webhook-crash-lab-mcp

Overview Schema Source Related Servers Discussions Admin

Run webhook-crash-lab

run_crash_lab

Replay hostile webhook deliveries (duplicates, concurrency, out-of-order, bad signatures, malformed JSON) against a configured handler; return structured failures with fix hints. Use test DB/secret.

Instructions

Replay hostile webhook deliveries (duplicates, concurrent duplicates, out-of-order events, forged/missing/stale signatures, malformed JSON) against the handler described by a crash-lab config file, and return structured failures with fix hints. Use a TEST database and test secret only. Create a config with npx webhook-crash-lab init if none exists.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "configPath": "<configPath>"
    },
    "name": "run_crash_lab"
  }
}

Input Schema

Name	Required	Description
`cwd`	No	Project directory; defaults to the server working directory
`scenarios`	No	Run only these scenarios
`configPath`	Yes	Path to a crash-lab config (.mjs, .js, .cjs, .ts, .mts or .cts), relative to cwd
`reportPath`	No	Also write the full JSON report here

Output Schema

Name	Required	Description	Default
`ok`	Yes
`name`	Yes
`summary`	Yes
`failures`	Yes
`nextSteps`	Yes
`notTested`	Yes
`scenarios`	Yes
`reportPath`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.2.4Nov 5, 2026

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false and openWorldHint=true; the description goes beyond them by disclosing that it actively drives the user's handler, that it must run against test infrastructure/secret, and that it returns structured failures with fix hints. It does not say whether replay state is cleaned up or what side effects (records written, logs emitted) persist after a run, which is the remaining behavioral gap for a non-read-only tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences: what it does, the safety constraint, and the setup remedy — all front-loaded with no filler. The scenario enumeration is dense but earns its length because it defines the tool's actual coverage surface.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and 100% schema coverage, the remaining burden is safety and prerequisites, both addressed. What is missing is operational context for an open-world tool: whether the handler must be running, expected runtime/timeouts, and whether failures abort the whole run or are collected per scenario.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters, and the enum values for `scenarios` are fully spelled out there. The description adds only a loose mapping between the named failure families and those enum values; it says nothing extra about `cwd`, `reportPath`, or path resolution rules, so the baseline applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a concrete verb ('Replay') and a precise resource ('hostile webhook deliveries ... against the handler described by a crash-lab config file'), then enumerates the exact failure classes exercised (duplicates, concurrent duplicates, out-of-order, forged/missing/stale signatures, malformed JSON). That enumeration also implicitly separates it from the read-only siblings (list_scenarios, explain_report, run_demo), which cannot be mistaken for an executor of scenario suites.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a hard usage constraint ('Use a TEST database and test secret only') and a prerequisite remedy ('Create a config with `npx webhook-crash-lab init` if none exists'), so an agent knows when the tool is applicable. It stops short of naming the sibling alternatives (e.g. call list_scenarios first to discover options), so routing is only partly covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server