feat(webhook_verify): timing-safe, replay-resistant webhook signature verification module (29 tests, zero deps)

[Larslllllll]

Refs #2 — you asked for more community packages, so here is one that fills a gap I did not see covered by the existing modules.

What it does

webhook_verify verifies inbound webhook signatures for Stripe, GitHub, Slack, Shopify, Twilio and generic hex HMAC. Zero dependencies — node:crypto only.

Why this one

Webhook verification is the security code almost every backend rewrites, and it fails in four predictable ways:

Mistake	Consequence
signature === expected	Byte-by-byte comparison leaks the position of the first wrong byte through timing
No timestamp check	A captured valid request stays valid forever — replay it tomorrow and it passes
Verifying the parsed body	Re-serialising shifts key order or whitespace, the HMAC stops matching, and people "fix" it by disabling verification
Returning bare false	A caller writes if (verify(...)) and a truthy value slips through

The module inverts each one:

• timingSafeEqual everywhere, with an explicit length check first — timingSafeEqual throws on unequal lengths, and length is itself a leak
• replay windows on every provider that signs a timestamp, symmetric so a future-dated timestamp is rejected too
• verification against the raw body; nothing is decoded before the signature is checked
• a structured result with a specific reason (signature_mismatch, timestamp_out_of_range, malformed_signature, unsupported_provider) plus advice: "Do not parse or act on this payload."

Stripe secret rotation is handled: a header carrying several v1= values passes if any one matches.

Layout

Follows mcp_modules/template exactly:

mcp_modules/webhook_verify/
  index.js                 register() + /tools/webhook_verify + metadata
  src/service.js           verification logic
  src/controller.js        HTTP handlers
  src/utils.js             header extraction (case-insensitive) + secret redaction
  test/service.test.js     23 tests
  test/utils.test.js       6 tests
  examples/basic-usage.js  runnable
  docs/api.md
  README.md
  package.json

Tests

29 passing (mocha + chai):

stripe        valid · tampered body · replayed · future-dated · multi-v1 rotation · no timestamp · non-numeric timestamp
github        valid · wrong secret · missing sha256= prefix · truncated signature (no throw)
slack         valid · stale request
shopify       valid · non-base64
twilio        valid · params changed
hmac          valid · non-hex
dispatcher    unsupported provider · missing secret · advice present on failure · never a bare boolean
utils         case-insensitive headers · slack timestamp · unknown provider · redaction (3)

A failed verification returns HTTP 200 with valid: false — it is a valid answer, not a server error. Missing or unsupported parameters return 400.

Happy to rename the module, adjust the endpoint prefix, or split providers if you would rather they were separate modules.