Skip to main content
Glama

NFC Tap Builder by Tap.Giving

register_webhook

Register (or replace) the organization's one webhook subscription for proof_ready and shipped events. The subscription secret is shown once, here. Registration is live in v1; delivery is pending and lands in v1.1, so until then get_order_status is the state read. Nothing about registration implies live push. Key required.

Input Schema

NameRequiredDescriptionDefault
eventsYes
callbackUrlYesThe https URL deliveries will POST to. It must be publicly reachable (no localhost or private addresses) and answer with a 2xx status; verify deliveries with the subscription secret shown once in the result (deliveries are signed with it). Failed deliveries are retried with backoff.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond annotations by disclosing that the secret is returned once and only here, that registration is a replace of the single existing subscription, and that registration does not imply live delivery in v1. This also explains why idempotentHint=false is correct (a fresh secret per call), so there is no annotation conflict.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and constraint, and the v1/v1.1 caveat appears before alternative routing. Slight redundancy between "delivery is pending" and "Nothing about registration implies live push" is deliberate disambiguation, but it is still restated twice.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a mutation tool, no output schema, and auth context provided ("Key required"), the definition covers the critical unknowns: secret-once return, replace semantics, and non-live delivery. It stops short of describing the response payload shape or what happens to the previous secret on replace, which would fully close the loop.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

At 50% schema coverage, callbackUrl already carries a detailed schema description (https, public, 2xx, signed deliveries, retries) and events carries its enum inline. The description names the event types but adds no format or validation detail beyond the schema, so baseline-level credit is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource: "Register (or replace) the organization's one webhook subscription for proof_ready and shipped events." It also states the cardinality constraint (one subscription per org), which no sibling shares, so an agent can distinguish it from create_order/start_order_intent style tools immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent away from expecting push behavior and names the alternative read path: "delivery is pending and lands in v1.1, so until then get_order_status is the state read." That is an explicit use-this-instead instruction tied to a named sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources