webhooklab.platphormnews.com

Observed 2026-08-23T07:06:07.528Z from graph node webhooklab. Evidence bodies are hashed and previews are bounded/redacted.

api: 75
mcp: 100
feeds: 93
health: 100
overall: 90
discovery: 100
consistency: 71

Declared vs observed

Capability	Declared	Observed	Valid	Complete	Status	Latency	URL
health	Yes	Yes	Yes	Yes	valid	120 ms	https://webhooklab.platphormnews.com/api/health
openapi	Yes	Yes	Yes	No	valid	80 ms	https://webhooklab.platphormnews.com/api/docs
mcp	Yes	Yes	Yes	Yes	valid	79 ms	https://webhooklab.platphormnews.com/api/mcp
mcpManifest	Yes	Yes	Yes	No	valid	51 ms	https://webhooklab.platphormnews.com/.well-known/mcp.json
llms	Yes	Yes	Yes	Yes	valid	56 ms	https://webhooklab.platphormnews.com/llms.txt
llmsIndex	Yes	Yes	Yes	Yes	valid	63 ms	https://webhooklab.platphormnews.com/llms-index.json
rss	Yes	Yes	Yes	Yes	valid	35 ms	https://webhooklab.platphormnews.com/rss.xml
atom	Yes	Yes	Yes	Yes	valid	49 ms	https://webhooklab.platphormnews.com/atom.xml
openai	Yes	Yes	Yes	Yes	valid	55 ms	https://webhooklab.platphormnews.com/.well-known/ai-plugin.json
sitemap	Yes	Yes	Yes	Yes	valid	33 ms	https://webhooklab.platphormnews.com/sitemap.xml
robots	No	Yes	Yes	Yes	valid	36 ms	https://webhooklab.platphormnews.com/robots.txt
trust	No	Yes	Yes	Yes	valid	51 ms	https://webhooklab.platphormnews.com/.well-known/trust.json
agents	No	Yes	Yes	Yes	valid	66 ms	https://webhooklab.platphormnews.com/.well-known/agents.json
manifest	No	Yes	Yes	Yes	valid	36 ms	https://webhooklab.platphormnews.com/manifest.webmanifest

Findings and evidence

mediumOPENAPI_MISSING_OPERATION_ID

114 operations lack operationId

Add stable operationId values for client and MCP correlation.

GET https://webhooklab.platphormnews.com/api/docs
HTTP 200
Content-Type: application/json
80 ms
Digest: sha256:3d4b615c88b04a0bcc93764dd7847d0d30a108f81c6b11a97f2d032073a259cb
Preview: {"openapi":"3.1.0","info":{"title":"WebhookLab API","version":"0.5.0","description":"Webhook simulation, signature generation and verification, delivery tracking, replay, contract testing, MCP integration, and PlatPhorm discovery for webhooklab.platphormnews.com."},"servers":[{"url":"https://webhooklab.platphormnews.com"}],"tags":[{"name":"Discovery","description":"Public-safe service metadata and route discovery."},{"name":"Webhooks","description":"Webhook event, endpoint, receive, and delivery APIs."},{"name":"Signatures","description":"Public-safe HMAC signature utilities. Secrets are never persisted."},{"name":"Contracts","description":"Webhook contract creation and payload validation."},{"name":"Delivery Jobs","description":"Async webhook delivery job APIs."},{"name":"Integrations","description":"Spec, Evals, Sandbox, AgentUI, Monitor, Trace, MCP, API, CLI, Docs, Sheets, and Decks handoffs."},{"name":"Agent Policy","description":"Public-safe agent policy, robots, AI, trust, and platform access metadata."},{"name":"Reports","description":"Protected report export APIs."},{"name":"Agent","description":"Agent-operable action surface with protected mutation gating."},{"name":"MCP","description":"JSON-RPC MCP endpoint."}],"components":{"securitySchemes":{"platphormApiKeyHeader":{"type":"apiKey","in":"header","name":"X-PlatPhorm-API-Key"},"platphormApiKeyBearer":{"type":"http","scheme":"bearer","bearerFormat":"PLATPHORM_API_KEY"}},"schemas":{"ApiSuccess":{"type":"object","required":["ok","data"],"properties":{"ok":{"const":true},"data":{}}},"ApiError":{"type":"object","required":["ok","error"],"properties":{"ok":{"const":false},"error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"string"},"message":{"type":"string"},"details":{}}}}},"Health":{"type":"object","properties":{"status":{"enum":["healthy","degraded"]},"service":{"const":"webhooklab"},"version":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"checks":{"type":"object"},"routes":{"type":"object"}}},"Capab

mediumRSS_DUPLICATE_GUID

GET https://webhooklab.platphormnews.com/rss.xml
HTTP 200
Content-Type: application/rss+xml; charset=utf-8
35 ms
Digest: sha256:a5592645e5a925f9a470c6cf2f236f135039864afa86689cf8f761f0e79859ca
Preview: <?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
  <channel>
    <title>WebhookLab Updates</title>
    <link>https://webhooklab.platphormnews.com</link>
    <description>WebhookLab event simulation, signature, and delivery monitoring updates.</description>
    <lastBuildDate>2026-08-23T06:53:58.089Z</lastBuildDate>
    <language>en-us</language>
    <atom:link href="https://webhooklab.platphormnews.com/rss.xml" rel="self" type="application/rss+xml" />

    <item>
      <title>WebhookLab 0.5 platform contract hardening</title>
      <link>https://webhooklab.platphormnews.com/changelog</link>
      <guid isPermaLink="false">urn:uuid:webhooklab-0-5-platform-contract</guid>
      <pubDate>2026-07-20T00:00:00.000Z</pubDate>
      <description>Canonical discovery, trusted CORS, trace propagation, bounded network sitemaps, and explicit external receiver allowlisting are now aligned with the PlatPhorm contract.</description>
    </item>
    <item>
      <title>WebhookLab Phase 3 lifecycle surface</title>
      <link>https://webhooklab.platphormnews.com/changelog</link>
      <guid isPermaLink="false">urn:uuid:webhooklab-phase-3-lifecycle</guid>
      <pubDate>2026-05-20T00:00:00.000Z</pubDate>
      <description>WebhookLab now centers event contracts, signature verification, delivery attempts, replay safety, async jobs, and PlatPhorm toolchain evidence.</description>
    </item>
    <item>
      <title>Public and protected access policy aligned to PLATPHORM_API_KEY</title>
      <link>https://webhooklab.platphormnews.com/changelog</link>
      <guid isPermaLink="false">urn:uuid:webhooklab-platform-auth-policy</guid>
      <pubDate>2026-05-20T00:00:00.000Z</pubDate>
      <description>Public-safe reads and local simulation remain available; persistent sends, replays, cancels, reports, and registry mutations require PLATPHORM_API_KEY.</description>
    </item>
    <item>
      <title>Agent, llms, sitemap, RSS, and MCP discovery refreshed</title>
      <link>https://webhooklab.platphormnews.com/changelog</link>

infoUNDECLARED_CAPABILITY_OBSERVED

Undeclared trust capability was observed

https://webhooklab.platphormnews.com/.well-known/trust.json

GET https://webhooklab.platphormnews.com/.well-known/trust.json
HTTP 200
Content-Type: application/json
51 ms
Digest: sha256:12265f54af2bb91fd2815d3ae112a5f6937615a86ed9fe93e4692babc425e3dd
Preview: {"service":"webhooklab.platphormnews.com","auth":{"protectedHeader":"X-PlatPhorm-API-Key","protectedBearer":"Authorization: [REDACTED] $PLATPHORM_API_KEY"},"publicReadOnly":true,"publicSafeAccess":["homepage, docs, FAQ, OpenAPI, llms, RSS, sitemap, robots, and well-known policy files","Lab shell, local-only payload generation, public templates, JSON/schema validation, and transient signature utilities","redacted event, endpoint, delivery, contract, integration, health, and route-compliance summaries when storage is available","read-only MCP introspection and public-safe MCP tools"],"publicSafeRoutes":["/","/lab","/dashboard","/docs","/status","/capabilities","/faq","/api/health","/api/capabilities","/api/docs","/api/mcp","/llms.txt","/sitemap.xml","/robots.txt"],"protectedActions":["persistent endpoint registration, update, and deletion","persistent event creation that sends to registered endpoints","third-party delivery attempts, replay, cancel, retry, and async delivery job mutation","contract create, update, delete, persistent test runs, and protected handoffs to Spec, Evals, Sandbox, AgentUI, Monitor, Docs, Sheets, and Decks","raw delivery details, raw request headers, private payloads, private traces, private audits, registry mutation, and report publishing"],"domainAllowlist":["*.platphormnews.com"],"trustLine":"Web dashboard, public-safe discovery, browser-based operations, trusted-domain discovery, standard route compliance, Vercel metadata capture, trace inspection, and agentic workflow discovery are intentionally supported for public read-only debugging and operator workflows. Mutating, administrative, ingestion, replay, fork, remediation, deployment, sync, test-triggering, reporting, and write actions require PLATPHORM_API_KEY.","signatureSecretPolicy":"Signature generation and verification accept transient secrets but never persist or return raw secrets.","ssrfPolicy":"Endpoint registration and delivery must reject localhost, private, link-local, metadata, local DNS, unsafe schemes, and unsafe redirects."

infoUNDECLARED_CAPABILITY_OBSERVED

Undeclared agents capability was observed

https://webhooklab.platphormnews.com/.well-known/agents.json

GET https://webhooklab.platphormnews.com/.well-known/agents.json
HTTP 200
Content-Type: application/json
66 ms
Digest: sha256:dde7596695a2f9ca13c93f1ad18453e47f0c865c9ec07652b54a2ad61183639d
Preview: {"schema_version":"1.0","name":"PlatPhorm WebhookLab Agent","service":"platphorm-webhook-simulator","role":"webhook_testing","endpoints":{"mcp":"https://webhooklab.platphormnews.com/api/mcp","health":"https://webhooklab.platphormnews.com/api/health","docs":"https://webhooklab.platphormnews.com/api/docs","trustPolicy":"https://webhooklab.platphormnews.com/.well-known/trust.json"},"access":{"publicSafe":["homepage, docs, FAQ, OpenAPI, llms, RSS, sitemap, robots, and well-known policy files","Lab shell, local-only payload generation, public templates, JSON/schema validation, and transient signature utilities","redacted event, endpoint, delivery, contract, integration, health, and route-compliance summaries when storage is available","read-only MCP introspection and public-safe MCP tools"],"protectedActions":["persistent endpoint registration, update, and deletion","persistent event creation that sends to registered endpoints","third-party delivery attempts, replay, cancel, retry, and async delivery job mutation","contract create, update, delete, persistent test runs, and protected handoffs to Spec, Evals, Sandbox, AgentUI, Monitor, Docs, Sheets, and Decks","raw delivery details, raw request headers, private payloads, private traces, private audits, registry mutation, and report publishing"],"auth":{"bearer":"Authorization: [REDACTED] $PLATPHORM_API_KEY","header":"X-PlatPhorm-API-Key: [REDACTED],"disallowedSummary":"Generic, service-specific, or neighboring-service key headers are not accepted as platform auth."}},"crawlerUserAgents":{"exactNamesVerified":false,"reason":"WebhookLab does not hardcode unverified official crawler user-agent strings. Platforms are listed by owner and capability only.","platforms":[{"id":"openai","name":"OpenAI / ChatGPT","exactCrawlerUserAgent":null,"status":"supported_public_safe"},{"id":"anthropic","name":"Anthropic / Claude","exactCrawlerUserAgent":null,"status":"supported_public_safe"},{"id":"xai","name":"xAI / Grok","exactCrawlerUserAgent":null,"status":"supported_public_safe"}

highMCP_TOOL_RISK_UNDECLARED