com.upheron/upheronv1.1.0 Domain verified
Uptime and vulnerability monitoring: check sites, manage monitors, incidents and status pages.
Maintained byupheron.com(verified)Also a maintainer?
Try it
Call this server's tools from your browser. Nothing to install.
https://upheron.com/mcp
Optional. An UpHeron API token from Settings → API tokens (read, or write to change monitors). Without one, only check_website works.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
acknowledge_incident
Marks an open incident as being handled: its repeat alerts and escalation stop. Everyone alerted still hears when it recovers. Free.
Incident ID from list_incidents.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Install
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
Run in a terminal
claude mcp add --transport http upheron https://upheron.com/mcp
Headers
X-API-Key(optional, not in the config above): Optional. An UpHeron API token from Settings → API tokens (read, or write to change monitors). Without one, only check_website works.
Tools (46)
acknowledge_incidentMarks an open incident as being handled: its repeat alerts and escalation stop. Everyone alerted still hears when it recovers. Free.
acknowledge_incident
Marks an open incident as being handled: its repeat alerts and escalation stop. Everyone alerted still hears when it recovers. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Incident ID from list_incidents. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Incident ID from list_incidents."
}
},
"additionalProperties": false
}add_notification_contactAdds an email address, chat channel, paging service, Jira project, webhook or phone number to alert on outages and recoveries. Email contacts must open a confirmation link before they receive alerts. A phone number texts or calls through the user's own account with a provider, on every plan, which bills them: twilio (Account SID, Auth Token) and plivo (Auth ID, Auth Token) text or call, vonage (API key and secret) and telnyx (API key) text. The user gives you the credentials and the sender, one of the account's numbers or for texts a sender ID of up to 11 letters and digits (not in the US or Canada). It needs no code: check it with test_notification_contact. sms and voice, through UpHeron's own Twilio account, are no longer added.
add_notification_contact
Adds an email address, chat channel, paging service, Jira project, webhook or phone number to alert on outages and recoveries. Email contacts must open a confirmation link before they receive alerts. A phone number texts or calls through the user's own account with a provider, on every plan, which bills them: twilio (Account SID, Auth Token) and plivo (Auth ID, Auth Token) text or call, vonage (API key and secret) and telnyx (API key) text. The user gives you the credentials and the sender, one of the account's numbers or for texts a sender ID of up to 11 letters and digits (not in the US or Canada). It needs no code: check it with test_notification_contact. sms and voice, through UpHeron's own Twilio account, are no longer added.
| Argument | Type | Description |
|---|---|---|
| kind* | string | Every plan alerts by email and through your own account with a texting provider, which bills you: `twilio` and `plivo` text or call, `vonage` and `telnyx` text (no code to confirm, send a test instead); the other kinds need a paid plan (pay-as-you-go workspaces: email, webhook, twilio, vonage, plivo and telnyx). `sms` and `voice`, texts and calls through UpHeron's own Twilio account, are no longer added (422 `phone_kind_retired`); contacts added before keep working and confirm with a code (`/alert-channels/{id}/confirm`). Push notifications to a device are added in the dashboard. |
| name* | string | |
| token | string | Telegram bot token, Pushover application token, ntfy access token (optional), Jira API token, Twilio or Plivo Auth Token, Vonage API secret, Telnyx API key, or a webhook's signing secret (optional: `whsec_` and 24 to 64 bytes in Base64; one is made when it is left out). Stored encrypted and never returned, except a webhook's signing secret as `signing_secret` in the response that made it. |
| options | object | opsgenie: `region` (us or eu, default us). splunk_oncall: `routing_key`. jira: `email` (the account the API token belongs to), `project` (key, such as OPS), `issue_type` (default Task) and `resolve_status` (optional: the status a resolved incident's issue moves to, such as Done). twilio: `account_sid` (AC…), `from_number` and `mode` (sms or call, default sms). vonage: `api_key` and `from_number`. plivo: `auth_id` (MA… or SA…), `from_number` and `mode`. telnyx: `from_number` and `messaging_profile_id` (needed for a sender ID; without `from_number` the profile's numbers send). `from_number` is one of the account's numbers with its country code, or for texts a sender ID of up to 11 letters, digits and spaces with at least one letter (not accepted in the US and Canada), or for twilio a Messaging Service SID (MG…). |
| destination* | string | Email address; webhook URL (slack, discord, teams, google_chat, mattermost, rocketchat, ntfy, webhook, zapier: its Catch Hook URL); Telegram chat ID; PagerDuty or ilert integration key, Pushover user key or Opsgenie API key; Splunk On-Call REST endpoint URL; Jira site URL (https://your-team.atlassian.net); or for twilio, vonage, plivo and telnyx the phone number to alert, with its country code (+359…). |
| error_types | array | null | Alert about the outages of these kinds of errors only, and their recoveries; null or left out for every kind. timeout, connection (refused, reset, unreachable, no reply), dns, tls (handshake and certificate verification), http_5xx, http_4xx, http_status (other unexpected statuses), content (missing text, a failed JSON assertion, a wrong reply), slow (latency threshold, performance score), heartbeat (missed or failed runs), expiry (certificate and domain monitors) and other. Expiry reminders, vulnerability and port alerts are not filtered. |
Input schema (JSON)
{
"type": "object",
"required": [
"name",
"kind",
"destination"
],
"properties": {
"kind": {
"enum": [
"email",
"slack",
"discord",
"teams",
"google_chat",
"mattermost",
"rocketchat",
"telegram",
"pagerduty",
"opsgenie",
"splunk_oncall",
"ilert",
"pushover",
"ntfy",
"jira",
"webhook",
"zapier",
"twilio",
"vonage",
"plivo",
"telnyx"
],
"type": "string",
"description": "Every plan alerts by email and through your own account with a texting provider, which bills you: `twilio` and `plivo` text or call, `vonage` and `telnyx` text (no code to confirm, send a test instead); the other kinds need a paid plan (pay-as-you-go workspaces: email, webhook, twilio, vonage, plivo and telnyx). `sms` and `voice`, texts and calls through UpHeron's own Twilio account, are no longer added (422 `phone_kind_retired`); contacts added before keep working and confirm with a code (`/alert-channels/{id}/confirm`). Push notifications to a device are added in the dashboard."
},
"name": {
"type": "string",
"maxLength": 100
},
"token": {
"type": "string",
"description": "Telegram bot token, Pushover application token, ntfy access token (optional), Jira API token, Twilio or Plivo Auth Token, Vonage API secret, Telnyx API key, or a webhook's signing secret (optional: `whsec_` and 24 to 64 bytes in Base64; one is made when it is left out). Stored encrypted and never returned, except a webhook's signing secret as `signing_secret` in the response that made it."
},
"options": {
"type": "object",
"description": "opsgenie: `region` (us or eu, default us). splunk_oncall: `routing_key`. jira: `email` (the account the API token belongs to), `project` (key, such as OPS), `issue_type` (default Task) and `resolve_status` (optional: the status a resolved incident's issue moves to, such as Done). twilio: `account_sid` (AC…), `from_number` and `mode` (sms or call, default sms). vonage: `api_key` and `from_number`. plivo: `auth_id` (MA… or SA…), `from_number` and `mode`. telnyx: `from_number` and `messaging_profile_id` (needed for a sender ID; without `from_number` the profile's numbers send). `from_number` is one of the account's numbers with its country code, or for texts a sender ID of up to 11 letters, digits and spaces with at least one letter (not accepted in the US and Canada), or for twilio a Messaging Service SID (MG…).",
"additionalProperties": {
"type": "string"
}
},
"destination": {
"type": "string",
"description": "Email address; webhook URL (slack, discord, teams, google_chat, mattermost, rocketchat, ntfy, webhook, zapier: its Catch Hook URL); Telegram chat ID; PagerDuty or ilert integration key, Pushover user key or Opsgenie API key; Splunk On-Call REST endpoint URL; Jira site URL (https://your-team.atlassian.net); or for twilio, vonage, plivo and telnyx the phone number to alert, with its country code (+359…)."
},
"error_types": {
"type": [
"array",
"null"
],
"items": {
"enum": [
"timeout",
"connection",
"dns",
"tls",
"http_5xx",
"http_4xx",
"http_status",
"content",
"slow",
"heartbeat",
"expiry",
"other"
],
"type": "string"
},
"description": "Alert about the outages of these kinds of errors only, and their recoveries; null or left out for every kind. timeout, connection (refused, reset, unreachable, no reply), dns, tls (handshake and certificate verification), http_5xx, http_4xx, http_status (other unexpected statuses), content (missing text, a failed JSON assertion, a wrong reply), slow (latency threshold, performance score), heartbeat (missed or failed runs), expiry (certificate and domain monitors) and other. Expiry reminders, vulnerability and port alerts are not filtered."
}
},
"additionalProperties": false
}add_on_call_overrideBusiness plans: puts a contact on call in a schedule from starts_at to ends_at (up to 90 days), instead of the rotation. Overrides may not overlap. Free.
add_on_call_override
Business plans: puts a contact on call in a schedule from starts_at to ends_at (up to 90 days), instead of the rotation. Overrides may not overlap. Free.
| Argument | Type | Description |
|---|---|---|
| ends_at* | string | In the future, after starts_at and at most 90 days later. Overrides of a schedule may not overlap. |
| starts_at* | string | |
| schedule_id* | string | Schedule ID from list_on_call_schedules. |
| alert_channel_id* | string | The notification contact on call instead of the rotation. |
Input schema (JSON)
{
"type": "object",
"required": [
"schedule_id",
"alert_channel_id",
"starts_at",
"ends_at"
],
"properties": {
"ends_at": {
"type": "string",
"format": "date-time",
"description": "In the future, after starts_at and at most 90 days later. Overrides of a schedule may not overlap."
},
"starts_at": {
"type": "string",
"format": "date-time"
},
"schedule_id": {
"type": "string",
"format": "uuid",
"description": "Schedule ID from list_on_call_schedules."
},
"alert_channel_id": {
"type": "string",
"format": "uuid",
"description": "The notification contact on call instead of the rotation."
}
},
"additionalProperties": false
}add_softwareAdds one piece of software the website runs, by name (Debian, nginx, WordPress, Next.js…), package (npm:lodash, composer:vendor/package, pypi:django, wp-plugin:slug) or NVD product (cpe:vendor:product), with its version if known. Replaces a detected or imported entry for the same product. Free.
add_software
Adds one piece of software the website runs, by name (Debian, nginx, WordPress, Next.js…), package (npm:lodash, composer:vendor/package, pypi:django, wp-plugin:slug) or NVD product (cpe:vendor:product), with its version if known. Replaces a detected or imported entry for the same product. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
| name* | string | Product name or package, such as "Debian" or "npm:lodash". |
| version | string | Installed version, such as 12 or 4.17.21. Leave out when unknown. |
Input schema (JSON)
{
"type": "object",
"required": [
"id",
"name"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
},
"name": {
"type": "string",
"description": "Product name or package, such as \"Debian\" or \"npm:lodash\"."
},
"version": {
"type": "string",
"description": "Installed version, such as 12 or 4.17.21. Leave out when unknown."
}
},
"additionalProperties": false
}check_websiteChecks whether a public website responds right now, from the monitoring service, without an account. Returns status, HTTP code and timings. Free; limited to a few checks a minute.
read-only
check_website
Checks whether a public website responds right now, from the monitoring service, without an account. Returns status, HTTP code and timings. Free; limited to a few checks a minute.
| Argument | Type | Description |
|---|---|---|
| url* | string | A public website, such as example.com or https://example.com/path. |
Input schema (JSON)
{
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "A public website, such as example.com or https://example.com/path."
}
},
"additionalProperties": false
}comment_on_incidentAdds a comment to the incident's timeline, seen only by the workspace (Pro plans). Use it to record what you found or did. Free.
comment_on_incident
Adds a comment to the incident's timeline, seen only by the workspace (Pro plans). Use it to record what you found or did. Free.
| Argument | Type | Description |
|---|---|---|
| message* | string | |
| incident_id* | string | Incident ID from list_incidents. |
Input schema (JSON)
{
"type": "object",
"required": [
"incident_id",
"message"
],
"properties": {
"message": {
"type": "string",
"maxLength": 2000
},
"incident_id": {
"type": "string",
"format": "uuid",
"description": "Incident ID from list_incidents."
}
},
"additionalProperties": false
}confirm_notification_contactConfirms an sms or voice contact, added before they were retired, with the 6-digit code it was texted or told in a call. The code works for 24 hours and 5 tries. Ask the phone's owner for it; never guess.
confirm_notification_contact
Confirms an sms or voice contact, added before they were retired, with the 6-digit code it was texted or told in a call. The code works for 24 hours and 5 tries. Ask the phone's owner for it; never guess.
| Argument | Type | Description |
|---|---|---|
| id* | string | Contact ID from add_notification_contact or list_notification_contacts. |
| code* | string |
Input schema (JSON)
{
"type": "object",
"required": [
"id",
"code"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Contact ID from add_notification_contact or list_notification_contacts."
},
"code": {
"type": "string",
"pattern": "^[0-9]{6}$"
}
},
"additionalProperties": false
}create_escalation_policyBusiness plans: ordered steps, each alerting contacts and whoever is on call in schedules, then waiting for an acknowledgement before the next. Monitors use it with update_monitor's escalation_policy_id. Free.
create_escalation_policy
Business plans: ordered steps, each alerting contacts and whoever is on call in schedules, then waiting for an acknowledgement before the next. Monitors use it with update_monitor's escalation_policy_id. Free.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| steps* | array | In order; sending steps replaces them all. Each names contacts, schedules or both. |
| repeat_count | integer | Times the whole policy runs again when nobody acknowledges. |
Input schema (JSON)
{
"type": "object",
"required": [
"name",
"steps"
],
"properties": {
"name": {
"type": "string",
"maxLength": 80
},
"steps": {
"type": "array",
"items": {
"type": "object",
"properties": {
"schedule_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"maxItems": 20,
"description": "On-call schedules whose on-call contact it alerts."
},
"wait_minutes": {
"type": "integer",
"default": 10,
"maximum": 1440,
"minimum": 1,
"description": "Minutes to wait for an acknowledgement before the next step."
},
"alert_channel_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"maxItems": 50,
"description": "Notification contacts it alerts."
}
}
},
"maxItems": 10,
"minItems": 1,
"description": "In order; sending steps replaces them all. Each names contacts, schedules or both."
},
"repeat_count": {
"type": "integer",
"default": 0,
"maximum": 9,
"minimum": 0,
"description": "Times the whole policy runs again when nobody acknowledges."
}
},
"additionalProperties": false
}create_monitorCreates a monitor in a free slot of the workspace's plan. Premium monitors (multi-step transactions and code repositories) have slots of their own, on Pro and Business only. When every slot is in use the call fails with monitor_limit_reached: the user can upgrade at https://upheron.com/pricing or delete a monitor. Needs a write token.
create_monitor
Creates a monitor in a free slot of the workspace's plan. Premium monitors (multi-step transactions and code repositories) have slots of their own, on Pro and Business only. When every slot is in use the call fails with monitor_limit_reached: the user can upgrade at https://upheron.com/pricing or delete a monitor. Needs a write token.
| Argument | Type | Description |
|---|---|---|
| url | string | URL, or host[:port] for network checks. |
| kind | string | What to check. `heartbeat` and `webhook` wait for your calls instead of probing. `repository` reads a GitHub or GitLab repository's dependency manifests daily and alerts on vulnerabilities in them, on every plan; put the repository URL in `url` (optionally …/tree/branch/folder) and, for a private repository (Pro plan), an access token in `check_options.token`. `websocket` (a ws:// or wss:// URL) and `grpc` (host[:port]) are created on Pro and Business (Free answers `422` with `plan_required`). |
| name* | string | Shown in alerts and on status pages. |
| charts | string | Charts on public status pages: uptime bars (the last 90 days, or the whole history), the last 24 hours of response time, or both. |
| method | string | |
| tab_id | string | null | The monitor tab (GET /monitor-tabs) the monitor is sorted into in the dashboard; `null` takes it out of its tab. |
| keyword | string | Text the response body must contain. |
| locations | array | Location codes from GET /locations. Defaults to the first location. |
| port_scan | boolean | Business plans, network and website checks: scan the common TCP ports of the host's verified addresses weekly (POST /monitors/{id}/ports/verify), and alert when a port opens. See /docs/port-scans. |
| ip_version | string | Network and website checks: `auto` connects over IPv4, or IPv6 when the host has no IPv4 address; `ipv4` and `ipv6` use only that. `ipv6` needs locations with IPv6 (`ipv6` in GET /locations). An IP address as the host sets it. |
| timeout_ms | integer | |
| status_page | boolean | Creating only: give the monitor its own published status page while the plan allows more pages. Send `false` when you manage status pages yourself. |
| request_body | string | |
| check_options | object | Kind-specific options, such as `json_path`/`expected_value` for `api`, `steps` for transactions, `warn_days` for ssl. Ports go in `url` as host:port. See /docs/api#check-options. |
| expiry_alerts | boolean | `http` and `api` monitors: check the domain registration and (for HTTPS) the TLS certificate daily. Domain alerts come 30, 14, 7, 3 and 1 days before expiry; certificate alerts only once automatic renewal should have happened (a sixth of the certificate's lifetime, at most 14 days). Uses no extra monitor. |
| repository_url | string | null | Pro and Business, `http` and `api` monitors with vulnerability alerts: the website's GitHub or GitLab repository (optionally …/tree/branch/folder), whose lockfiles and manifests are read hourly for exact versions. A failed read opens no incident. `null` unlinks it and removes what it listed. |
| idempotency_key | string | Any unique string. Repeating a call with the same key within 24 hours returns the first monitor instead of creating another. Use one per intended monitor. |
| request_headers | object | Sent with the check; stored encrypted and never returned. |
| interval_seconds | integer | Seconds between checks, no faster than the plan allows (300 on Free, 10 on Pro). |
| repository_token | string | null | Access token for a private `repository_url`: on GitHub a fine-grained token with read-only Contents, on GitLab `read_api`. Stored encrypted and never returned (`repository_token_set` tells whether one is saved). Leave it out to keep it; `null` removes it. |
| alert_channel_ids | array | Notification contacts to alert. Defaults to all of the workspace's contacts. |
| failure_threshold | integer | Failed checks in a row before an incident opens. The default alerts on the first failed check. |
| recovery_threshold | integer | |
| alert_delay_minutes | integer | Pro and Business plans: minutes the first outage alert waits after the incident opens (on top of `failure_threshold`). Nobody is alerted about, or hears the recovery of, an outage that ends sooner. |
| expected_status_max | integer | |
| expected_status_min | integer | |
| escalation_policy_id | string | null | Business plans: alert this escalation policy (GET /escalation-policies) about outages instead of `alert_channel_ids`, which still receive expiry and vulnerability alerts. `null` alerts the contacts. |
| repeat_alert_minutes | integer | null | Pro and Business plans: repeat the outage alert to the monitor's contacts this often until someone acknowledges the incident or it recovers, at most 48 times. `null` sends it once. |
| vulnerability_alerts | boolean | Every plan, `http` and `api` monitors: scan the website for the software it runs (weekly on Free, daily on paid plans) and alert on newly published vulnerabilities in it, checked daily and within 15 minutes of a new advisory (OSV.dev with the GitHub Advisory Database, NVD, new CVE records, WPVulnerability and WordPress core advisories for WordPress, CISA KEV, endoflife.date). |
| confirmation_threshold | integer | Locations that must fail a check at the same time for it to count as failed. 1, the default, is any location; with 2 of 3 locations, one failing location alone is no outage and alerts nobody. More than the monitor's locations counts as all of them. |
| vulnerability_severity | string | The lowest severity that alerts. Actively exploited vulnerabilities and releases reaching end of support always alert. |
| heartbeat_grace_seconds | integer | For heartbeat and webhook monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"name"
],
"properties": {
"url": {
"type": "string",
"description": "URL, or host[:port] for network checks."
},
"kind": {
"enum": [
"http",
"api",
"ssl",
"domain",
"dns",
"blacklist",
"email_auth",
"malware",
"tcp",
"ssh",
"smtp",
"imap",
"pop",
"ftps",
"ping",
"ntp",
"udp",
"minecraft",
"steam",
"websocket",
"grpc",
"transaction",
"micro_transaction",
"extended_transaction",
"group",
"cloud_status",
"page_speed",
"webhook",
"heartbeat",
"repository"
],
"type": "string",
"default": "http",
"description": "What to check. `heartbeat` and `webhook` wait for your calls instead of probing. `repository` reads a GitHub or GitLab repository's dependency manifests daily and alerts on vulnerabilities in them, on every plan; put the repository URL in `url` (optionally …/tree/branch/folder) and, for a private repository (Pro plan), an access token in `check_options.token`. `websocket` (a ws:// or wss:// URL) and `grpc` (host[:port]) are created on Pro and Business (Free answers `422` with `plan_required`)."
},
"name": {
"type": "string",
"maxLength": 160,
"description": "Shown in alerts and on status pages."
},
"charts": {
"enum": [
"both",
"uptime",
"response"
],
"type": "string",
"default": "both",
"description": "Charts on public status pages: uptime bars (the last 90 days, or the whole history), the last 24 hours of response time, or both."
},
"method": {
"enum": [
"GET",
"HEAD",
"POST",
"PUT",
"PATCH",
"DELETE"
],
"type": "string",
"default": "GET"
},
"tab_id": {
"type": [
"string",
"null"
],
"format": "uuid",
"description": "The monitor tab (GET /monitor-tabs) the monitor is sorted into in the dashboard; `null` takes it out of its tab."
},
"keyword": {
"type": "string",
"maxLength": 2000,
"description": "Text the response body must contain."
},
"locations": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 10,
"minItems": 1,
"description": "Location codes from GET /locations. Defaults to the first location."
},
"port_scan": {
"type": "boolean",
"default": false,
"description": "Business plans, network and website checks: scan the common TCP ports of the host's verified addresses weekly (POST /monitors/{id}/ports/verify), and alert when a port opens. See /docs/port-scans."
},
"ip_version": {
"enum": [
"auto",
"ipv4",
"ipv6"
],
"type": "string",
"default": "auto",
"description": "Network and website checks: `auto` connects over IPv4, or IPv6 when the host has no IPv4 address; `ipv4` and `ipv6` use only that. `ipv6` needs locations with IPv6 (`ipv6` in GET /locations). An IP address as the host sets it."
},
"timeout_ms": {
"type": "integer",
"default": 10000,
"maximum": 60000,
"minimum": 500
},
"status_page": {
"type": "boolean",
"default": true,
"writeOnly": true,
"description": "Creating only: give the monitor its own published status page while the plan allows more pages. Send `false` when you manage status pages yourself."
},
"request_body": {
"type": "string",
"maxLength": 65536
},
"check_options": {
"type": "object",
"description": "Kind-specific options, such as `json_path`/`expected_value` for `api`, `steps` for transactions, `warn_days` for ssl. Ports go in `url` as host:port. See /docs/api#check-options."
},
"expiry_alerts": {
"type": "boolean",
"default": true,
"description": "`http` and `api` monitors: check the domain registration and (for HTTPS) the TLS certificate daily. Domain alerts come 30, 14, 7, 3 and 1 days before expiry; certificate alerts only once automatic renewal should have happened (a sixth of the certificate's lifetime, at most 14 days). Uses no extra monitor."
},
"repository_url": {
"type": [
"string",
"null"
],
"description": "Pro and Business, `http` and `api` monitors with vulnerability alerts: the website's GitHub or GitLab repository (optionally …/tree/branch/folder), whose lockfiles and manifests are read hourly for exact versions. A failed read opens no incident. `null` unlinks it and removes what it listed."
},
"idempotency_key": {
"type": "string",
"maxLength": 255,
"description": "Any unique string. Repeating a call with the same key within 24 hours returns the first monitor instead of creating another. Use one per intended monitor."
},
"request_headers": {
"type": "object",
"description": "Sent with the check; stored encrypted and never returned.",
"additionalProperties": {
"type": "string"
}
},
"interval_seconds": {
"type": "integer",
"default": 300,
"maximum": 86400,
"minimum": 10,
"description": "Seconds between checks, no faster than the plan allows (300 on Free, 10 on Pro)."
},
"repository_token": {
"type": [
"string",
"null"
],
"maxLength": 500,
"writeOnly": true,
"description": "Access token for a private `repository_url`: on GitHub a fine-grained token with read-only Contents, on GitLab `read_api`. Stored encrypted and never returned (`repository_token_set` tells whether one is saved). Leave it out to keep it; `null` removes it."
},
"alert_channel_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"description": "Notification contacts to alert. Defaults to all of the workspace's contacts."
},
"failure_threshold": {
"type": "integer",
"default": 1,
"maximum": 10,
"minimum": 1,
"description": "Failed checks in a row before an incident opens. The default alerts on the first failed check."
},
"recovery_threshold": {
"type": "integer",
"default": 2,
"maximum": 10,
"minimum": 1
},
"alert_delay_minutes": {
"type": "integer",
"default": 0,
"maximum": 1440,
"minimum": 0,
"description": "Pro and Business plans: minutes the first outage alert waits after the incident opens (on top of `failure_threshold`). Nobody is alerted about, or hears the recovery of, an outage that ends sooner."
},
"expected_status_max": {
"type": "integer",
"default": 399
},
"expected_status_min": {
"type": "integer",
"default": 200
},
"escalation_policy_id": {
"type": [
"string",
"null"
],
"format": "uuid",
"description": "Business plans: alert this escalation policy (GET /escalation-policies) about outages instead of `alert_channel_ids`, which still receive expiry and vulnerability alerts. `null` alerts the contacts."
},
"repeat_alert_minutes": {
"type": [
"integer",
"null"
],
"maximum": 1440,
"minimum": 5,
"description": "Pro and Business plans: repeat the outage alert to the monitor's contacts this often until someone acknowledges the incident or it recovers, at most 48 times. `null` sends it once."
},
"vulnerability_alerts": {
"type": "boolean",
"default": false,
"description": "Every plan, `http` and `api` monitors: scan the website for the software it runs (weekly on Free, daily on paid plans) and alert on newly published vulnerabilities in it, checked daily and within 15 minutes of a new advisory (OSV.dev with the GitHub Advisory Database, NVD, new CVE records, WPVulnerability and WordPress core advisories for WordPress, CISA KEV, endoflife.date)."
},
"confirmation_threshold": {
"type": "integer",
"default": 1,
"maximum": 10,
"minimum": 1,
"description": "Locations that must fail a check at the same time for it to count as failed. 1, the default, is any location; with 2 of 3 locations, one failing location alone is no outage and alerts nobody. More than the monitor's locations counts as all of them."
},
"vulnerability_severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string",
"default": "high",
"description": "The lowest severity that alerts. Actively exploited vulnerabilities and releases reaching end of support always alert."
},
"heartbeat_grace_seconds": {
"type": "integer",
"description": "For heartbeat and webhook monitors."
}
},
"additionalProperties": false
}create_on_call_scheduleBusiness plans: a rotation through notification contacts (list_notification_contacts), handing off daily or weekly at a time in a time zone. The first member is on call from now. Free.
create_on_call_schedule
Business plans: a rotation through notification contacts (list_notification_contacts), handing off daily or weekly at a time in a time zone. The first member is on call from now. Free.
| Argument | Type | Description |
|---|---|---|
| name* | string | |
| rotation | string | |
| time_zone | string | An IANA time zone. |
| member_ids | array | Notification contacts (GET /alert-channels) in rotation order. Changing them, the rotation, the handoff or the time zone starts the rotation over with the first member. |
| handoff_day | integer | Weekly handoffs: the weekday, 1 for Monday. |
| handoff_time | string | HH:MM on the schedule's own clock. |
Input schema (JSON)
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"maxLength": 80
},
"rotation": {
"enum": [
"daily",
"weekly"
],
"type": "string",
"default": "weekly"
},
"time_zone": {
"type": "string",
"default": "Etc/UTC",
"examples": [
"Europe/Berlin"
],
"description": "An IANA time zone."
},
"member_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"maxItems": 50,
"description": "Notification contacts (GET /alert-channels) in rotation order. Changing them, the rotation, the handoff or the time zone starts the rotation over with the first member."
},
"handoff_day": {
"type": "integer",
"default": 1,
"maximum": 7,
"minimum": 1,
"description": "Weekly handoffs: the weekday, 1 for Monday."
},
"handoff_time": {
"type": "string",
"default": "09:00",
"examples": [
"09:00"
],
"description": "HH:MM on the schedule's own clock."
}
},
"additionalProperties": false
}delete_escalation_policyDeletes a policy; its monitors go back to alerting their own contacts. Free.
destructive
delete_escalation_policy
Deletes a policy; its monitors go back to alerting their own contacts. Free.
| Argument | Type | Description |
|---|---|---|
| policy_id* | string | Policy ID from list_escalation_policies. |
Input schema (JSON)
{
"type": "object",
"required": [
"policy_id"
],
"properties": {
"policy_id": {
"type": "string",
"format": "uuid",
"description": "Policy ID from list_escalation_policies."
}
},
"additionalProperties": false
}delete_monitorDeletes a monitor and its history. Frees its plan slot.
destructive
delete_monitor
Deletes a monitor and its history. Frees its plan slot.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
}
},
"additionalProperties": false
}delete_on_call_scheduleDeletes a schedule no escalation policy uses. Free.
destructive
delete_on_call_schedule
Deletes a schedule no escalation policy uses. Free.
| Argument | Type | Description |
|---|---|---|
| schedule_id* | string | Schedule ID from list_on_call_schedules. |
Input schema (JSON)
{
"type": "object",
"required": [
"schedule_id"
],
"properties": {
"schedule_id": {
"type": "string",
"format": "uuid",
"description": "Schedule ID from list_on_call_schedules."
}
},
"additionalProperties": false
}get_accountPlan and its monitor slots (standard in plan_monitors, premium in premium_monitors with their kinds), and the workspace's time zone (workspace.time_zone), which report days follow. Call this first to know whether the plan has room for another monitor.
read-only
get_account
Plan and its monitor slots (standard in plan_monitors, premium in premium_monitors with their kinds), and the workspace's time zone (workspace.time_zone), which report days follow. Call this first to know whether the plan has room for another monitor.
No arguments.
Input schema (JSON)
{
"type": "object",
"required": [],
"properties": {},
"additionalProperties": false
}get_audit_logWho changed what in the workspace, newest first: people, API tokens and agents, with the changed fields and IP (Business plan). Filter by resource_type (monitor, alert_channel, status_page, member, api_token…), action (monitor.updated, or a prefix like monitor.), from and to (YYYY-MM-DD); pass next as before for older entries. Free.
read-only
get_audit_log
Who changed what in the workspace, newest first: people, API tokens and agents, with the changed fields and IP (Business plan). Filter by resource_type (monitor, alert_channel, status_page, member, api_token…), action (monitor.updated, or a prefix like monitor.), from and to (YYYY-MM-DD); pass next as before for older entries. Free.
| Argument | Type | Description |
|---|---|---|
| to | string | |
| from | string | |
| limit | integer | |
| action | string | |
| before | string | |
| resource_type | string |
Input schema (JSON)
{
"type": "object",
"required": [],
"properties": {
"to": {
"type": "string",
"format": "date"
},
"from": {
"type": "string",
"format": "date"
},
"limit": {
"type": "integer",
"maximum": 100,
"minimum": 1
},
"action": {
"type": "string"
},
"before": {
"type": "string"
},
"resource_type": {
"type": "string"
}
},
"additionalProperties": false
}get_incidentOne incident with its timeline (detected, acknowledged, comments, status page updates, recovered), root cause and post-mortem, and the status pages its updates go to with their subscriber counts. Free.
read-only
get_incident
One incident with its timeline (detected, acknowledged, comments, status page updates, recovered), root cause and post-mortem, and the status pages its updates go to with their subscriber counts. Free.
| Argument | Type | Description |
|---|---|---|
| incident_id* | string | Incident ID from list_incidents. |
Input schema (JSON)
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"incident_id": {
"type": "string",
"format": "uuid",
"description": "Incident ID from list_incidents."
}
},
"additionalProperties": false
}get_monitorOne monitor with uptime for 24 hours, 7 days and 30 days, its last 90 days, incident totals, its latest results with errors, recent incidents, and route traces from failing locations (Pro and Business: each hop's loss, round trips and jitter over every round). Free.
read-only
get_monitor
One monitor with uptime for 24 hours, 7 days and 30 days, its last 90 days, incident totals, its latest results with errors, recent incidents, and route traces from failing locations (Pro and Business: each hop's loss, round trips and jitter over every round). Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
}
},
"additionalProperties": false
}get_monitor_resultsA monitor's most recent check results, newest first. Older results may be merged: repeats checks with the same outcome up to last_checked_at. Free.
read-only
get_monitor_results
A monitor's most recent check results, newest first. Older results may be merged: repeats checks with the same outcome up to last_checked_at. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
| limit | integer |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
},
"limit": {
"type": "integer",
"default": 50,
"maximum": 500,
"minimum": 1
}
},
"additionalProperties": false
}get_portsFor a monitor with port_scan on (Business plans): which of its host's addresses are verified and how to verify the rest (a file each address serves, or reverse DNS under the host with a TXT record), the ports the last weekly scan found open, flagged where the service usually should not be public, and the recent scans. Free.
read-only
get_ports
For a monitor with port_scan on (Business plans): which of its host's addresses are verified and how to verify the rest (a file each address serves, or reverse DNS under the host with a TXT record), the ports the last weekly scan found open, flagged where the service usually should not be public, and the recent scans. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
}
},
"additionalProperties": false
}get_sla_reportBusiness plans: availability against an SLA target for a range of days in the workspace's time zone (time_zone in get_account; by default this month), with the downtime budget used and left, incidents, MTTR, MTBF and the longest outage, per monitor (lowest availability first) and overall. The dashboard and the API also give it as a PDF. Free.
read-only
get_sla_report
Business plans: availability against an SLA target for a range of days in the workspace's time zone (time_zone in get_account; by default this month), with the downtime budget used and left, incidents, MTTR, MTBF and the longest outage, per monitor (lowest availability first) and overall. The dashboard and the API also give it as a PDF. Free.
| Argument | Type | Description |
|---|---|---|
| to | string | Last day, YYYY-MM-DD. |
| from | string | First day, YYYY-MM-DD, in the workspace's time zone. |
| target | number | SLA target in percent. |
| monitor_ids | array | Only these monitors; by default all. |
Input schema (JSON)
{
"type": "object",
"required": [],
"properties": {
"to": {
"type": "string",
"format": "date",
"description": "Last day, YYYY-MM-DD."
},
"from": {
"type": "string",
"format": "date",
"description": "First day, YYYY-MM-DD, in the workspace's time zone."
},
"target": {
"type": "number",
"default": 99.9,
"minimum": 1,
"description": "SLA target in percent.",
"exclusiveMaximum": 100
},
"monitor_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"description": "Only these monitors; by default all."
}
},
"additionalProperties": false
}get_uptime_historyA monitor's daily uptime, kept for as long as it exists: checks, successful, failed and average response time per UTC day, oldest first. By default from the first check to today. Free.
read-only
get_uptime_history
A monitor's daily uptime, kept for as long as it exists: checks, successful, failed and average response time per UTC day, oldest first. By default from the first check to today. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
| to | string | Last UTC day, YYYY-MM-DD. |
| from | string | First UTC day, YYYY-MM-DD. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
},
"to": {
"type": "string",
"format": "date",
"description": "Last UTC day, YYYY-MM-DD."
},
"from": {
"type": "string",
"format": "date",
"description": "First UTC day, YYYY-MM-DD."
}
},
"additionalProperties": false
}get_vulnerabilitiesFor an http or api monitor with vulnerability_alerts on: the vulnerabilities and unsupported releases found in the website's software, actively exploited and most severe first, with the version that fixes each, and the software they were matched on (found by scanning the website, imported, or added). Free.
read-only
get_vulnerabilities
For an http or api monitor with vulnerability_alerts on: the vulnerabilities and unsupported releases found in the website's software, actively exploited and most severe first, with the version that fixes each, and the software they were matched on (found by scanning the website, imported, or added). Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
}
},
"additionalProperties": false
}import_softwareTells the monitor what software the website and its server run, so their vulnerabilities are checked. Send a file's contents (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock, mix.lock, composer.json/.lock, requirements.txt, Pipfile.lock, poetry.lock, Gemfile.lock, go.mod, Cargo.lock, pom.xml, .csproj, Dockerfile, docker-compose.yml, .nvmrc, .bun-version, .tool-versions, mise.toml, railpack.json) or a plain list with one item per line as "name version", for example "Debian 12", "nginx 1.24.0", "PHP 8.2.12", "wp-plugin:woocommerce 9.3.3", "npm:lodash 4.17.21". If you can run commands on the server, `cat /etc/os-release`, `nginx -v`, `php -v` and the like give exact versions. Importing the same filename again replaces what it added. Lines that name nothing known are returned as unrecognized. Format and supported files: https://upheron.com/docs/software. Free.
import_software
Tells the monitor what software the website and its server run, so their vulnerabilities are checked. Send a file's contents (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock, mix.lock, composer.json/.lock, requirements.txt, Pipfile.lock, poetry.lock, Gemfile.lock, go.mod, Cargo.lock, pom.xml, .csproj, Dockerfile, docker-compose.yml, .nvmrc, .bun-version, .tool-versions, mise.toml, railpack.json) or a plain list with one item per line as "name version", for example "Debian 12", "nginx 1.24.0", "PHP 8.2.12", "wp-plugin:woocommerce 9.3.3", "npm:lodash 4.17.21". If you can run commands on the server, `cat /etc/os-release`, `nginx -v`, `php -v` and the like give exact versions. Importing the same filename again replaces what it added. Lines that name nothing known are returned as unrecognized. Format and supported files: https://upheron.com/docs/software. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
| name | string | A label such as frontend/package.json, to keep two files with the same name apart. Importing under the same label again replaces it. Defaults to the filename. |
| content* | string | The file's text, or the list. |
| filename | string | The file's name, such as package-lock.json or Dockerfile; tells the format. Leave out for a plain list. |
Input schema (JSON)
{
"type": "object",
"required": [
"id",
"content"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
},
"name": {
"type": "string",
"description": "A label such as frontend/package.json, to keep two files with the same name apart. Importing under the same label again replaces it. Defaults to the filename."
},
"content": {
"type": "string",
"maxLength": 5000000,
"description": "The file's text, or the list."
},
"filename": {
"type": "string",
"description": "The file's name, such as package-lock.json or Dockerfile; tells the format. Leave out for a plain list."
}
},
"additionalProperties": false
}list_escalation_policiesBusiness plans: escalation policies, whose id a monitor's escalation_policy_id takes, and their steps. Free.
read-only
list_escalation_policies
Business plans: escalation policies, whose id a monitor's escalation_policy_id takes, and their steps. Free.
No arguments.
Input schema (JSON)
{
"type": "object",
"required": [],
"properties": {},
"additionalProperties": false
}list_incidentsOutages, newest first, with their status (open, acknowledged, resolved). Free.
read-only
list_incidents
Outages, newest first, with their status (open, acknowledged, resolved). Free.
No arguments.
Input schema (JSON)
{
"type": "object",
"required": [],
"properties": {},
"additionalProperties": false
}list_locationsLocation codes you can pass in a monitor's `locations`.
read-only
list_locations
Location codes you can pass in a monitor's `locations`.
No arguments.
Input schema (JSON)
{
"type": "object",
"required": [],
"properties": {},
"additionalProperties": false
}list_monitorsEvery monitor with its current status (pending, up, down, degraded), and interval. Free.
read-only
list_monitors
Every monitor with its current status (pending, up, down, degraded), and interval. Free.
No arguments.
Input schema (JSON)
{
"type": "object",
"required": [],
"properties": {},
"additionalProperties": false
}list_notification_contactsContacts that receive alerts, whether each is confirmed, and for phone contacts their latest text or call and whether it was delivered.
read-only
list_notification_contacts
Contacts that receive alerts, whether each is confirmed, and for phone contacts their latest text or call and whether it was delivered.
No arguments.
Input schema (JSON)
{
"type": "object",
"required": [],
"properties": {},
"additionalProperties": false
}list_on_call_schedulesBusiness plans: on-call schedules with who is on call now, until when, and who is next. Free.
read-only
list_on_call_schedules
Business plans: on-call schedules with who is on call now, until when, and who is next. Free.
No arguments.
Input schema (JSON)
{
"type": "object",
"required": [],
"properties": {},
"additionalProperties": false
}mark_vulnerability_fixedRecords that the software behind a finding from get_vulnerabilities was upgraded: to `version`, or by default to the first version that fixes it (the finding's fix_version). The monitor is checked again; findings that no longer apply disappear, and one that still applies stays, marked with the version. Only records the version; it does not change the server. Free.
mark_vulnerability_fixed
Records that the software behind a finding from get_vulnerabilities was upgraded: to `version`, or by default to the first version that fixes it (the finding's fix_version). The monitor is checked again; findings that no longer apply disappear, and one that still applies stays, marked with the version. Only records the version; it does not change the server. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
| version | string | The version installed. Leave out for the first version that fixes it. |
| finding_id* | string | The finding's id from get_vulnerabilities. |
Input schema (JSON)
{
"type": "object",
"required": [
"id",
"finding_id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
},
"version": {
"type": "string",
"description": "The version installed. Leave out for the first version that fixes it."
},
"finding_id": {
"type": "string",
"format": "uuid",
"description": "The finding's id from get_vulnerabilities."
}
},
"additionalProperties": false
}open_incidentOpens an incident for what the checks cannot see: a slow service, a problem a customer reported. With a message it publishes the first update on the status pages that show its monitors (and emails their subscribers on Pro plans); alert pages the monitors' contacts once. It stays open until resolve_incident and never counts as downtime. Every plan, at most 20 open. Free.
open_incident
Opens an incident for what the checks cannot see: a slow service, a problem a customer reported. With a message it publishes the first update on the status pages that show its monitors (and emails their subscribers on Pro plans); alert pages the monitors' contacts once. It stays open until resolve_incident and never counts as downtime. Every plan, at most 20 open. Free.
| Argument | Type | Description |
|---|---|---|
| alert | boolean | Alert the monitors' contacts once, and again when it is resolved. Ask the user first. |
| state | string | The first update's state, investigating by default. |
| title* | string | What the dashboard, alerts and status pages call it. |
| message | string | Optional first update for the visitors of the status pages that show the monitors. |
| severity | string | |
| monitor_ids | array | The monitors it affects (GET /monitors): its updates show on the published status pages that show any of them. None or up to 50. |
Input schema (JSON)
{
"type": "object",
"required": [
"title"
],
"properties": {
"alert": {
"type": "boolean",
"description": "Alert the monitors' contacts once, and again when it is resolved. Ask the user first."
},
"state": {
"enum": [
"investigating",
"identified",
"monitoring"
],
"type": "string",
"description": "The first update's state, investigating by default."
},
"title": {
"type": "string",
"maxLength": 120,
"description": "What the dashboard, alerts and status pages call it."
},
"message": {
"type": "string",
"maxLength": 2000,
"description": "Optional first update for the visitors of the status pages that show the monitors."
},
"severity": {
"enum": [
"warning",
"critical"
],
"type": "string",
"default": "critical"
},
"monitor_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"maxItems": 50,
"description": "The monitors it affects (GET /monitors): its updates show on the published status pages that show any of them. None or up to 50."
}
},
"additionalProperties": false
}pause_monitorStops checking a monitor. Free.
pause_monitor
Stops checking a monitor. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
}
},
"additionalProperties": false
}post_incident_updatePublishes an update on every published status page that shows the incident's monitor and in their RSS and Atom feeds, and on Pro plans emails those pages' subscribers. States: investigating, identified, monitoring, resolved. Write for the page's visitors. Free.
post_incident_update
Publishes an update on every published status page that shows the incident's monitor and in their RSS and Atom feeds, and on Pro plans emails those pages' subscribers. States: investigating, identified, monitoring, resolved. Write for the page's visitors. Free.
| Argument | Type | Description |
|---|---|---|
| state* | string | |
| title | string | Optional title on the pages, such as "Slow checkout". |
| message* | string | |
| incident_id* | string | Incident ID from list_incidents. |
Input schema (JSON)
{
"type": "object",
"required": [
"incident_id",
"state",
"message"
],
"properties": {
"state": {
"enum": [
"investigating",
"identified",
"monitoring",
"resolved"
],
"type": "string"
},
"title": {
"type": "string",
"maxLength": 120,
"description": "Optional title on the pages, such as \"Slow checkout\"."
},
"message": {
"type": "string",
"maxLength": 2000
},
"incident_id": {
"type": "string",
"format": "uuid",
"description": "Incident ID from list_incidents."
}
},
"additionalProperties": false
}remove_on_call_overrideRemoves an override from a schedule (its id is in the schedule's overrides). Free.
destructive
remove_on_call_override
Removes an override from a schedule (its id is in the schedule's overrides). Free.
| Argument | Type | Description |
|---|---|---|
| override_id* | string | |
| schedule_id* | string | Schedule ID from list_on_call_schedules. |
Input schema (JSON)
{
"type": "object",
"required": [
"schedule_id",
"override_id"
],
"properties": {
"override_id": {
"type": "string",
"format": "uuid"
},
"schedule_id": {
"type": "string",
"format": "uuid",
"description": "Schedule ID from list_on_call_schedules."
}
},
"additionalProperties": false
}remove_softwareRemoves an entry from get_vulnerabilities' software list. Software the scan found is ignored instead, so the next scan does not add it back. Free.
destructive
remove_software
Removes an entry from get_vulnerabilities' software list. Software the scan found is ignored instead, so the next scan does not add it back. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
| software_id* | string | The entry's id from get_vulnerabilities. |
Input schema (JSON)
{
"type": "object",
"required": [
"id",
"software_id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
},
"software_id": {
"type": "string",
"format": "uuid",
"description": "The entry's id from get_vulnerabilities."
}
},
"additionalProperties": false
}resolve_incidentResolves an incident opened with open_incident; the contacts it alerted hear so. A message is published as the last update on its status pages. Incidents opened by checks resolve with their checks. Free.
resolve_incident
Resolves an incident opened with open_incident; the contacts it alerted hear so. A message is published as the last update on its status pages. Incidents opened by checks resolve with their checks. Free.
| Argument | Type | Description |
|---|---|---|
| message | string | |
| incident_id* | string | Incident ID from list_incidents. |
Input schema (JSON)
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"message": {
"type": "string",
"maxLength": 2000
},
"incident_id": {
"type": "string",
"format": "uuid",
"description": "Incident ID from list_incidents."
}
},
"additionalProperties": false
}resume_monitorStarts checking a paused monitor again. Free.
resume_monitor
Starts checking a paused monitor again. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
}
},
"additionalProperties": false
}scan_portsScans the verified host's common TCP ports now instead of waiting for the weekly scan, at most once an hour. Takes a minute or two; then read get_ports. Free.
scan_ports
Scans the verified host's common TCP ports now instead of waiting for the weekly scan, at most once an hour. Takes a minute or two; then read get_ports. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
}
},
"additionalProperties": false
}scan_website_softwareScans the monitor's website for the software it runs and checks it against the vulnerability sources now, instead of waiting for the next scan. Takes up to a minute; then read get_vulnerabilities. Free.
scan_website_software
Scans the monitor's website for the software it runs and checks it against the vulnerability sources now, instead of waiting for the next scan. Takes up to a minute; then read get_vulnerabilities. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
}
},
"additionalProperties": false
}test_notification_contactSends a contact a test alert, at most 5 a minute for a workspace. For a phone contact it is a real text or call through the user's account, which counts toward its 6 texts or 3 calls an hour; an error says in words what the provider refused (credentials, a trial account's unverified number, the sender).
test_notification_contact
Sends a contact a test alert, at most 5 a minute for a workspace. For a phone contact it is a real text or call through the user's account, which counts toward its 6 texts or 3 calls an hour; an error says in words what the provider refused (credentials, a trial account's unverified number, the sender).
| Argument | Type | Description |
|---|---|---|
| id* | string | Contact ID from add_notification_contact or list_notification_contacts. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Contact ID from add_notification_contact or list_notification_contacts."
}
},
"additionalProperties": false
}update_escalation_policyBusiness plans. Fields left out keep their value; steps replaces them all. Free.
update_escalation_policy
Business plans. Fields left out keep their value; steps replaces them all. Free.
| Argument | Type | Description |
|---|---|---|
| name | string | |
| steps | array | In order; sending steps replaces them all. Each names contacts, schedules or both. |
| policy_id* | string | Policy ID from list_escalation_policies. |
| repeat_count | integer | Times the whole policy runs again when nobody acknowledges. |
Input schema (JSON)
{
"type": "object",
"required": [
"policy_id"
],
"properties": {
"name": {
"type": "string",
"maxLength": 80
},
"steps": {
"type": "array",
"items": {
"type": "object",
"properties": {
"schedule_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"maxItems": 20,
"description": "On-call schedules whose on-call contact it alerts."
},
"wait_minutes": {
"type": "integer",
"default": 10,
"maximum": 1440,
"minimum": 1,
"description": "Minutes to wait for an acknowledgement before the next step."
},
"alert_channel_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"maxItems": 50,
"description": "Notification contacts it alerts."
}
}
},
"maxItems": 10,
"minItems": 1,
"description": "In order; sending steps replaces them all. Each names contacts, schedules or both."
},
"policy_id": {
"type": "string",
"format": "uuid",
"description": "Policy ID from list_escalation_policies."
},
"repeat_count": {
"type": "integer",
"default": 0,
"maximum": 9,
"minimum": 0,
"description": "Times the whole policy runs again when nobody acknowledges."
}
},
"additionalProperties": false
}update_incidentChanges the title status pages show (public_title) or the root cause (Pro plans) of any incident, and the title, severity and monitors of one opened by hand. Fields left out keep their value. Free.
update_incident
Changes the title status pages show (public_title) or the root cause (Pro plans) of any incident, and the title, severity and monitors of one opened by hand. Fields left out keep their value. Free.
| Argument | Type | Description |
|---|---|---|
| title | string | What the dashboard, alerts and status pages call it. |
| severity | string | |
| root_cause | string | null | |
| incident_id* | string | Incident ID from list_incidents. |
| monitor_ids | array | The monitors it affects (GET /monitors): its updates show on the published status pages that show any of them. None or up to 50. |
| public_title | string | null |
Input schema (JSON)
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"title": {
"type": "string",
"maxLength": 120,
"description": "What the dashboard, alerts and status pages call it."
},
"severity": {
"enum": [
"warning",
"critical"
],
"type": "string",
"default": "critical"
},
"root_cause": {
"type": [
"string",
"null"
],
"maxLength": 5000
},
"incident_id": {
"type": "string",
"format": "uuid",
"description": "Incident ID from list_incidents."
},
"monitor_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"maxItems": 50,
"description": "The monitors it affects (GET /monitors): its updates show on the published status pages that show any of them. None or up to 50."
},
"public_title": {
"type": [
"string",
"null"
],
"maxLength": 120
}
},
"additionalProperties": false
}update_monitorChanges a monitor's settings, within the plan's interval and location limits. Free.
update_monitor
Changes a monitor's settings, within the plan's interval and location limits. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
| url | string | URL, or host[:port] for network checks. |
| kind | string | What to check. `heartbeat` and `webhook` wait for your calls instead of probing. `repository` reads a GitHub or GitLab repository's dependency manifests daily and alerts on vulnerabilities in them, on every plan; put the repository URL in `url` (optionally …/tree/branch/folder) and, for a private repository (Pro plan), an access token in `check_options.token`. `websocket` (a ws:// or wss:// URL) and `grpc` (host[:port]) are created on Pro and Business (Free answers `422` with `plan_required`). |
| name | string | Shown in alerts and on status pages. |
| charts | string | Charts on public status pages: uptime bars (the last 90 days, or the whole history), the last 24 hours of response time, or both. |
| method | string | |
| tab_id | string | null | The monitor tab (GET /monitor-tabs) the monitor is sorted into in the dashboard; `null` takes it out of its tab. |
| keyword | string | Text the response body must contain. |
| locations | array | Location codes from GET /locations. Defaults to the first location. |
| port_scan | boolean | Business plans, network and website checks: scan the common TCP ports of the host's verified addresses weekly (POST /monitors/{id}/ports/verify), and alert when a port opens. See /docs/port-scans. |
| ip_version | string | Network and website checks: `auto` connects over IPv4, or IPv6 when the host has no IPv4 address; `ipv4` and `ipv6` use only that. `ipv6` needs locations with IPv6 (`ipv6` in GET /locations). An IP address as the host sets it. |
| timeout_ms | integer | |
| status_page | boolean | Creating only: give the monitor its own published status page while the plan allows more pages. Send `false` when you manage status pages yourself. |
| request_body | string | |
| check_options | object | Kind-specific options, such as `json_path`/`expected_value` for `api`, `steps` for transactions, `warn_days` for ssl. Ports go in `url` as host:port. See /docs/api#check-options. |
| expiry_alerts | boolean | `http` and `api` monitors: check the domain registration and (for HTTPS) the TLS certificate daily. Domain alerts come 30, 14, 7, 3 and 1 days before expiry; certificate alerts only once automatic renewal should have happened (a sixth of the certificate's lifetime, at most 14 days). Uses no extra monitor. |
| repository_url | string | null | Pro and Business, `http` and `api` monitors with vulnerability alerts: the website's GitHub or GitLab repository (optionally …/tree/branch/folder), whose lockfiles and manifests are read hourly for exact versions. A failed read opens no incident. `null` unlinks it and removes what it listed. |
| request_headers | object | Sent with the check; stored encrypted and never returned. |
| interval_seconds | integer | Seconds between checks, no faster than the plan allows (300 on Free, 10 on Pro). |
| repository_token | string | null | Access token for a private `repository_url`: on GitHub a fine-grained token with read-only Contents, on GitLab `read_api`. Stored encrypted and never returned (`repository_token_set` tells whether one is saved). Leave it out to keep it; `null` removes it. |
| alert_channel_ids | array | Notification contacts to alert. Defaults to all of the workspace's contacts. |
| failure_threshold | integer | Failed checks in a row before an incident opens. The default alerts on the first failed check. |
| recovery_threshold | integer | |
| alert_delay_minutes | integer | Pro and Business plans: minutes the first outage alert waits after the incident opens (on top of `failure_threshold`). Nobody is alerted about, or hears the recovery of, an outage that ends sooner. |
| expected_status_max | integer | |
| expected_status_min | integer | |
| escalation_policy_id | string | null | Business plans: alert this escalation policy (GET /escalation-policies) about outages instead of `alert_channel_ids`, which still receive expiry and vulnerability alerts. `null` alerts the contacts. |
| repeat_alert_minutes | integer | null | Pro and Business plans: repeat the outage alert to the monitor's contacts this often until someone acknowledges the incident or it recovers, at most 48 times. `null` sends it once. |
| vulnerability_alerts | boolean | Every plan, `http` and `api` monitors: scan the website for the software it runs (weekly on Free, daily on paid plans) and alert on newly published vulnerabilities in it, checked daily and within 15 minutes of a new advisory (OSV.dev with the GitHub Advisory Database, NVD, new CVE records, WPVulnerability and WordPress core advisories for WordPress, CISA KEV, endoflife.date). |
| confirmation_threshold | integer | Locations that must fail a check at the same time for it to count as failed. 1, the default, is any location; with 2 of 3 locations, one failing location alone is no outage and alerts nobody. More than the monitor's locations counts as all of them. |
| vulnerability_severity | string | The lowest severity that alerts. Actively exploited vulnerabilities and releases reaching end of support always alert. |
| heartbeat_grace_seconds | integer | For heartbeat and webhook monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
},
"url": {
"type": "string",
"description": "URL, or host[:port] for network checks."
},
"kind": {
"enum": [
"http",
"api",
"ssl",
"domain",
"dns",
"blacklist",
"email_auth",
"malware",
"tcp",
"ssh",
"smtp",
"imap",
"pop",
"ftps",
"ping",
"ntp",
"udp",
"minecraft",
"steam",
"websocket",
"grpc",
"transaction",
"micro_transaction",
"extended_transaction",
"group",
"cloud_status",
"page_speed",
"webhook",
"heartbeat",
"repository"
],
"type": "string",
"default": "http",
"description": "What to check. `heartbeat` and `webhook` wait for your calls instead of probing. `repository` reads a GitHub or GitLab repository's dependency manifests daily and alerts on vulnerabilities in them, on every plan; put the repository URL in `url` (optionally …/tree/branch/folder) and, for a private repository (Pro plan), an access token in `check_options.token`. `websocket` (a ws:// or wss:// URL) and `grpc` (host[:port]) are created on Pro and Business (Free answers `422` with `plan_required`)."
},
"name": {
"type": "string",
"maxLength": 160,
"description": "Shown in alerts and on status pages."
},
"charts": {
"enum": [
"both",
"uptime",
"response"
],
"type": "string",
"default": "both",
"description": "Charts on public status pages: uptime bars (the last 90 days, or the whole history), the last 24 hours of response time, or both."
},
"method": {
"enum": [
"GET",
"HEAD",
"POST",
"PUT",
"PATCH",
"DELETE"
],
"type": "string",
"default": "GET"
},
"tab_id": {
"type": [
"string",
"null"
],
"format": "uuid",
"description": "The monitor tab (GET /monitor-tabs) the monitor is sorted into in the dashboard; `null` takes it out of its tab."
},
"keyword": {
"type": "string",
"maxLength": 2000,
"description": "Text the response body must contain."
},
"locations": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 10,
"minItems": 1,
"description": "Location codes from GET /locations. Defaults to the first location."
},
"port_scan": {
"type": "boolean",
"default": false,
"description": "Business plans, network and website checks: scan the common TCP ports of the host's verified addresses weekly (POST /monitors/{id}/ports/verify), and alert when a port opens. See /docs/port-scans."
},
"ip_version": {
"enum": [
"auto",
"ipv4",
"ipv6"
],
"type": "string",
"default": "auto",
"description": "Network and website checks: `auto` connects over IPv4, or IPv6 when the host has no IPv4 address; `ipv4` and `ipv6` use only that. `ipv6` needs locations with IPv6 (`ipv6` in GET /locations). An IP address as the host sets it."
},
"timeout_ms": {
"type": "integer",
"default": 10000,
"maximum": 60000,
"minimum": 500
},
"status_page": {
"type": "boolean",
"default": true,
"writeOnly": true,
"description": "Creating only: give the monitor its own published status page while the plan allows more pages. Send `false` when you manage status pages yourself."
},
"request_body": {
"type": "string",
"maxLength": 65536
},
"check_options": {
"type": "object",
"description": "Kind-specific options, such as `json_path`/`expected_value` for `api`, `steps` for transactions, `warn_days` for ssl. Ports go in `url` as host:port. See /docs/api#check-options."
},
"expiry_alerts": {
"type": "boolean",
"default": true,
"description": "`http` and `api` monitors: check the domain registration and (for HTTPS) the TLS certificate daily. Domain alerts come 30, 14, 7, 3 and 1 days before expiry; certificate alerts only once automatic renewal should have happened (a sixth of the certificate's lifetime, at most 14 days). Uses no extra monitor."
},
"repository_url": {
"type": [
"string",
"null"
],
"description": "Pro and Business, `http` and `api` monitors with vulnerability alerts: the website's GitHub or GitLab repository (optionally …/tree/branch/folder), whose lockfiles and manifests are read hourly for exact versions. A failed read opens no incident. `null` unlinks it and removes what it listed."
},
"request_headers": {
"type": "object",
"description": "Sent with the check; stored encrypted and never returned.",
"additionalProperties": {
"type": "string"
}
},
"interval_seconds": {
"type": "integer",
"default": 300,
"maximum": 86400,
"minimum": 10,
"description": "Seconds between checks, no faster than the plan allows (300 on Free, 10 on Pro)."
},
"repository_token": {
"type": [
"string",
"null"
],
"maxLength": 500,
"writeOnly": true,
"description": "Access token for a private `repository_url`: on GitHub a fine-grained token with read-only Contents, on GitLab `read_api`. Stored encrypted and never returned (`repository_token_set` tells whether one is saved). Leave it out to keep it; `null` removes it."
},
"alert_channel_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"description": "Notification contacts to alert. Defaults to all of the workspace's contacts."
},
"failure_threshold": {
"type": "integer",
"default": 1,
"maximum": 10,
"minimum": 1,
"description": "Failed checks in a row before an incident opens. The default alerts on the first failed check."
},
"recovery_threshold": {
"type": "integer",
"default": 2,
"maximum": 10,
"minimum": 1
},
"alert_delay_minutes": {
"type": "integer",
"default": 0,
"maximum": 1440,
"minimum": 0,
"description": "Pro and Business plans: minutes the first outage alert waits after the incident opens (on top of `failure_threshold`). Nobody is alerted about, or hears the recovery of, an outage that ends sooner."
},
"expected_status_max": {
"type": "integer",
"default": 399
},
"expected_status_min": {
"type": "integer",
"default": 200
},
"escalation_policy_id": {
"type": [
"string",
"null"
],
"format": "uuid",
"description": "Business plans: alert this escalation policy (GET /escalation-policies) about outages instead of `alert_channel_ids`, which still receive expiry and vulnerability alerts. `null` alerts the contacts."
},
"repeat_alert_minutes": {
"type": [
"integer",
"null"
],
"maximum": 1440,
"minimum": 5,
"description": "Pro and Business plans: repeat the outage alert to the monitor's contacts this often until someone acknowledges the incident or it recovers, at most 48 times. `null` sends it once."
},
"vulnerability_alerts": {
"type": "boolean",
"default": false,
"description": "Every plan, `http` and `api` monitors: scan the website for the software it runs (weekly on Free, daily on paid plans) and alert on newly published vulnerabilities in it, checked daily and within 15 minutes of a new advisory (OSV.dev with the GitHub Advisory Database, NVD, new CVE records, WPVulnerability and WordPress core advisories for WordPress, CISA KEV, endoflife.date)."
},
"confirmation_threshold": {
"type": "integer",
"default": 1,
"maximum": 10,
"minimum": 1,
"description": "Locations that must fail a check at the same time for it to count as failed. 1, the default, is any location; with 2 of 3 locations, one failing location alone is no outage and alerts nobody. More than the monitor's locations counts as all of them."
},
"vulnerability_severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string",
"default": "high",
"description": "The lowest severity that alerts. Actively exploited vulnerabilities and releases reaching end of support always alert."
},
"heartbeat_grace_seconds": {
"type": "integer",
"description": "For heartbeat and webhook monitors."
}
},
"additionalProperties": false
}update_on_call_scheduleBusiness plans. Fields left out keep their value; changing the members, rotation, handoff or time zone starts the rotation over. Free.
update_on_call_schedule
Business plans. Fields left out keep their value; changing the members, rotation, handoff or time zone starts the rotation over. Free.
| Argument | Type | Description |
|---|---|---|
| name | string | |
| rotation | string | |
| time_zone | string | An IANA time zone. |
| member_ids | array | Notification contacts (GET /alert-channels) in rotation order. Changing them, the rotation, the handoff or the time zone starts the rotation over with the first member. |
| handoff_day | integer | Weekly handoffs: the weekday, 1 for Monday. |
| schedule_id* | string | Schedule ID from list_on_call_schedules. |
| handoff_time | string | HH:MM on the schedule's own clock. |
Input schema (JSON)
{
"type": "object",
"required": [
"schedule_id"
],
"properties": {
"name": {
"type": "string",
"maxLength": 80
},
"rotation": {
"enum": [
"daily",
"weekly"
],
"type": "string",
"default": "weekly"
},
"time_zone": {
"type": "string",
"default": "Etc/UTC",
"examples": [
"Europe/Berlin"
],
"description": "An IANA time zone."
},
"member_ids": {
"type": "array",
"items": {
"type": "string",
"format": "uuid"
},
"maxItems": 50,
"description": "Notification contacts (GET /alert-channels) in rotation order. Changing them, the rotation, the handoff or the time zone starts the rotation over with the first member."
},
"handoff_day": {
"type": "integer",
"default": 1,
"maximum": 7,
"minimum": 1,
"description": "Weekly handoffs: the weekday, 1 for Monday."
},
"schedule_id": {
"type": "string",
"format": "uuid",
"description": "Schedule ID from list_on_call_schedules."
},
"handoff_time": {
"type": "string",
"default": "09:00",
"examples": [
"09:00"
],
"description": "HH:MM on the schedule's own clock."
}
},
"additionalProperties": false
}verify_hostLooks for the proof of each of the host's addresses from get_ports: the file served at the address, or its reverse DNS (PTR) under the host resolving back to it with the TXT record in place. The TXT record alone proves no address. The proof must stay in place, since every scan checks it again; only covered addresses are scanned. Free.
verify_host
Looks for the proof of each of the host's addresses from get_ports: the file served at the address, or its reverse DNS (PTR) under the host resolving back to it with the TXT record in place. The TXT record alone proves no address. The proof must stay in place, since every scan checks it again; only covered addresses are scanned. Free.
| Argument | Type | Description |
|---|---|---|
| id* | string | Monitor ID from list_monitors. |
Input schema (JSON)
{
"type": "object",
"required": [
"id"
],
"properties": {
"id": {
"type": "string",
"format": "uuid",
"description": "Monitor ID from list_monitors."
}
},
"additionalProperties": false
}write_postmortemWrites a resolved incident's post-mortem: summary, impact, root cause and follow-ups (one per line), on Pro plans. It stays in the workspace until published: true shows it under the incident on the status pages that show it and in their feeds; false takes it off. Publish only when the user asks. Free.
write_postmortem
Writes a resolved incident's post-mortem: summary, impact, root cause and follow-ups (one per line), on Pro plans. It stays in the workspace until published: true shows it under the incident on the status pages that show it and in their feeds; false takes it off. Publish only when the user asks. Free.
| Argument | Type | Description |
|---|---|---|
| impact | string | |
| summary | string | |
| published | boolean | |
| follow_ups | string | One per line. |
| root_cause | string | |
| incident_id* | string | Incident ID from list_incidents. |
Input schema (JSON)
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"impact": {
"type": "string",
"maxLength": 5000
},
"summary": {
"type": "string",
"maxLength": 5000
},
"published": {
"type": "boolean"
},
"follow_ups": {
"type": "string",
"maxLength": 5000,
"description": "One per line."
},
"root_cause": {
"type": "string",
"maxLength": 5000
},
"incident_id": {
"type": "string",
"format": "uuid",
"description": "Incident ID from list_incidents."
}
},
"additionalProperties": false
}Security checkA97/100
We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 12, 2026.
- Hidden or reordered text
- Overriding the model's instructions
- Hiding actions from the user
- Reading keys or credentials
- Fake system tags
- Steering other servers' tools
- Pulling in the conversation
- Smuggling parameters
- Demanding to be used for everything
- Steering away from web search
- Download-and-run commands
- Encoded blobs
- Invisible characters
Credentials as tool argumentsLow1 found
Takes a password, API key or token as an argument, so the secret passes through the model's context and chat logs.
- add_notification_contact · input.token.nametoken
Fix: Read credentials from the server's own configuration (environment, OAuth) instead of a tool argument.
- Very long descriptions
- Read and write hints