Webhook Crash Lab

CI npm downloads

Coding agents write webhook handlers that work for one test event and break in production on retries, duplicates and forged signatures. This package gives them a loop: run webhook-crash-lab → read structured failures with fix hints → fix → re-run.

It ships three things:

Tools

Every result comes back as text for the model and structuredContent (with an outputSchema) for clients. Errors such as a missing or invalid config come back as isError results, not crashes.

60-second start

Install in VS Code Install in Cursor

Claude Code

claude mcp add webhook-crash-lab -- npx -y webhook-crash-lab-mcp
# or the full plugin (MCP server + skill):
#   /plugin marketplace add Krrishkumar125/webhook-crash-lab-mcp
#   /plugin install webhook-crash-lab@webhook-crash-lab

Codex

codex mcp add webhook-crash-lab -- npx -y webhook-crash-lab-mcp
mkdir -p .agents/skills && cp -r node_modules/webhook-crash-lab-mcp/.agents/skills/webhook-crash-lab .agents/skills/

Cursor / other MCP clients

{
  "mcpServers": {
    "webhook-crash-lab": { "command": "npx", "args": ["-y", "webhook-crash-lab-mcp"] }
  }
}

Then ask: "Run the webhook crash lab demo", or "Make my Stripe webhook pass webhook-crash-lab". Paste docs/AGENTS-snippet.md into AGENTS.md / CLAUDE.md to make it a standing rule.

Safety

run_crash_lab imports your crash-lab config (.mjs/.js/.cjs, or .ts/.mts/.cts via the bundled jiti) (it is code, like any config file) and sends requests to its target. Point configs at a local server and a test database and secret only. The skill tells agents never to use production URLs or live secrets.

Related

• webhook-crash-lab: the CLI/library this wraps
• eslint-plugin-webhook-safety and eslint-plugin-bullmq: the same bugs, caught statically

Sibling packages

Other tools by the same author:

• secret-blast-radius: what a malicious npm install could steal, plus a rotation plan
• zod-india: Zod schemas for GSTIN, PAN, IFSC, UPI and Aadhaar
• create-bullmq-app: scaffold a production BullMQ + TypeScript service
• webhook-crash-lab: crash-test webhook handlers against duplicates and races
• eslint-plugin-bullmq: lint rules for BullMQ production pitfalls
• eslint-plugin-webhook-safety: lint rules for unsafe Stripe webhook handlers

License

MIT © Krrish Kumar