# webhook_verify

Verify (or create) webhook signatures for Stripe, GitHub, Slack, Shopify, Twilio, Standard Webhooks / Svix, Paddle, Square, Zoom, Mailgun, Intercom, Linear, Typeform and HubSpot v3, or any generic HMAC scheme — the step agents get wrong when wiring up webhook receivers. Pass the raw body, the received headers (or just the signature) and the signing secret: returns valid, the timestamp age against a replay tolerance, and on failure a diagnosis (body re-serialised or trimmed, wrong secret format, hex vs base64, stale timestamp). mode=sign produces the exact headers a provider would send, for testing receivers. Constant-time comparison; the secret is never echoed. Price: $0.002 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/webhook-verify

Agent View of the PolicyLayer registry record for `webhook_verify`. HTML page: https://policylayer.com/tools/com-it-scorptech-x402/webhook-verify

## Facts

- Tool: `webhook_verify`
- Server: ScorpTech x402 API (`https://scorptech.it.com/api/x402/mcp`) — https://policylayer.com/tools/com-it-scorptech-x402.md
- Homepage: https://github.com/https://scorptech.it.com/api/x402/mcp
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server CORS policy: *
- Server rate-limited: no
- Parameters: 12 (3 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | no | Standard Webhooks / Svix message id when not in headers |
| `now` | integer | no | Unix time for "now" (testing) |
| `url` | string | no | Full webhook URL (Twilio, Square, HubSpot) |
| `mode` | string | no |  |
| `header` | string | no | generic: header holding the signature |
| `method` | string | no | HTTP method (HubSpot v3) |
| `prefix` | string | no | generic: prefix before the signature, e.g. "sha256=" |
| `secret` | string | yes | Signing secret (Stripe whsec_..., Svix whsec_<base64>, ...) |
| `headers` | object | no | Received headers (any case), e.g. {"Stripe-Signature": "t=...,v1=..."} |
| `payload` | string | yes | The raw request body exactly as received (not re-serialised JSON) |
| `encoding` | string | no | generic: signature encoding |
| `provider` | string | yes |  |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "webhook_verify",
    "arguments": {
      "secret": "<secret>",
      "payload": "<payload>",
      "provider": "<provider>"
    }
  }
}
```

## Why webhook_verify is rated Low

Even though webhook_verify only reads data, uncontrolled read access leaks sensitive information and racks up API costs: an agent caught in a retry loop can make thousands of calls a minute without anyone noticing.

Risk signals: Accepts URL/endpoint input (url) · Handles credentials or secrets (secret) · Accepts raw HTML/template content (payload) · High parameter count (16 properties)

## Use case

AI agents call webhook_verify to retrieve information from ScorpTech x402 API without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches ScorpTech x402 API:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "webhook_verify": {}
  }
}
```

## Other tools on ScorpTech x402 API (1011)

- `collatz_drop` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/collatz-drop.md
- `dedupe_records` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/dedupe-records.md
- `evm_selector_decode` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/evm-selector-decode.md
- `frames_timecode` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/frames-timecode.md
- `ip_reputation` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/ip-reputation.md
- `led_resistor` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/led-resistor.md
- `ruler_odd` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/ruler-odd.md
- `sql_format` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/sql-format.md
- `timecode_diff` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/timecode-diff.md
- `timecode_duration` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/timecode-duration.md
- `timecode_frames` — Destructive — https://policylayer.com/tools/com-it-scorptech-x402/timecode-frames.md
- `abi_encode` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/abi-encode.md
- `apery_term` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/apery-term.md
- `ballot` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/ballot.md
- `baum_sweet` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/baum-sweet.md
- `binom` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/binom.md
- `bit_subset` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/bit-subset.md
- `biunitary_sigma` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/biunitary-sigma.md
- `champernowne_start` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/champernowne-start.md
- `clinical_trials` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/clinical-trials.md
- `coin_min` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/coin-min.md
- `coin_ways` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/coin-ways.md
- `color_palette` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/color-palette.md
- `compound_interest` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/compound-interest.md
- `cron_explain` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/cron-explain.md
- `curl_to_code` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/curl-to-code.md
- `date_calc` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/date-calc.md
- `delannoy` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/delannoy.md
- `delannoy_sum` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/delannoy-sum.md
- `dmarc_report_parse` — Execute — https://policylayer.com/tools/com-it-scorptech-x402/dmarc-report-parse.md
- …and 981 more: https://policylayer.com/tools/com-it-scorptech-x402.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-it-scorptech-x402 · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-it-scorptech-x402