Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/nylas/cli/webhooksgit clone --depth 1 https://github.com/nylas/cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.03299 |
| Opus 5 | $0.00000 | $0.01649 |
| Sonnet 5 | $0.00000 | $0.00660 |
| Haiku 4.5 | $0.00000 | $0.00330 |
Grade A, and why
webhooks scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
# Skip the prompt and run loopback-only (useful for local curl tests How it starts
The opening of the file, as written. The whole thing — 559 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Webhook Management
Create and manage Nylas notification destinations for real-time event delivery.
Quick Reference
nylas webhook list
nylas webhook create --url https://example.com/webhook --triggers message.created
nylas webhook rotate-secret <webhook-id> --yes
nylas webhook verify --payload-file body.json --signature <sig> --secret <secret>
nylas webhook pubsub list
nylas webhook pubsub create --topic projects/PROJ/topics/TOPIC --triggers message.created
nylas webhook pubsub show <channel-id>
nylas webhook pubsub update <channel-id> --status inactive
nylas webhook pubsub delete <channel-id> --yes
Built-in Webhook Server
Start a local webhook server for development and testing:
# Interactive: detects cloudflared and prompts to enable a public tunnel.
# (Nylas can't deliver webhooks to localhost, so a tunnel is needed to
# receive real events.)
nylas webhook server
# Skip the prompt and run loopback-only (useful for local curl tests
# or non-interactive environments)
nylas webhook server --no-tunnel
# Start with public tunnel (cloudflared required) + signature verification
nylas webhook server --tunnel cloudflared --secret your-webhook-secret
# Custom port with a tunnel
nylas webhook server --port 8080 --tunnel cloudflared --secret your-webhook-secret
# Auto-register: create the Nylas webhook for the tunnel URL, fetch its
# secret automatically, and delete it again on exit (no manual setup)
nylas webhook server --tunnel cloudflared --register --triggers message.created
When --tunnel is set, --secret is required (or pass --allow-unsigned
to opt out explicitly). The interactive preflight will prompt for a
secret inline when you accept the tunnel; leaving it empty opts into
unsigned mode.
Auto-registration (--register): the quick-tunnel URL changes on every
restart, so registering it by hand is tedious. --register does it for you:
after the tunnel comes up the CLI creates a Nylas webhook pointing at the live
URL, pulls back the signing secret into memory (so signature verification is
on without you copying anything), and deletes the webhook when the server
stops. A stale-webhook sweep on start also removes any auto-registered webhook
left behind by a previous hard kill. Choose the events with --triggers
(comma-separated or repeated); you'll be prompted if it's omitted on a
terminal. With --register you do not pass --secret — it's fetched from
Nylas. --register implies --tunnel cloudflared and cannot be combined with
--secret, --allow-unsigned, or --no-tunnel.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 559 lines · 0 tokens per session scan A 14ed56cf6602
webhooks is a command published in the GitHub repository nylas/cli (68 stars, last pushed 14d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,299 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
create-pr
Create a pull request following the official template.
/release
Release a new version — updates CHANGELOG, pyproject.toml, creates git tag, and pushes.
numbers-to-excel
Convert a Numbers document to Excel.
briefing
Get a daily briefing of today's calendar events, reminders, and optional inbox context.
symfony-api-errors
Design API Platform 4.3 error handling — RFC 7807.
execute-plan
Execute an implementation plan methodically with TDD and continuous validation.