Skip to main content
Glama
revclamp

RevClamp MCP Server

Official
by revclamp
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

revclamp_verify_webhook_signature

Generate and verify Stripe, Shopify, and RevClamp webhook signatures using HMAC-SHA256 with 300-second timestamp replay protection to reject forged or stale requests.

Instructions

Generates and verifies raw-UTF8 HMAC-SHA256 webhook signatures for Stripe (Stripe-Signature t=,v1=), Shopify (X-Shopify-Hmac-Sha256 base64), and RevClamp (X-RevClamp-Signature) with 300s timestamp replay protection.

Input Schema

NameRequiredDescriptionDefault
secretYes
providerYes
rawPayloadYes
timestampSecNo
toleranceSecNo
signatureHeaderNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed9 schema fields changedv1.20.1
    • removedInput schema / properties / provider / description
      Removed value: -"Webhook signature provider scheme to evaluate: 'stripe' (Stripe-Signature t=<sec>,v1=<hex>, default), 'shopify' (X-Shopify-Hmac-Sha256 Base64 raw UTF-8 HMAC), or 'revclamp' (X-RevClamp-Signature t=<sec>,v1=<hex>)."
    • removedInput schema / properties / rawPayload / description
      Removed value: -"Exact unparsed UTF-8 webhook request body string (up to 16,384 chars) used to compute the canonical SHA-256 HMAC digest. Defaults to a provider-specific sample JSON event if omitted."
    • removedInput schema / properties / secret / description
      Removed value: -"Synthetic or test webhook signing secret (default: 'whsec_test_revclamp_sandbox_secret_2026', max 256 chars). Live production secrets (sk_live_, rk_live_, non-test whsec_..., shpss_..., shpat_..., rg_live_, rc_live_, AKIA..., and PEM private keys) are rejected."
    • removedInput schema / properties / signatureHeader / description
      Removed value: -"Optional supplied HTTP signature header value to verify via crypto.timingSafeEqual (e.g. 't=1760000000,v1=...' or Base64 digest, max 512 chars). Omit to run in GENERATE_AND_SELF_VERIFY mode."
    • removedInput schema / properties / timestampSec / description
      Removed value: -"Optional Unix epoch timestamp in integer seconds (valid range: 1 to 9999999999; defaults to current server Unix timestamp) used when generating or verifying timestamped Stripe/RevClamp headers."
    • removedInput schema / properties / timestampSec / maximum
      Removed value: -9999999999
    • removedInput schema / properties / timestampSec / minimum
      Removed value: -1
    • addedInput schema / properties / toleranceSec
      Added value: +{
+  "default": 300,
+  "maximum": 3600,
+  "minimum": 1,
+  "type": "integer"
+}
    • addedInput schema / required
      Added value: +[
+  "provider",
+  "secret",
+  "rawPayload"
+]
  2. First observedv1.20.0

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose meaningful behavior: raw-UTF8 encoding, the exact HMAC algorithm, per-provider header conventions, and a 300s timestamp replay-protection window. It stops short of the behaviors that matter most for a combined generate/verify tool - which mode is selected and when, and what a failed verification produces (error vs. boolean).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, front-loaded with the verb, and every clause carries information an agent cannot get from the bare schema. No filler or restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a six-parameter tool with no annotations and no output schema, the description leaves critical gaps: the return shape of a verification (boolean, parsed result, or thrown error) is unknown, and the role of signatureHeader in choosing generation versus verification is unstated. An agent could call it correctly on inputs but not predict its outcome.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across six parameters, so the description must compensate and largely does not. It maps provider values to header formats and implies toleranceSec via the 300s window, but secret, rawPayload, timestampSec, and especially signatureHeader (which appears to be the generate-vs-verify switch) are never explained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete verb pair (generates and verifies) plus the resource (HMAC-SHA256 webhook signatures) and even enumerates the three supported providers with their header formats. What it does not do is differentiate this tool from the sibling revclamp_simulate_webhook_replay, which an agent could plausibly confuse it with.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to reach for this tool versus revclamp_simulate_webhook_replay or any other sibling, and no prerequisites are given (where the secret comes from, whether rawPayload must be the unparsed body). The provider/header breakdown hints at inbound webhook validation, but usage is left entirely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools