Featureflip

Official

by canopy-labs

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

Create, update, or delete a webhook subscription, or rotate its secret

manage_webhook

Destructive

Create, update, delete, rotate, or retire Featureflip webhook subscriptions, signing secrets, and event filters to control event delivery.

Instructions

action=create requires name + url and returns the signing secret. action=update/delete/rotate_secret/retire_secret require id. update changes only the fields you pass and keeps the rest; pass an empty list to widen that filter back to "all". projects take project keys or ids; environments take "/" keys (e.g. "web/production") or ids. eventTypes come from list_webhooks → availableEventTypes. create and rotate_secret return a secret that is NEVER shown again: relay it to the user verbatim so they can store it. rotate_secret adds a new active secret while the old one keeps signing; retire_secret (secretId from list_webhooks) removes one and is refused for the last active secret. A project-restricted service token must list at least one project, all in its scope. Requires an Admin token. A 404 on every webhook call means webhooks are not enabled for the organization.

Input Schema

Name	Required	Description
`id`	No	Subscription id; required for everything except create
`url`	No	Receiver URL; required for create
`name`	No	Required for create
`action`	Yes	What to do; every action except create needs id
`enabled`	No	update only; subscriptions are created enabled
`projects`	No	Project keys or ids to cover; empty or omitted on create = all
`secretId`	No	Required for retire_secret
`eventTypes`	No	Event types to send; empty or omitted = all
`environments`	No	"<project>/<environment>" keys or environment ids; empty or omitted on create = all
`idempotency_key`	No	Idempotency-Key header for create / rotate_secret

Output Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv0.3.0Oct 18, 2026

addedInput schema / properties / action / description

Added value: +"What to do; every action except create needs id"

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$defs": {
+    "PublicCreateWebhookSubscriptionResponse": {
+      "description": "The created subscription's id and its signing secret. The secret is shown only here.",
+      "properties": {
+        "id": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "secret": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "warning": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "type": [
+        "object",
+        "null"
+      ]
+    },
+    "PublicRotateWebhookSecretResponse": {
+      "description": "A newly added signing secret. The secret is shown only here.",
+      "properties": {
+        "secret": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "secretId": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "warning": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "type": [
+        "object",
+        "null"
+      ]
+    }
+  },
+  "anyOf": [
+    {
+      "$ref": "#/$defs/PublicCreateWebhookSubscriptionResponse"
+    },
+    {
+      "properties": {
+        "environmentIds": {
+          "items": {
+            "type": "string"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        },
+        "eventTypes": {
+          "items": {
+            "type": "string"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        },
+        "id": {
+          "type": "string"
+        },
+        "isEnabled": {
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
+        "name": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "projectIds": {
+          "items": {
+            "type": "string"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        },
+        "updated": {
+          "type": "boolean"
+        },
+        "url": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "required": [
+        "id",
+        "updated"
+      ],
+      "type": "object"
+    },
+    {
+      "properties": {
+        "deleted": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "deleted"
+      ],
+      "type": "object"
+    },
+    {
+      "$ref": "#/$defs/PublicRotateWebhookSecretResponse"
+    },
+    {
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "retiredSecretId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "id",
+        "retiredSecretId"
+      ],
+      "type": "object"
+    }
+  ],
+  "type": "object"
+}

Addedv0.1.8Sep 25, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, it discloses critical behavior: the secret is NEVER shown again and must be relayed verbatim, update changes only passed fields and empty lists widen filters back to 'all', an Admin token is required, project-restricted service tokens must list in-scope projects, and a 404 on every call means webhooks are disabled for the org. This is exactly the non-obvious context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single dense paragraph front-loaded with action requirements, and every sentence carries actionable information. It is slightly run-on and could be bulleted per action, but there is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter multi-action mutation tool with an output schema, the description covers auth requirements, secret-return handling, action-specific prerequisites, edge cases (last active secret, 404/disabled org), and cross-tool references. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents parameters. The description still adds meaning: environment keys use '<project>/<environment>' format with an example, eventTypes originate from list_webhooks → availableEventTypes, and update's partial-update/empty-list-widens-to-all semantics are not in the schema. It repeats some schema content (empty = all) but the additions are genuine.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The title and description state the exact verb+resource for each of the five actions (create/update/delete/rotate_secret/retire_secret) and their required inputs, so an agent can tell immediately what the tool does. It is clearly distinguishable from siblings like list_webhooks and deliver_webhook.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives per-action routing rules (create needs name+url; everything else needs id) and explicitly distinguishes the two secret actions: rotate_secret adds a new active secret while the old keeps signing, retire_secret removes one and is refused for the last active secret. It also points to list_webhooks for availableEventTypes and secretId, naming the alternative source.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.