Skip to main content
Glama
tribeunal

Tribeunal Decision-Making Platform

Official

Create webhook

tribeunal_create_webhook

Register an https URL to receive signed POST events for cases you own. Get a one-time signing secret for HMAC verification, with retries and deduplication support.

Instructions

Register a URL that Tribeunal will POST your cases' events to. Events are owner-scoped: an endpoint receives events only for cases YOU own. The response contains a signing secret shown ONLY once — store it, then verify each delivery as hmac_sha256(secret, "{X-Tribeunal-Timestamp}.{raw body}") against the hex in X-Tribeunal-Signature (format "v1="). Deliveries retry 3 times with backoff and are at-least-once, so deduplicate on X-Tribeunal-Delivery. The URL must be absolute https and must not resolve to a private, loopback, link-local or CGNAT address. An 11th endpoint answers 409 endpoint_limit (cap: 10 per account). Change events or pause delivery with tribeunal_update_webhook; the URL and secret cannot be changed — delete with tribeunal_delete_webhook and re-create instead. Returns {uuid, url, events, active, secret} — secret appears here and nowhere else.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYesAbsolute https URL to receive the signed POST deliveries; rejected (400 invalid_url / url_not_allowed) if it isn't https, carries embedded credentials, or resolves to a private, loopback, link-local, or CGNAT address.
eventsYesOne or more of case.opened, case.closed, vote.cast, vote.revoked, comment.created, evidence.marked, evidence.unmarked, jury.joined, ping; an unknown name answers 400 invalid_events. 'ping' fires only when the endpoint is pinged from the web dashboard or API — no MCP tool sends it.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changedv2.0.0
    • changedInput schema / properties / events / description
      Previous value: -"Events to subscribe to. One or more of: case.opened, case.closed, vote.cast, vote.revoked, comment.created, evidence.marked, evidence.unmarked, jury.joined, ping"New value: +"One or more of case.opened, case.closed, vote.cast, vote.revoked, comment.created, evidence.marked, evidence.unmarked, jury.joined, ping; an unknown name answers 400 invalid_events. 'ping' fires only when the endpoint is pinged from the web dashboard or API — no MCP tool sends it."
    • changedInput schema / properties / url / description
      Previous value: -"HTTPS URL that will receive the signed POST requests"New value: +"Absolute https URL to receive the signed POST deliveries; rejected (400 invalid_url / url_not_allowed) if it isn't https, carries embedded credentials, or resolves to a private, loopback, link-local, or CGNAT address."
  2. First observedv1.13.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes far beyond the annotations (which only say readOnlyHint=false, destructiveHint=false). It discloses critical behavioral details: the secret appears only once, endpoints are owner-scoped, deliveries retry 3 times with backoff, are at-least-once (requiring deduplication), rate limiting (10 per account), and the signing scheme. These are essential for an agent to use the tool correctly and are not visible in the schema or annotations. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense and front-loaded with the core action (register URL). It covers many critical details in a compact paragraph. However, it is a bit long and covers a lot of ground; while every sentence earns its place, the sheer volume might be slightly overwhelming for an agent scanning quickly. Still, it is well-structured with progressive disclosure of important constraints.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (signing, retries, security, rate limits) and the lack of an output schema, the description covers all essential information an agent needs: the return value includes secret only once, the signing verification method, retry and deduplication requirements, and the endpoint cap. The response format isn't specified in a schema, but the description explicitly lists the returned fields, which compensates. No gaps are apparent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. However, the description adds significant value beyond the schema: it explains the 'ping' event is only triggered from the web dashboard or API (not by any MCP tool), which is critical for agents to avoid confusion. It also reinforces the URL validation rules and the retry/at-least-once semantics, which are not in the parameter descriptions. Minor deduction because the schema already covers the basic formats and validation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: register a URL to receive event POSTs. It distinguishes itself from sibling tools like tribeunal_update_webhook and tribeunal_delete_webhook by explicitly mentioning that those handle updates/deletion. The verb 'register' plus the resource 'URL' is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool versus alternatives: it names tribeunal_update_webhook for changing events or pausing delivery, and tribeunal_delete_webhook for deletion. It also explains the constraints (https, no private IPs) and the flow (re-create after delete) clearly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.