Repository navigation
[factory] Sender conformance checks for MCP Events webhooks — pr-open - #62
Open
NickolasBenakis wants to merge 2 commits into
Open
NickolasBenakis wants to merge 2 commits into
NickolasBenakis wants to merge 2 commits into
Conversation
A fault-injecting receiver and MCP client that check a server's SEP-3415 webhook delivery: signatures, headers, retries, 410/413, redirects, endpoint verification, rotation, unsubscribe and restarts. Includes an example server with a hookgres mode and a naive mode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d is MUST Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
NickolasBenakis
changed the title
NickolasBenakis
marked this pull request as ready for review
November 13, 2026 21:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sender-side conformance and failure checks for MCP Events webhook delivery, in
conformance/mcp-events-sender/. Stacked on #61. Not part of the npm package.check.mjsruns a receiver that misbehaves on purpose (5xx,410,413, redirects, no challenge echo, downtime) plus a small JSON-RPC client. It checks any MCP server's webhook mode: 36 checks, each marked MUST, SHOULD or INFO with the SEP section it comes from. Triggering events is a command you pass, so it works with any server language. Receiver-side checks already exist in evdock; this covers the sending side.example-server.mjshas ahookgres/mcp-eventsmode and a naive in-memory mode with the usual mistakes, so the checks themselves are tested.Verification
DATABASE_URL=... ./run-example.sh: 36 passed../run-example.sh --broken: 10 MUST and 1 SHOULD failed, each for the planted defect: no input or auth checks, no verification,webhook-idderived fromeventId,410/413retried, redirects followed, no dual signing, wrong unsubscribe error.pnpm lintpasses.Decision Log
check.mjs tls) that the server trusts throughNODE_EXTRA_CA_CERTSor the equivalent.--insecure-httpexists for servers in a test mode, and skips the https check.--expect-handshake.eventIdappearing inside a randomwebhook-idisn't counted as "derived".Follow-ups
gap/terminated.🤖 Generated with Claude Code