---|
| event | Yes | Event type (e.g., payment_intent.succeeded, push, pull_request, message) | |
| service | Yes | Service to generate payload for | |
| overrides | No | Optional field overrides to merge into the generated payload |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It states that the tool generates a realistic payload, implying it does not send or mutate anything, but it does not explicitly disclose the output format or behavior for invalid inputs. For a benign generator, this is adequate but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, front-loaded with the main action, and contains no unnecessary detail. It efficiently communicates the tool's purpose and key supported services.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema or annotations exist, so the description should explain return values and constraints. It covers the core purpose and supported services, but lacks explicit output format details (e.g., JSON) and does not clarify whether only the listed event types are supported. The description is adequate for a simple generator but leaves some gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema descriptions cover all parameters (100% coverage), but the description adds meaningful service-event mappings (e.g., Stripe -> payment_intent.succeeded, GitHub -> push/pull_request, Slack -> message) that are not present in the schema. This helps the agent select valid service-event combinations beyond the generic schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (generate) and resource (realistic webhook payload), and lists supported services (Stripe, GitHub, Slack) and example events. This distinguishes it from sibling tools like send, validate, and debug, which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool (when you need to generate a payload for common services) and distinguishes it from siblings by name, but it does not explicitly state alternatives or when-not-to-use scenarios. The context is clear but exclusions are not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Calculate a retry schedule with exponential backoff and optional jitter. Shows the delay, cumulative time, and scheduled timestamp for each retry attempt.
| Name | Required | Description | Default |
|---|---|---|---|
| jitter | No | Add randomized jitter (default: true) | |
| multiplier | No | Backoff multiplier (default: 2) | |
| start_time | No | ISO 8601 start time (default: now) | |
| max_retries | Yes | Number of retry attempts | |
| max_delay_ms | No | Maximum delay cap in milliseconds (default: 60000) | |
| base_delay_ms | No | Initial delay in milliseconds (default: 1000) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must disclose behavior. It states the tool calculates and shows results, implying a read-only operation, but does not explicitly confirm it sends no webhooks or mention edge cases like invalid inputs or jitter behavior. Moderate transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences that front-load the action and describe the output. No filler words—every phrase adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's purpose and output shape, but with 6 parameters and no output schema or annotations, it leaves some ambiguity about return format and boundary conditions. Still, it is sufficient for a calculation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the description adds limited context by mentioning exponential backoff and jitter, which map to existing parameters. It does not explain parameter relationships or formulas beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Calculate') and resource ('retry schedule'), explicitly naming the algorithm (exponential backoff) and output components (delay, cumulative time, scheduled timestamp). This clearly distinguishes it from sibling tools like webhook_send or webhook_validate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for planning retry timing but does not explicitly state when to use it versus alternatives or what conditions warrant this tool. No exclusions or comparisons are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Send a webhook payload to a URL with custom headers, body, and content-type. Supports retry with exponential backoff.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Target URL to send the webhook to | |
| body | Yes | Request body (typically JSON string) | |
| method | No | HTTP method (default: POST) | |
| headers | No | Custom HTTP headers as key-value pairs | |
| timeout_ms | No | Request timeout in milliseconds (default: 10000) | |
| max_retries | No | Maximum retry attempts on failure (default: 0) | |
| content_type | No | Content-Type header (default: application/json) | |
| base_delay_ms | No | Base delay between retries in ms (default: 1000) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses retry with exponential backoff, which is a useful behavioral detail, but it does not mention return values, error handling, or side effects. More context (e.g., whether it blocks, returns HTTP response) would improve transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary action, and contains no redundant words. It efficiently covers the core purpose and a key feature (retry with exponential backoff).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 8 parameters and no output schema or annotations, the description is somewhat minimal. It covers the main purpose and retry behavior, but lacks details about what the tool returns or how errors are surfaced. It is adequate but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds meaningful nuance by mentioning 'exponential backoff,' which clarifies the relationship between max_retries and base_delay_ms beyond their schema descriptions. It also highlights key parameters but mostly echoes schema info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it sends a webhook payload to a URL, with explicit mention of customization options (headers, body, content-type). This specific verb+resource scope distinguishes it from siblings like webhook_generate_payload and webhook_validate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is the tool for actually sending webhooks, and the sibling tools serve clearly different purposes (generating, validating, debugging, retry scheduling). However, it does not explicitly state when to use or not use this tool versus alternatives, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Validate a webhook signature. Supports HMAC-SHA256 and HMAC-SHA1 with built-in patterns for Stripe, GitHub, and Slack.
| Name | Required | Description | Default |
|---|---|---|---|
| secret | Yes | The webhook signing secret | |
| payload | Yes | The raw webhook payload body | |
| provider | No | Webhook provider for automatic format detection | |
| algorithm | No | Hash algorithm (default: sha256) | |
| signature | Yes | The signature to validate | |
| timestamp | No | Request timestamp (required for Slack) | |
| signature_format | No | Signature encoding (default: hex) | |
| tolerance_seconds | No | Max age of timestamp in seconds (default: 300) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions supported algorithms and provider patterns but does not state what the tool returns on valid/invalid signatures, error handling, or any side effects. For a validation tool, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence: 'Validate a webhook signature.' It wastes no words and immediately states the core purpose, then adds useful supporting details about algorithms and providers.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 8 parameters, no output schema, and no annotations. The schema covers parameter semantics well, but the description lacks crucial behavioral context such as return values and error behavior. The description plus schema is adequate for a basic understanding, but the absence of return-value information leaves a clear gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds limited semantic value beyond the schema, such as noting built-in provider patterns that relate to the 'provider' parameter. It does not explain each parameter in detail, but the schema already covers that, so the score stays at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Validate a webhook signature.' It also specifies supported algorithms (HMAC-SHA256, HMAC-SHA1) and provider-specific patterns (Stripe, GitHub, Slack), which distinguishes it from sibling tools like webhook_generate_payload or webhook_send.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: it's for validating webhook signatures. It implies when to use it (when a webhook signature must be checked) but does not explicitly mention alternatives or when not to use it. The sibling tool names suggest related webhook operations, but no explicit exclusions are provided, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0webhook_debugwebhook_generate_payloadwebhook_retry_schedulewebhook_sendwebhook_validateEach tool targets a distinct webhook operation: generating payloads, sending, validating signatures, debugging requests, and computing retry schedules. No two tools overlap in purpose.
All tool names follow a consistent 'webhook_<verb>_<noun>' pattern in snake_case. Clear and predictable naming convention throughout.
Five tools is well-scoped for a webhook utility server. Each tool serves a distinct need without redundancy or bloat.
The set covers the core webhook workflow: generate, send, validate, debug, and plan retries. There are no obvious missing operations for the server's stated purpose.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Debug webhooks from your AI agent: inspect and replay captured webhooks on localhost.
Instant no-signup webhook & HTTP-request inspector for testing webhooks and agent tool-callbacks.
Receive, inspect, replay and deliver webhooks — with signature verification and agent triggers.
A webhook inbox for agents: one call returns a live URL. Mock, verify, inspect and replay.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/rog0x/mcp-webhook-tools'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
