# Hookwarden — Webhook Integrity [Health: Active]

**Category:** 💬 Communication  
**Repository:** https://github.com/Hookwarden/hookwarden  
**GitHub Stars:** 1  
**npm Downloads (last month):** 452  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/hookwarden-webhook-integrity

## Description
Webhook signature-verification audit. Stripe, GitHub, Shopify, Twilio +17. Local. Deterministic.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "hookwarden-webhook-integrity": {
    "command": "npx",
    "args": ["-y","hookwarden"]
  }
}
```

## Documentation

## What Hookwarden — Webhook Integrity does

Hookwarden — Webhook Integrity MCP server focuses on a narrow security problem: whether application code verifies webhook signatures correctly before processing provider events. It examines local repositories rather than inspecting live webhook traffic, and it is designed to identify issues that general-purpose static analysis may not recognize as webhook-specific problems.

The analyzer can classify handlers as verified, not-verified, or manual-review. Findings include the relevant file and line, along with remediation guidance tied to provider behavior. The manual-review state is used when the source does not provide enough evidence to prove that a handler is safe or unsafe, such as logic hidden in middleware the analyzer cannot follow.

## How it works

The scanner parses supported source code across JavaScript, TypeScript, Python, PHP, and Go. Its rules account for provider-specific signing schemes and requirements, including Stripe timestamp tolerance, Slack’s signed request format, and Twilio’s SHA-1-based verification. The documented catalog covers 21 providers and also includes Standard Webhooks-conformant providers.

Checks include missing signature validation, unsafe raw-body handling, verification performed after side effects, hardcoded secret prefixes, and other webhook integrity conditions. Results can be emitted as human-readable output, JSON, or SARIF 2.1.0. Exit codes distinguish clean scans, threshold failures, engine errors, configuration errors, and insufficient parser coverage.

## Setup and configuration

Run the CLI against a repository with `npx hookwarden scan ./your-app`; no package installation is required for that form. Alternatives include a global npm installation, Homebrew on Linux or macOS, Scoop on Windows, PyPI, or a standalone binary. Node 22 or newer is required for the npm, npx, and macOS Homebrew paths. The standalone binaries bundle their runtime.

For CI, combine a severity threshold with machine-readable output, such as `--fail-on high --format json`. A baseline can record existing findings so later runs gate newly introduced issues. Pinning a CLI version, for example with `npx hookwarden@0.7.5`, keeps the engine and rule pack fixed across runs.

## Tools and capabilities

Hookwarden — Webhook Integrity provides the documented scan and fix workflow for webhook security review. Scanning can:

- Inventory webhook handlers across supported codebases.
- Detect absent or incorrectly ordered signature checks.
- Recognize supported provider verification patterns.
- Report verified, not-verified, and manual-review outcomes.
- Produce JSON and SARIF output for automation.
- Return non-zero statuses for configured CI thresholds.

The documented fix workflow can rewrite an insecure equality comparison to a constant-time comparison. Changes should still be reviewed, especially when the analyzer reports manual review or parser coverage diagnostics.

## Limitations and notes

Analysis is limited by what the parser can understand and what is visible in source. Files with broken syntax or unsupported language features may be excluded and reported as coverage diagnostics rather than handler findings. A manual-review result is not proof of a vulnerability; it indicates that the analyzer could not establish a definitive result.

It checks the code that receives provider events, not the providers’ own SDKs or services. Direct binary downloads are intentionally unsigned, while the documented package and package-manager installation paths provide SHA-256 verification.

_Full upstream README: https://allmcps.com/mcp/hookwarden-webhook-integrity/readme_