Verify WeChat Pay V3 callback signatures using the platform certificate to confirm notification authenticity and return a validity boolean.
微信支付V3 异步通知验签：用微信支付平台证书校验 Wechatpay-Signature。返回 {valid:boolean}。
| Name | Required | Description | Default |
|---|---|---|---|
| cred | No | 凭证（可省略，改用环境变量；PEM 字段可直接传 PEM 全文或 .pem 文件路径） | |
| nonce | Yes | 请求头 Wechatpay-Nonce | |
| rawBody | Yes | 请求体原始字符串（不可格式化） | |
| signature | Yes | 请求头 Wechatpay-Signature | |
| timestamp | Yes | 请求头 Wechatpay-Timestamp |
Changes observed during successful MCP inspections.
v1.0.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description is the only behavioral contract. It clearly says verification is done with the WeChat Pay platform certificate and that the result is {valid:boolean}. However, it doesn't describe failure behavior (e.g., invalid signature or certificate), credential sourcing, or whether any network/state effects occur; these details are left to the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single two-part sentence: it states the use case first, then the action and return value. No filler words or repeated schema content; it is well front-loaded for quick scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a verification tool with no annotations and no output schema, the description covers the key selection cue (WeChat Pay V3 callback), the verification mechanism (platform certificate), and the return type (valid boolean). It could be more complete by stating error/edge-case behavior, but the schema covers all parameters completely and the essential invocation contract is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; timestamp, nonce, signature, rawBody, and cred all have explanatory descriptions, including the instruction that rawBody must not be formatted. The description itself does not add parameter-level detail beyond naming Wechatpay-Signature, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact operation ('验签' / verify signature) on a specific resource ('微信支付V3 异步通知' / WeChat Pay V3 callback notification) and states the return shape. It clearly separates this tool from siblings like wechat_decrypt_callback, which handles decryption rather than verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It identifies the triggering context (WeChat Pay V3 asynchronous notification) and the core task (verifying the Wechatpay-Signature with the platform certificate). It does not explicitly mention when not to use it or name alternatives such as wechat_decrypt_callback or alipay_verify_notify, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.