com.webhook-studio/webhooks

Est-ce que com.webhook-studio/webhooks est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.webhook-studio/webhooks » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 17 outils

• configure_verification≈ 260 tokens

  Turn on HMAC signature verification for a bucket using the provider's own signing secret (e.g. Stripe's whsec_). This is how you finish a "verified webhook" integration end to end. Set secret to the provider secret and hmac_enabled:true in the same call; the signature scheme is auto-detected from the header shape.

  Paramètres, retour & exemple (6)

  Paramètres

  • secret · string · optionnel
    The provider's signing secret (≥16 chars).
  • bucket_id · string · requis
    The endpoint id.
  • on_failure · string · optionnel · reject | accept_log
    What to do with a failed signature.
  • header_name · string · optionnel
    Signature header to read (auto-detected if omitted).
  • hmac_enabled · boolean · optionnel
    Enable verification.
  • tolerance_seconds · number · optionnel
    Max timestamp skew allowed, in seconds.

  Exemple d'appel

  {"name": "configure_verification", "arguments": {"bucket_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_bucket≈ 216 tokens

  Provision a new webhook endpoint (a "bucket") that captures incoming HTTP requests. Returns its id, public ingest url to point a provider at, inbox_url (the live human view to hand back), and signing secret. Pass external_ref — your own stable name like "acme-api:stripe" — so you can re-find this exact bucket later with list_buckets after losing context.

  Paramètres, retour & exemple (3)

  Paramètres

  • name · string · optionnel
    Human label for the bucket.
  • environment · string · optionnel · production | staging | sandbox | development
    Deployment environment.
  • external_ref · string · optionnel
    Your own stable identifier (unique per account) for idempotent re-provisioning and re-finding.

  Exemple d'appel

  {"name": "create_bucket", "arguments": {"name": "texte", "environment": "production", "external_ref": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• delete_bucket≈ 71 tokens

  Permanently delete a webhook endpoint and its captured events.

  Paramètres, retour & exemple (1)

  Paramètres

  • bucket_id · string · requis
    The endpoint id.

  Exemple d'appel

  {"name": "delete_bucket", "arguments": {"bucket_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• diff_schema≈ 172 tokens

  Compare two versions of a learned schema and get exactly which fields were added, removed or changed type, each flagged as breaking or not. This is the "why did my handler start failing" answer, produced without reading a single payload. from defaults to the version before to.

  Paramètres, retour & exemple (3)

  Paramètres

  • to · string · optionnel
    Target version number, or "current".
  • from · string · optionnel
    Baseline version number (defaults to the one before "to").
  • schema_id · string · requis
    The schema id.

  Exemple d'appel

  {"name": "diff_schema", "arguments": {"schema_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• find_correlation_keys≈ 180 tokens

  List the correlation-key candidates for a learned schema — the fields that look like identifiers (e.g. data.object.id), ranked by how consistently they appear. These are the fields to group events by when reconstructing a lifecycle (a Stripe payment_intent across created -> succeeded, a GitHub PR across its events). Derived from real traffic, so it reflects what THIS account actually receives.

  Paramètres, retour & exemple (2)

  Paramètres

  • version · string · optionnel
    Version number, or "current" (the default).
  • schema_id · string · requis
    The schema id.

  Exemple d'appel

  {"name": "find_correlation_keys", "arguments": {"schema_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• forward_bucket≈ 255 tokens

  Set up standing forwarding from a bucket to a URL. Pass forward_all:true to forward every event, or condition_tree to forward only matching events (same AND/OR condition grammar the routing engine uses). Creates the destination and routing rule in one call.

  Paramètres, retour & exemple (6)

  Paramètres

  • url · string · requis
    Destination URL to forward to.
  • name · string · optionnel
    Optional label for the destination.
  • bucket_id · string · requis
    The endpoint id.
  • rule_name · string · optionnel
    Optional name for the routing rule when using condition_tree.
  • forward_all · boolean · optionnel
    Forward every event unconditionally.
  • condition_tree · object · optionnel
    A condition tree (AND/OR of field comparisons) to forward only matching events. Mutually exclusive with forward_all.

  Exemple d'appel

  {"name": "forward_bucket", "arguments": {"url": "texte", "bucket_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• generate_types≈ 271 tokens

  Generate types, a runtime validator, or a full handler from a learned schema — the payoff of the knowledge layer. Everything is derived from the payloads this account ACTUALLY received, with genuinely-optional fields marked optional, instead of a plausible-but-wrong guess from a model's memory of the provider docs. Pass lang for a bare type (typescript / json-schema / zod), or framework (next / express) for a ready-to-paste handler that validates and hands back a fully-typed event.

  Paramètres, retour & exemple (4)

  Paramètres

  • lang · string · optionnel · typescript | json-schema | zod
    Output format for a bare type.
  • version · string · optionnel
    Version number, or "current" (the default).
  • framework · string · optionnel · next | express
    Return a ready-to-paste handler scaffold instead of a bare type. Overrides lang.
  • schema_id · string · requis
    The schema id.

  Exemple d'appel

  {"name": "generate_types", "arguments": {"schema_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_bucket≈ 71 tokens

  Fetch one webhook endpoint by id, including its url and inbox_url.

  Paramètres, retour & exemple (1)

  Paramètres

  • bucket_id · string · requis
    The endpoint id.

  Exemple d'appel

  {"name": "get_bucket", "arguments": {"bucket_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_event≈ 114 tokens

  Fetch one captured event by id with its full headers, body, signature verification result (and failure reason), and every outbound delivery attempt. This is how you find out whether your forward actually reached its target and what came back.

  Paramètres, retour & exemple (1)

  Paramètres

  • event_id · string · requis
    The event id.

  Exemple d'appel

  {"name": "get_event", "arguments": {"event_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_schema≈ 134 tokens

  Fetch one learned schema with every field, its type, whether it is optional, and how often it actually appears — the real shape of the payload, derived from what this account received rather than guessed from training data.

  Paramètres, retour & exemple (2)

  Paramètres

  • version · string · optionnel
    Version number, or "current" (the default).
  • schema_id · string · requis
    The schema id.

  Exemple d'appel

  {"name": "get_schema", "arguments": {"schema_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• latest_event≈ 187 tokens

  Get the single most recent event captured by a bucket, optionally filtered by provider and event type. Returns one event with its headers, body and delivery results — the one-shot answer to "what did Stripe last send me". 404 if nothing matches, so you never index into an empty list.

  Paramètres, retour & exemple (3)

  Paramètres

  • type · string · optionnel
    The provider's own event name, matched exactly (e.g. payment_intent.succeeded).
  • provider · string · optionnel
    Filter to a provider attributed at ingest (e.g. stripe, github).
  • bucket_id · string · requis
    The endpoint id.

  Exemple d'appel

  {"name": "latest_event", "arguments": {"bucket_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_buckets≈ 117 tokens

  List your webhook endpoints. Pass external_ref to fetch the specific bucket you created earlier under that name — this is how you re-anchor after losing the conversation, since you never need to have stored the bucket id.

  Paramètres, retour & exemple (1)

  Paramètres

  • external_ref · string · optionnel
    Return only the bucket with this exact external_ref.

  Exemple d'appel

  {"name": "list_buckets", "arguments": {"external_ref": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_deliveries≈ 208 tokens

  List outbound delivery attempts for a bucket, newest first, with the full request and response of each. Pass success:false to see only failures — the direct answer to "which of my forwards are broken and why".

  Paramètres, retour & exemple (5)

  Paramètres

  • limit · number · optionnel
    Max deliveries to return (1–100, default 20).
  • cursor · string · optionnel
    Pagination cursor from a previous response.
  • source · string · optionnel · rule | replay | manual_test
    Delivery source.
  • success · boolean · optionnel
    Filter to succeeded (true) or failed (false) deliveries.
  • bucket_id · string · requis
    The endpoint id.

  Exemple d'appel

  {"name": "list_deliveries", "arguments": {"bucket_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_events≈ 339 tokens

  List events captured by a bucket, newest first, with composable filters: since/until (ISO 8601 or YYYY-MM-DD), provider, type, method, signature_valid, and q (case-insensitive substring over body, content type, method, type and labels). Use cursor for the next page.

  Paramètres, retour & exemple (10)

  Paramètres

  • q · string · optionnel
    Case-insensitive substring search over body/content-type/method/type/labels.
  • type · string · optionnel
    The provider's own event name, matched exactly.
  • limit · number · optionnel
    Max events to return (1–100, default 20).
  • since · string · optionnel
    Only events at or after this time (ISO 8601 or YYYY-MM-DD).
  • until · string · optionnel
    Only events at or before this time.
  • cursor · string · optionnel
    Pagination cursor from a previous response.
  • method · string · optionnel
    HTTP method (GET, POST, ...).
  • provider · string · optionnel
    Filter to a provider (e.g. stripe, github).
  • bucket_id · string · requis
    The endpoint id.
  • signature_valid · boolean · optionnel
    Only events whose signature verification passed/failed.

  Exemple d'appel

  {"name": "list_events", "arguments": {"bucket_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_schemas≈ 156 tokens

  List the payload schemas Webhook Studio has learned from this account's real traffic, optionally filtered by provider and event_type. These outlive the payloads they were learned from, so this answers "what shapes do I know about" even after old events are gone. Start here to discover what you can generate types or diffs for.

  Paramètres, retour & exemple (2)

  Paramètres

  • provider · string · optionnel
    Filter to a provider.
  • event_type · string · optionnel
    The provider's own event name.

  Exemple d'appel

  {"name": "list_schemas", "arguments": {"provider": "texte", "event_type": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• replay_event≈ 320 tokens

  Re-send a captured event to any URL — the test runner for a handler you just wrote. preserve_headers defaults to true so the original signature header (e.g. Stripe-Signature) arrives intact. If you changed the body or the receiver verifies with a different secret, pass resign_with (the dev's own signing secret) so the payload is re-signed and their verification code passes unmodified. Returns the response status, latency and body.

  Paramètres, retour & exemple (7)

  Paramètres

  • url · string · requis
    Destination URL to send it to.
  • body · string · optionnel
    Replacement request body (defaults to the captured body).
  • headers · object · optionnel
    Header overrides layered on top of the preserved set.
  • event_id · string · requis
    The event id to replay.
  • resign_with · string · optionnel
    Signing secret to re-sign the payload with (≥16 chars).
  • preserve_headers · boolean · optionnel
    Replay the captured headers verbatim (default true).
  • signature_header · string · optionnel
    Header name for resign_with (default x-signature).

  Exemple d'appel

  {"name": "replay_event", "arguments": {"url": "texte", "event_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• wait_for_event≈ 210 tokens

  Block until the next matching event arrives on a bucket, or until the timeout. Use this to turn "go click Send test webhook in Stripe" into a synchronous step: call it, tell the human to trigger the event, and it returns as soon as one arrives. Filters (provider, type) mean unrelated traffic does not wake it. Returns the event, or nothing if it times out.

  Paramètres, retour & exemple (4)

  Paramètres

  • type · string · optionnel
    Only resolve on this event type.
  • timeout · number · optionnel
    Seconds to wait (1–55, default 30).
  • provider · string · optionnel
    Only resolve on an event from this provider.
  • bucket_id · string · requis
    The endpoint id.

  Exemple d'appel

  {"name": "wait_for_event", "arguments": {"bucket_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://webhook-studio.com/mcp