webhook-verify
Verify webhook signatures from 8 providers — Constant-time verification of inbound webhook signatures from Stripe, GitHub, Shopify, Slack, Twilio, Linear, Clerk (Svix) and SendGrid HMAC, each using the exact signing string that provider documents. Every scheme uses Web Crypto HMAC with a timing-safe compare and, where the provider signs a timestamp, a configurable clock-skew tolerance (default 300s) to block replay. Returns the verdict and t
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"source": "<source>",
"secret": "<secret>",
"rawBody": "<rawBody>",
"headers": "<headers>"
},
"name": "webhook-verify"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Full request URL. Required for Twilio, ignored elsewhere. | |
| nowIso | No | Override 'now' for deterministic tests; ISO-8601 instant. | |
| secret | Yes | The signing secret; for Clerk/Svix a 'whsec_<base64>' value is accepted. | |
| source | Yes | ||
| headers | Yes | Request headers as sent by the provider (string values). Names are case-insensitive. | |
| rawBody | Yes | The exact request body bytes as a string. Reparsed JSON will not match; send the raw bytes. | |
| formParams | No | Form parameters parsed from a Twilio POST (string values); order does not matter. | |
| toleranceSeconds | No | Max allowed |now - signed timestamp|. Default 300s. |