authority-webhook-mcp

A compact Node.js repo for demonstrating an explicit tool-call boundary around a consequential webhook publish operation.

The public tool is publish_release_webhook. It accepts a target URL, repository, tag, and summary, normalizes them into a deterministic action packet, then calls the configured release provider.

Boundary

The consequential boundary is in src/service.js:

return this.provider.send(action);

For a real provider, that call performs the outbound fetch() POST to an allowlisted HTTPS webhook. Tests use RecordingReleaseProvider, so no live network side effect or credential is needed.

The normalized action packet binds:

• action class: release.webhook.publish
• exact target URL
• repository
• release tag
• summary
• SHA-256 fingerprint

This is the point where a single-use authority check can be inserted before allowing the provider call to proceed.

Usage

npm test
node src/server.js

Example JSON-RPC line:

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"publish_release_webhook","arguments":{"target":"https://deploy.example.com/releases","repository":"codex-bounty-e792cf/authority-webhook-mcp","tag":"v0.1.0","summary":"Initial gated webhook boundary demo."}}}

Safety

The default provider is a dry-run recorder. The live HTTP provider is present to make the boundary concrete, but it is not used by default.