webhook-crash-lab-mcp

Coding agents write webhook handlers that work for one test event and break in production on retries, duplicates and forged signatures. This package gives them a loop: run webhook-crash-lab → read structured failures with fix hints → fix → re-run.

It ships three things:

Tools

Every result comes back as text for the model and structuredContent (with an outputSchema) for clients. Errors such as a missing or invalid config come back as isError results, not crashes.

Related MCP server: Vulnerable MCP Server

60-second start

Claude Code

claude mcp add webhook-crash-lab -- npx -y webhook-crash-lab-mcp@0.2.4
# or the full plugin (MCP server + skill):
#   /plugin marketplace add Krrishkumar125/webhook-crash-lab-mcp
#   /plugin install webhook-crash-lab@webhook-crash-lab

Codex

codex mcp add webhook-crash-lab -- npx -y webhook-crash-lab-mcp@0.2.4
mkdir -p .agents/skills && cp -r node_modules/webhook-crash-lab-mcp/.agents/skills/webhook-crash-lab .agents/skills/

Cursor / other MCP clients

{
  "mcpServers": {
    "webhook-crash-lab": { "command": "npx", "args": ["-y", "webhook-crash-lab-mcp@0.2.4"] }
  }
}

The examples pin the version so npx never silently runs a newer release. To update, check the latest with npm view webhook-crash-lab-mcp version, read the releases, then change @0.2.4 to the new version in your MCP config and restart the client.

Then ask: "Run the webhook crash lab demo", or "Make my Stripe webhook pass webhook-crash-lab". Paste docs/AGENTS-snippet.md into AGENTS.md / CLAUDE.md to make it a standing rule.

Safety

run_crash_lab imports your crash-lab config (.mjs/.js/.cjs, or .ts/.mts/.cts via the bundled jiti) (it is code, like any config file) and sends requests to its target. Point configs at a local server and a test database and secret only. The skill tells agents never to use production URLs or live secrets.

Related

• webhook-crash-lab: the CLI/library this wraps

• eslint-plugin-webhook-safety and eslint-plugin-bullmq: the same bugs, caught statically

Sibling packages

Other tools by the same author:

• secret-blast-radius: what a malicious npm install could steal, plus a rotation plan

• zod-india: Zod schemas for GSTIN, PAN, IFSC, UPI and Aadhaar

• create-bullmq-app: scaffold a production BullMQ + TypeScript service

• webhook-crash-lab: crash-test webhook handlers against duplicates and races

• eslint-plugin-bullmq: lint rules for BullMQ production pitfalls

• eslint-plugin-webhook-safety: lint rules for unsafe Stripe webhook handlers

License

MIT © Krrish Kumar