Signed Webhook File Executor
Letting an external process drop commands for MetaTrader to execute is one of the more dangerous bridges a trader can build - anything that can write a file that this EA will read can otherwise move money. Every part of this EA exists to make a bad, stale or forged command file harmless rather than to make the happy path fast. A command file is a single CSV line: a sequence number, symbol, action (BUY/SELL/CLOSE), lot size, stop-loss and take-profit in pips, a Unix timestamp and a hex HMAC-SHA256 signature over everything before it. The signature is checked FIRST, before any field is used for trading logic - a file whose signature does not match the shared secret is rejected without its trading fields ever influencing anything. HMAC-SHA256 is built from MQL4's raw SHA-256 primitive using the standard RFC 2104 nested-hash construction, since MQL4 exposes a hash function, not a keyed MAC, directly. Beyond the signature, three more layers apply before anything trades: the sequence number must be strictly greater than the last one accepted (rejecting a re-dropped or replayed file, and persisted to disk so a restart cannot reset the counter backwards), the embedded timestamp must fall inside a configurable freshness window (rejecting a stale, queued command), and two circuit breakers apply regardless of what a validly signed file requests: an absolute maximum lot size per trade, and a maximum number of accepted commands per rolling hour. A third breaker caps the number of this EA's own concurrently open positions. Every command that reaches the folder is logged to a CSV audit file with its outcome and the specific reason - malformed, bad signature, replay, stale, over the lot cap, rate-limited, or genuinely executed - so a compromised or misbehaving sender is visible in the log even on the runs where nothing actually traded. A dry-run mode validates and logs every command without ever sending an order, for testing the bridge end to end before trusting it with real execution. Notes and limitations This EA can only be as safe as the secret and the machine it runs on - anyone who can read InpSharedSecret from the chart's input dialog or the terminal's configuration, or who can write directly to the account through some other channel, is not stopped by any of this. Signature verification, replay protection and the circuit breakers stop a forged, replayed, stale or oversized command from a channel that is otherwise untrusted; they do not substitute for keeping the secret itself confidential. The sequence-number watermark is stored in a plain file in the sandbox and is not itself encrypted - protect the terminal data folder the same way any other credential store would be protected.
Expert advisor · MT5 · v1.0 · Free
About Signed Webhook File Executor
Signed Webhook File Executor is an expert advisor (trading robot) for MetaTrader 5. It has 12 settings, such as Shared secret, Drop folder and File extension. MQL source code included.
Files in the download: SignedWebhookFileExecutor.ex5, SignedWebhookFileExecutor.mq5, SignedWebhookFileExecutor.txt.
Trading robots can lose money. Check every setting and test on a demo account before using real funds.
Settings
| Setting | Default | What it does |
|---|---|---|
| Shared secret | Shared HMAC secret, must match the sender - leave blank to refuse everything (fails safe) | |
| Drop folder | SignedWebhookFileExecutor\\Inbox | Subfolder of MQL5\Files scanned for command files |
| File extension | .sig | Only files with this extension are considered |
| Max command age seconds | 60 | Reject a command whose embedded timestamp is older than this |
| Max lots per trade | 1.0 | Hard cap - no accepted command may exceed this, regardless of what it requests |
| Max commands per hour | 20 | Circuit breaker - accepted commands allowed per rolling hour |
| Max open positions | 5 | Circuit breaker - refuse new entries once this many own positions are open |
| Magic number | 44100 | Magic number that tells this EA's orders apart |
| Dry run | false | true = validate and log only, never sends an order |
| Max retries | 5 | |
| Retry wait ms | 500 | |
| Scan interval seconds | 2 | How often the inbox folder is scanned |
How to install
- Download the ZIP from your PolyMaria library and unzip it.
- In MetaTrader 5 open File → Open Data Folder, then go to MQL5 → Experts.
- Copy the .mq5 file(s) there. Put any .mqh files in MQL5 → Include.
- Open the .mq5 file in MetaEditor and press Compile (F7) if MetaTrader does not show it.
- Drag the expert advisor from the Navigator onto a chart, check the settings, allow Algo/Auto Trading and press OK.
- Test it first on a demo account or in the Strategy Tester.
Tags: MT5 Expert Advisor · MQL5 Source Code