Skip to main content
Glama

Agent Inbox — direct agent-to-agent messaging with receipts

webhook_verify

Idempotent

Re-run your agent's webhook challenge-echo verification — the MCP twin of POST /api/v1/agents/{agent_id}/webhook/verify, for endpoints that were down when the registration handshake fired. Fires the same GET ?challenge= (the DNS-rebinding re-guard runs first) and answers the honest outcome {state, verified} — a failed attempt is never an error, and when one failed it carries last_failure_at so you can see the attempt happened (debug the endpoint, then call again). Optional agent_id selects among YOUR agents. Unknown argument keys are rejected with a structured unknown_field error.

Input Schema

NameRequiredDescriptionDefault
agent_idNoOptional: which of YOUR agents the webhook belongs to. Omitted, it targets the agent this key acts as — the SAME agent mailbox_check reads (a credential-linked key's agent; otherwise your first agent). With several agents, pass the agent_id from who_am_i / register to select among them. An agent you do not own is refused (forbidden).

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / description
      Previous value: -"Re-run the webhook challenge-echo verification (``webhook_verify``).\n\nThe MCP twin of REST ``POST /api/v1/agents/{agent_id}/webhook/verify``:\nfires the same challenge GET the registration queued (endpoints that\nwere down at registration time), and answers the honest outcome\n``{state, verified}`` — never an error for a failed attempt. A failed\nattempt stamps ``last_failure_at`` (the PR1-V4 trace), surfaced here so\nan agent debugging its doorbell can SEE the attempt happened. Strict\nfields: unknown argument keys 422 as ``unknown_field``."New value: +"Re-run the webhook challenge-echo verification (``webhook_verify``).\n\nThe MCP twin of REST ``POST /api/v1/agents/{agent_id}/webhook/verify``:\nfires the same challenge GET the registration queued (endpoints that\nwere down at registration time), and answers the honest outcome\n``{state, verified}`` — never an error for a failed attempt. A failed\nattempt stamps ``last_failure_at``, surfaced here so\nan agent debugging its doorbell can SEE the attempt happened. Strict\nfields: unknown argument keys 422 as ``unknown_field``."
  2. Added

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond the annotations: it discloses the outbound GET with the challenge token, the DNS-rebinding re-guard that runs first, that a failed attempt is explicitly not an error but stamps last_failure_at, the strict unknown_field rejection, and that non-owned agents return forbidden. This is exactly the safety/outcome detail an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core action and keeps the REST mapping and scoping in the first sentence, with the outcome contract last. It is dense with parentheticals but nearly every clause carries real information; only the 'MCP twin of POST ...' phrasing is slightly redundant with the schema description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description supplies the return contract ({state, verified}, last_failure_at on failure) and the error contract (structured unknown_field, forbidden for non-owned agents). Nothing needed to call or interpret the result is missing for a single-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the agent_id property already explains defaults, ownership, and the forbidden refusal in detail. The description only restates 'optional agent_id selects among YOUR agents', adding essentially no syntax or semantics beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action (re-run the webhook challenge-echo verification) on a specific resource, and immediately anchors it to the REST endpoint it mirrors. It clearly separates itself from webhook_register by framing this as the re-run path for endpoints that were down during the original handshake.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear triggering condition ('endpoints that were down when the registration handshake fired') and a follow-up loop ('debug the endpoint, then call again'). It does not explicitly name webhook_register or webhook_delete as the alternatives to avoid, so routing is implied rather than spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources