webex-message-handler
Mercury WebSocket · KMS · 4 languages

Receive encrypted Webex messages.
Emit decrypted ones.

Lightweight Webex Mercury WebSocket + KMS decryption for receiving bot messages — no Webex SDK required. Available for Node.js, Python, Go, and Rust.

Get started Read the source ↗
0 known vulnerabilities ~6 dependencies no public webhook
Why not just use the SDK

The receive path, and nothing you don't need.

The official Webex JS SDK pulls in hundreds of transitive dependencies for a job that's really just a WebSocket and a decrypt loop. This extracts only that.

0 known CVEs

Small, audited surface

A handful of direct dependencies per language, scanned on every release. Nothing you can't read in an afternoon.

~6 vs 300+

Dependencies, not a framework

The Webex JS SDK ships 300+ transitive packages. This ships the Mercury + KMS essentials and stops there.

↔ no ingress

Works behind a firewall

An outbound WebSocket, so bots receive messages with no public webhook endpoint and no Hookbuster in the middle.

One dependency, four runtimes

Install

The same receive-and-decrypt model in each language, with idiomatic APIs. Pick your runtime.

$npm install webex-message-handler

      

    

  


  
  

    

      

        The data flow
        
Five steps from socket to plaintext.

        
Every message follows the same pipeline. The library owns all five; you subscribe to the last one.

      

      

        
01
Register device
Register with WDM and obtain the Mercury WebSocket URL.

        
02
Connect Mercury
Open the socket, authorize the token, heartbeat with ping/pong.

        
03
Encrypted activity
Mercury pushes encrypted conversation.activity frames.

        
04
Fetch KMS key
Retrieve the decryption key over an ECDH-secured KMS channel.

        
05
Decrypt & emit
JWE/AES-GCM decrypt, then emit message:created.

      

    

  


  
  

    

      

        What arrives at your callback
        
More than plain text.

        
The decrypt loop surfaces the parts of a Webex activity you actually act on — parsed, deduped, and typed.

      

      

        
✓
Mercury + KMS decryptionThe core receive loop: encrypted frames in, plaintext out.

        
✓
MentionsPerson UUIDs and group mentions parsed from decrypted HTML.

        
✓
Message editsmessage:updated with the re-decrypted content.

        
✓
Adaptive Card actionsattachmentAction:created with the submitted inputs.

        
✓
File attachmentsFile-only shares arrive too, with their attachment URLs in files.

        
✓
Room & membership eventsCreated/updated rooms and add/leave/moderator changes.

        
✓
ThreadingparentId plus REST ↔ Mercury ID conversion helpers.

        
✓
Self-message filteringDrops the bot's own messages to prevent reply loops.

        
✓
Circuit breaker + retryKMS failures fail fast instead of stalling the stream.

      

    

  


  
  

    

      

        Honest comparison
        
Where it fits.

        
It does one side of the conversation — receive — and expects you to send with the plain REST API.

      

      

        

          
            

              
              webex-message-handler
              Webex JS SDK
              Hookbuster
            

          
          
            
Dependencies~6~300+Full SDK

            
Known vulnerabilities0MultipleInherits SDK

            
LanguagesNode · Python · Go · RustJavaScriptJavaScript

            
Receive messagesYesYesYes

            
Send messagesNo — use RESTYesNo

            
Public webhook requiredNoNoNo

            
Footprint~50 KB~5 MB+~5 MB+