# Webhook Agent Gate: the one-action pattern and a ten-check handler scan (free sample)

> From Webhook Agent Gate: the five-step pattern that makes a webhook act once, six rules for agents that build or touch webhook code, and a read-only script that runs ten checks on a Python or JavaScript handler, from parsing before the signature check and plain string compares to missing duplicate protection and refunds inside the request.

- URL: https://paperchasewebb.ai/bots/marketplace/items/webhook-agent-gate-one-action-pattern-ten-check-handler-scan-free-sample/
- Type: Prompt pack
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); Plain .md plus one Python 3 script, standard library only, read-only. The rules paste into AGENTS.md, CLAUDE.md, Hermes's AGENTS.md or a Grok Bot's standing instructions. Tested on Linux on Python and JavaScript webhook handlers
- Price: Free USD
- Difficulty: Beginner
- Setup time: 5 min
- Time to result: About five minutes to a first scan
- Format: Markdown (.md) file, webhook-agent-gate-one-action-pattern-ten-check-handler-scan-free-sample.md
- Version: 1.0, updated 2026-10-31
- License: Personal and commercial use.

## What you end up with

You know whether your webhook handler can act twice on one event, or act on a forged one, and what to fix first.

## What you get

- The one-action pattern in five steps
- Six rules for agents that build or touch webhook code
- hook_mini.py: ten read-only checks for a handler file

## Who it is for

Anyone who wants a quick check of a webhook handler before it starts an agent or moves money.

## Tools needed

- Python 3.8 or newer: runs the gate, the worker, the owner approval script, replay.py and hook_check.py; standard library only
- You need: Python 3.8 or newer
- You need: A webhook handler in Python or JavaScript/TypeScript

Cost to run: Free.

## Sample prompt: Scan before you go live (Grok Bot, Claude Code, Codex, Hermes)

```
Run python3 hook_mini.py on [handler file]. For every finding, explain the risk in one line and the smallest fix. Do not edit the file.
```

The rules and script are in the file.

## Free preview of webhook-agent-gate-one-action-pattern-ten-check-handler-scan-free-sample.md

````markdown
# Webhook Agent Gate: the safe webhook pattern for agents and a ten-check handler scan (free sample)

Version 1.0, 2026-10-31. By PaperChaseWebb. For anyone who lets a Stripe, GitHub, form or store webhook start an agent, a Zap, an n8n flow or a refund. One page and one Python 3 script, standard library only, read-only: it reads handler files and never runs them, sends nothing and reads no secrets. Tested with 3 unit tests and 41 planted faults (each of the ten checks fires) on Linux with Python 3.13, 3.12, 3.11, 3.9 and 3.8, and run on the eight Python and Node webhook servers in Stripe's public accept-a-payment samples.

## The pattern

Providers send the same event more than once, out of order, and keep retrying when your handler is slow or answers with an error. That is normal and documented. It turns into a problem the day the handler starts an agent or moves money, because each copy can run the action again. The safe shape:

1. Verify the signature on the raw body, before parsing. A failed check answers 400 and stops. A missing secret stops the server from starting; it never means "skip the check".
2. Store the event once, under a unique key on the event id (INSERT OR IGNORE or ON CONFLICT DO NOTHING). Answer 200 quickly, including to a duplicate.
3. Do the work later, in a worker. Each action gets a key built from what it acts on (refund:ch_123), not from the event or the run. Two copies of one event, or two events about the same charge, land on one row.
4. Money and a
````

## Test record

- Date: Oct 31, 2026
- What was run: tests/test_mini.py (clean handler, bought starter findings, file input) and the copy extracted from the sample page. Linux, Python 3.13, 3.12, 3.11, 3.9 and 3.8.
- Result: 3 passed, 0 failed on all five versions; the extracted copy was identical to the tested script and found 8 findings in the made-up starter.
- Not run: Replay against a running handler (the full kit's replay.py does that).

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- The sample checks handler files only. The gate, the ledger, the owner step, replay.py and the 17-check checker with event map, ledger and rules checks are in the full kit.
- On 2026-10-31 hook_mini.py passed 3 unit tests on Linux with Python 3.13, 3.12, 3.11, 3.9 and 3.8, and the copy extracted from the sample page was identical to the tested script.

## Questions

**Does it change my files?** No. It reads the files you name and prints findings. It opens no network connection and never runs your code.

**What is in the full kit?** A webhook gate with four signature schemes, a ledger that acts once per action, owner-approved refunds, replay.py, a 17-check checker tested on Stripe's public samples, and setup for Grok Bot, Claude Code, Codex and Hermes. $29.

## How to get it

Free sample. Download it directly at https://paperchasewebb.ai/bots/marketplace/items/webhook-agent-gate-one-action-pattern-ten-check-handler-scan-free-sample/, no signup.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com