Loading ToolBench
Webhook management and testing tools for AI agents via MCP
Server has 5 well-defined tools with complete input schemas and descriptions. All tools have clear verb-noun naming (webhook_send, webhook_validate, etc.) and descriptions ranging 80-180 chars, meeting baseline expectations. However, output schemas are not documented, LLMs cannot predict response structure for downstream chaining. Parameter descriptions are present but lack constraint details (e.g., timeout_ms has no min/max bounds, max_retries lacks guidance on reasonable limits). Error handling is minimal, no recovery guidance or actionable error messages visible in code. Security concern: webhook_send accepts arbitrary URLs and headers, risking SSRF and header injection without validation hints.
Analyze a webhook request: parse headers, validate signature, decode body, check content-type, verify timestamp freshness, and detect the provider.
Generate a realistic webhook payload for common services. Supports Stripe (payment_intent.succeeded), GitHub (push, pull_request), and Slack (message).
Calculate a retry schedule with exponential backoff and optional jitter. Shows the delay, cumulative time, and scheduled timestamp for each retry attempt.
Send a webhook payload to a URL with custom headers, body, and content-type. Supports retry with exponential backoff.
Validate a webhook signature. Supports HMAC-SHA256 and HMAC-SHA1 with built-in patterns for Stripe, GitHub, and Slack.
Output schemas not documented. LLMs cannot predict response structure, breaking tool chaining and forcing agents to guess field names for downstream calls.
Numeric parameters lack bounds. timeout_ms, max_retries, base_delay_ms, max_delay_ms, multiplier, tolerance_seconds have no min/max constraints, allowing LLMs to pass absurd values (e.g., timeout_ms=999999999).
No error handling guidance. Code catches errors but does not return actionable recovery hints (e.g., 'Invalid URL format. Expected https://...' or 'Signature validation failed. Check secret and algorithm.').
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
webhook_send accepts arbitrary URLs and custom headers without validation, risking SSRF and header injection. No mention of URL allowlisting, header sanitization, or security constraints in description.
Parameter descriptions lack format/constraint details. E.g., 'body' is 'Request body (typically JSON string)', does not specify max length, encoding, or validation rules. 'secret' in webhook_validate lacks guidance on format or length.