Webhook Signature Fixture Lab

Generates deterministic webhook HMAC-SHA256 fixtures and optionally verifies a supplied signature using a customer-owned TEST secret and payload. It is offline and never delivers HTTP requests or validates a live endpoint.

Pricing

0.03 per analysis

Requires x402 capable MCP client with wallet for payment settlement.

Input Schema

{
  "type": "object",
  "additionalProperties": false,
  "required": [
    "mode",
    "test_secret",
    "payload"
  ],
  "properties": {
    "mode": {
      "type": "string",
      "enum": [
        "github_sha256",
        "timestamped_sha256"
      ]
    },
    "test_secret": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "Customer-owned TEST secret; never returned in output."
    },
    "payload": {
      "type": "string",
      "description": "Exact UTF-8 payload text, at most 65536 bytes; never parsed or reformatted."
    },
    "timestamp": {
      "type": "string",
      "pattern": "^[1-9][0-9]{0,11}$",
      "description": "Required by timestamped_sha256: canonical positive epoch seconds."
    },
    "now": {
      "type": "string",
      "pattern": "^[1-9][0-9]{0,11}$",
      "description": "Required by timestamped_sha256: supplied comparison epoch seconds."
    },
    "tolerance_seconds": {
      "type": "integer",
      "minimum": 0,
      "maximum": 3600,
      "default": 300
    },
    "supplied_signature": {
      "type": "string",
      "maxLength": 256,
      "description": "Optional exact header value to verify; malformed values produce a negative verification result."
    }
  }
}

Example Input

{
  "mode": "github_sha256",
  "test_secret": "It's a Secret to Everybody",
  "payload": "Hello, World!"
}

Example Output

{
  "ok": true,
  "scope": "generated_fixtures_only",
  "payload_sha256": "dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f",
  "header": {
    "name": "X-Hub-Signature-256",
    "value": "sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17"
  },
  "verification": null,
  "fixtures": [
    {
      "name": "valid",
      "payload": "Hello, World!",
      "header": {
        "name": "X-Hub-Signature-256",
        "value": "sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17"
      },
      "expected_signature_valid": true,
      "expected_time_valid": null,
      "expected_accepted": true
    },
    {
      "name": "tampered_payload",
      "payload": "Hello, World!!",
      "header": {
        "name": "X-Hub-Signature-256",
        "value": "sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17"
      },
      "expected_signature_valid": false,
      "expected_time_valid": null,
      "expected_accepted": false
    },
    {
      "name": "wrong_signature",
      "payload": "Hello, World!",
      "header": {
        "name": "X-Hub-Signature-256",
        "value": "sha256=057107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17"
      },
      "expected_signature_valid": false,
      "expected_time_valid": null,
      "expected_accepted": false
    }
  ]
}

Limitations

• Generates fixtures from only the supplied TEST secret, payload, and timestamp inputs; it never sends HTTP requests or checks a live endpoint.
• github_sha256 follows GitHub’s HMAC-SHA256 header shape. timestamped_sha256 is a generic timestamp-bound test scheme and is not Stripe or any other vendor’s certified implementation.
• The timestamped scheme signs the exact UTF-8 bytes of timestamp + "." + payload and checks freshness against the supplied now value; the real wall clock is never read.
• Requests are bounded to 131072 serialized UTF-8 bytes, 8 nesting levels, 20000 JSON nodes, and 10000 items per array.
• Payloads are bounded to 65536 UTF-8 bytes; secrets are bounded to 1024 characters.
• This tool does not certify a provider integration, retrieve provider configuration, manage production credentials, or make a security determination about a verifier.
• Results at most 96 KiB; retry identical input and authorization within 24 hours to recover a purchase.

Connect via MCP

Add to your MCP client configuration:

{
  "mcpServers": {
    "webhook-signature-fixture-lab": {
      "type": "http",
      "url": "https://mcp-factory.bowling-anthony.workers.dev/webhook-signature-fixture-lab/mcp"
    }
  }
}