Log inSubmit server
Hookwarden — Webhook Integrity logo

Hookwarden — Webhook Integrity

Audits local webhook handlers for missing or unsafe signature verification across multiple languages and providers.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Hookwarden — Webhook Integrity

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "hookwarden-webhook-integrity": {
      "command": "npx",
      "args": [
        "-y",
        "hookwarden"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y hookwarden

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 28d ago.

Overview

Hookwarden — Webhook Integrity MCP server audits webhook signature verification in local application code. It analyzes JavaScript, TypeScript, Python, PHP, and Go handlers, then reports verified, not-verified, or manual-review findings with file and line details. Provider-specific rules cover services including Stripe, GitHub, Shopify, Twilio, Slack, and Standard Webhooks. Reach for it when webhook handlers need a focused security check without sending source code or traffic to a remote service.

Use cases

  • Scan webhook handlers before deployment
  • Gate CI on high-severity verification findings
  • Inventory provider integrations in a repository
  • Generate SARIF results for security workflows

Key features

  • Provider-specific webhook signature rules
  • Three-state verification verdicts
  • JavaScript, TypeScript, Python, PHP, and Go scanning
  • JSON and SARIF 2.1.0 output
  • Baseline support for existing findings
  • Local, zero-network analysis

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

23/23 checks healthy over the last 92d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 3d ago via OSV.dev · hookwarden (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads452Package downloads in the last 30 days.
Last commit7d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How Hookwarden — Webhook Integrity works

What Hookwarden — Webhook Integrity does

Hookwarden — Webhook Integrity MCP server focuses on a narrow security problem: whether application code verifies webhook signatures correctly before processing provider events. It examines local repositories rather than inspecting live webhook traffic, and it is designed to identify issues that general-purpose static analysis may not recognize as webhook-specific problems.

The analyzer can classify handlers as verified, not-verified, or manual-review. Findings include the relevant file and line, along with remediation guidance tied to provider behavior. The manual-review state is used when the source does not provide enough evidence to prove that a handler is safe or unsafe, such as logic hidden in middleware the analyzer cannot follow.

How it works

The scanner parses supported source code across JavaScript, TypeScript, Python, PHP, and Go. Its rules account for provider-specific signing schemes and requirements, including Stripe timestamp tolerance, Slack’s signed request format, and Twilio’s SHA-1-based verification. The documented catalog covers 21 providers and also includes Standard Webhooks-conformant providers.

Checks include missing signature validation, unsafe raw-body handling, verification performed after side effects, hardcoded secret prefixes, and other webhook integrity conditions. Results can be emitted as human-readable output, JSON, or SARIF 2.1.0. Exit codes distinguish clean scans, threshold failures, engine errors, configuration errors, and insufficient parser coverage.

Setup and configuration

Run the CLI against a repository with npx hookwarden scan ./your-app; no package installation is required for that form. Alternatives include a global npm installation, Homebrew on Linux or macOS, Scoop on Windows, PyPI, or a standalone binary. Node 22 or newer is required for the npm, npx, and macOS Homebrew paths. The standalone binaries bundle their runtime.

For CI, combine a severity threshold with machine-readable output, such as --fail-on high --format json. A baseline can record existing findings so later runs gate newly introduced issues. Pinning a CLI version, for example with npx hookwarden@0.7.5, keeps the engine and rule pack fixed across runs.

Tools and capabilities

Hookwarden — Webhook Integrity provides the documented scan and fix workflow for webhook security review. Scanning can:

  • Inventory webhook handlers across supported codebases.
  • Detect absent or incorrectly ordered signature checks.
  • Recognize supported provider verification patterns.
  • Report verified, not-verified, and manual-review outcomes.
  • Produce JSON and SARIF output for automation.
  • Return non-zero statuses for configured CI thresholds.

The documented fix workflow can rewrite an insecure equality comparison to a constant-time comparison. Changes should still be reviewed, especially when the analyzer reports manual review or parser coverage diagnostics.

Limitations and notes

Analysis is limited by what the parser can understand and what is visible in source. Files with broken syntax or unsupported language features may be excluded and reported as coverage diagnostics rather than handler findings. A manual-review result is not proof of a vulnerability; it indicates that the analyzer could not establish a definitive result.

It checks the code that receives provider events, not the providers’ own SDKs or services. Direct binary downloads are intentionally unsigned, while the documented package and package-manager installation paths provide SHA-256 verification.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Hookwarden — Webhook Integrity

Hookwarden — Webhook Integrity is an MCP server that connects to local application source repositories for webhook security auditing. Its main tools support scanning and fixing webhook handlers, with provider-aware checks for signature verification, raw-body handling, constant-time comparisons, and verification order across supported languages.

Run `npx hookwarden scan ./your-app` to use the documented CLI without installation. You can also install it globally with npm, through Homebrew or Scoop, from PyPI, or by downloading a standalone binary. Node 22 or newer is required for the npm, npx, and macOS Homebrew paths.

Hookwarden scans JavaScript, TypeScript, Python, PHP, and Go code. Its parser analyzes webhook handlers in those languages, but unsupported syntax or language features can reduce coverage and produce diagnostics rather than definitive handler findings.

Yes. Use the `--fail-on` option with a severity such as `high` to return a failing status when findings meet the threshold. JSON or SARIF output can be selected for automation, and a baseline can be used to gate newly introduced findings instead of existing ones.

Related MCP servers

All in Communication All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewHookwarden — Webhook Integrity AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/hookwarden-webhook-integrity?style=directory)](https://allmcps.com/mcp/hookwarden-webhook-integrity)
HTML Embed
<a href="https://allmcps.com/mcp/hookwarden-webhook-integrity"><img src="https://allmcps.com/api/badge/hookwarden-webhook-integrity?style=directory" alt="Hookwarden — Webhook Integrity on AllMCPs" /></a>