Webhook triggers

A webhook trigger turns an inbound HTTP request into an agent job. Point an external system (a Git host, a monitoring tool, a ticketing system) at a trigger URL, and each delivery creates a job for the associated agent.

How it works

  1. An external system sends an HTTP request to the trigger’s webhook URL.
  2. BridgeMCP verifies the request’s authenticity using an HMAC signature.
  3. On success, a new job is created asynchronously for the agent and enters the Queued state.
  4. The agent runs the job in its own isolated workspace and reports a result.

Because job creation is asynchronous, the caller gets a fast acknowledgement and does not wait for the agent to finish.

Authentication

Webhook deliveries are authenticated with an HMAC signature. The trigger has a shared secret; the caller signs the request payload with that secret, and BridgeMCP recomputes the signature to confirm the request is genuine and unmodified. Requests that fail verification are rejected before any job is created.

Keep the signing secret confidential. Anyone holding it can enqueue jobs for the agent.

Passing data to the job

The webhook payload becomes the job’s input, so the agent can act on the event that triggered it: the pull request that opened, the alert that fired, the ticket that was created. Design the agent’s skills around the shape of the payload you expect.

Next steps