What it does
Inspiration
Payment webhooks are easy to underestimate. Providers retry, events arrive twice or late, and an amount in a callback may not match the original order. I wanted to make these failure modes visible and give developers a practical way to review payment code before it reaches production.
What I built
RedTeam Pay combines an interactive security lab with an IDE agent. In the lab, five deterministic scenarios—duplicate webhooks, amount tampering, old event replay, late callbacks, and retry storms—run against a vulnerable baseline and a hardened reference handler. Developers can follow the run, compare results, inspect evidence, and export a report.
For Codex and VS Code, I built an MCP server with tools to scan for payment-related code, list the scenarios, and run the reference simulation. An Agent Skill guides the IDE agent to inspect cited code in context and explain where a finding is certain or only a heuristic. The scan is read-only, and the simulation never executes or changes the developer’s project. The dashboard also supports optional AI explanations and an explicitly triggered PayPal sandbox order.
Challenges and what I learned
My original concept involved two autonomous agents generating and attacking payment code, then patching it automatically. I narrowed the project to a reliable, demonstrable scope: deterministic attacks against reference handlers, plus an IDE review workflow that leaves the developer’s code untouched.
Building it taught me how to connect an IDE agent to MCP tools and package a reusable skill for more than one editor. It also reinforced that webhook security depends on several controls working together: process event IDs once, reconcile amounts against stored orders, enforce a replay window, and verify the provider’s signature. The simulator’s signature check is only a fixture, and the code scan can miss or misidentify patterns. Making those limits clear is part of building a tool developers can trust.
Built With
- ai-agents
- codex
- css
- express.js
- html
- javascript
- llm
- model-context-protocol-(mcp)
- node.js
- paypal-sandbox
- server-sent
- typescript
- vercel
- visual-studio-code
