# Webhook Payload Signature Validator MCP for AI Agents MCP > Webhook Payload Signature Validator lets you verify that incoming webhooks actually come from the source you think they do. It handles HMAC signature checks and timestamp validation to stop replay attacks and spoofing. Use it to secure your API endpoints against unauthorized data injection from third-party services like Stripe or GitHub. ## Overview - **Category:** security - **Price:** Free - **Endpoint:** https://edge.vinkius.com/undefined/mcp - **Tags:** webhook, hmac, security, api, validation, github, stripe ## Description Building a production API means dealing with webhooks, and if you aren't verifying signatures, you're basically leaving your front door wide open. This MCP lets your AI client handle the heavy lifting of security validation. Instead of you manually writing boilerplate code to check headers, hash payloads, and compare timestamps, you can just ask your agent to verify the incoming data. It recognizes common patterns like GitHub's static signatures and Stripe's timestamped headers. It's a core part of keeping your backend secure when you're using the Vinkius catalog to connect your tools. You get to focus on the logic of what happens after a successful webhook, while the MCP ensures that the data actually belongs to the sender. ## Tools ### verify_hmac_standard Compare the raw payload against a shared secret using HMAC-SHA256. It tells you if the sender is who they say they are. ### identify_signature_scheme Determine if the webhook uses a standard or timestamped signature format. This helps the agent know which check to run next. ### verify_hmac_timestamped Check the signature and the timestamp drift simultaneously. This prevents attackers from re-sending old, valid requests. ## Prompt Examples **Prompt:** ``` Check if this Stripe header 't=1625097600,v1=abc' is still valid if my max drift is 5 minutes. ``` **Response:** ``` The timestamp in the header is from 10 minutes ago. Since your maximum allowed drift is 5 minutes, this webhook is expired and should be rejected. ``` **Prompt:** ``` Verify this payload with secret 'my_secret' and signature '5d41402abc4b2a76b9719d911017c592'. ``` **Response:** ``` I've checked the HMAC signature against your secret. The signature is valid, and the payload is authentic. ``` **Prompt:** ``` What's the best way to check a webhook from a new provider? ``` **Response:** ``` First, you should identify the signature scheme they use. Once you know if it's a standard HMAC or a timestamped one, you can use the appropriate verification tool to check the payload against your shared secret. ``` ## Capabilities ### Identify signature types Determine which header format a webhook is using before you run a check. ### Verify HMAC signatures Confirm that a payload matches a shared secret using standard HMAC-SHA256. ### Prevent replay attacks Check the timestamp drift to ensure a request isn't an old message being re-sent. ### Detect tampering Ensure the body of the webhook hasn't been modified during transit. ### Support Stripe-style headers Handle specific timestamped formats used by popular payment processors. ## Use Cases ### Verifying Stripe payment success A developer asks the agent to check a Stripe webhook to see if a subscription was actually paid. ### Securing GitHub events A user wants to ensure a push event from GitHub isn't a fake request trying to trigger a build. ### Testing for replay attacks A security dev asks the agent to see if a webhook from 10 minutes ago is still accepted by the current logic. ### Rapid API prototyping A dev needs to quickly validate headers for a new integration without writing a full security middleware. ## Benefits - Stop spoofing attacks by using verify_hmac_standard to ensure every payload matches your secret key. - Block replay attacks automatically with verify_hmac_timestamped which checks for valid time windows. - Save on development time by letting your agent identify the correct signature scheme with identify_signature_scheme. - Reduce security risks by letting your AI agent handle the complex math of HMAC-SHA256 verification. - Support multiple platforms like Stripe and GitHub without writing custom logic for each unique header format. ## How It Works The bottom line is that you get a definitive yes or no on whether a webhook is authentic before your code processes it. 1. Provide the raw payload and the header from the incoming request to your agent. 2. The agent runs the verification tool based on the detected signature scheme. 3. You get a clear pass or fail result with the reason for any rejection. ## Frequently Asked Questions **How does the Webhook Payload Signature Validator protect my app?** It ensures that only the actual service you're integrating with can trigger your webhooks. It checks a unique signature for every request, making it nearly impossible for someone to spoof your data. **Can I use this for Stripe webhooks?** Yes, it specifically supports the timestamped HMAC-SHA256 format that Stripe uses. Your agent can use it to verify payments and other events safely. **Does this help prevent replay attacks?** Yes, that's one of its main jobs. By using the timestamped verification, it checks if a request is too old to be valid, which stops attackers from re-sending old messages. **What do I need to provide to verify a webhook?** You'll need the raw payload of the request and the shared secret provided by the service (like Stripe or GitHub). The MCP handles the rest of the math. **Is this the right tool for my API security?** It's the best tool for verifying webhook authenticity. If you need to check signatures and timestamps for inbound webhooks, this is exactly what you need. **Can my AI agent automatically handle multiple webhook types?** Yes, the agent can use the identification tool to figure out which validation method to use for different providers, making your security logic much more flexible. **How does the tool prevent replay attacks?** By using `verify_hmac_timestamped`, the system checks if the timestamp in the header is within the allowed drift window. **What signature formats are supported?** It supports static signatures like GitHub's and timestamped signatures like Stripe's. **Does it protect against timing attacks?** Yes, the implementation uses constant-time comparison to mitigate timing analysis risks.