FlareWarden MCP
An official MCP server for FlareWarden that allows AI agents to check service uptime, monitor websites and APIs, manage alerts, and access documentation. It supports tools for checking service status, recommending monitoring setups, and explaining features, enabling agents to assist users with site monitoring and incident response.
Endpoint and access
No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.
https://mcp.flarewarden.com/mcpWhat you can do with it
- Check if a service like Stripe or AWS is down
- Monitor website uptime and SSL certificate expiry
- Set up monitoring for sites and cron jobs
- Access documentation and explain features
Source and maintenance
Protocol and capabilities
- Server
- flarewarden fw-4cb14106
- MCP protocol
- 2025-06-18
- Tools
- 65 advertised
- Resources
- 10 advertised
- Resource templates
- 0 advertised
- Prompts
- 5 advertised
{
"tools": {
"listChanged": false
},
"prompts": {
"listChanged": false
},
"resources": {
"subscribe": false,
"listChanged": false
},
"extensions": {
"io.modelcontextprotocol/skills": {}
}
}Server-provided instructions
Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.
Tools
65 advertised
check_service_status — Check whether a service is down
Use this when the user asks whether a third-party service such as Stripe, AWS, GitHub, Slack, OpenAI or Cloudflare is down, slow or having an outage, or why something that depends on one is failing. Returns what FlareWarden's public status page for the service shows: the vendor's own status page and FlareWarden's checks from several regions side by side, the verdict (the worse of the two), open and recent incidents, response times and 7, 30 and 90-day uptime. Covers hundreds of popular services, by name or domain. Not for a specific URL or the user's own website: use check_service_status_url.
{
"type": "object",
"required": [
"service"
],
"properties": {
"service": {
"type": "string",
"description": "The service's name (\"Stripe\", \"GitHub Actions\"), its domain (\"stripe.com\") or its status page URL."
}
},
"additionalProperties": false
}{
"title": "Check whether a service is down",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}check_service_status_url — Check whether a website is down
Use this when the user asks whether a specific website, URL or API endpoint is down, unreachable or slow: "is my site down or is it just me?", "is api.example.com reachable from Europe?". Requests the URL once from six regions (Ashburn, San Jose, London, Frankfurt, Singapore and Sydney) and returns each region's result (up, down, blocked or inconclusive), status code and timings, with an overall verdict. A host is checked at most once every 5 minutes; a repeat returns that result and its age. Never returns page content. Not for named third-party services like Stripe or AWS: use check_service_status, which also reads the vendor's own status page. Not for a site the user monitors with FlareWarden: diagnose_site checks it from every region FlareWarden checks from, as its own monitoring.
{
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "The website or endpoint to check, such as https://example.com or api.example.com/health. Query strings are ignored."
}
},
"additionalProperties": false
}{
"title": "Check whether a website is down",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}recommend_monitoring — Recommend what to monitor for a website
Use this when the user asks what they should monitor for a website, what could take their site down, or which third-party services (hosting, CDN, DNS, payments, email, analytics) a site depends on, and when someone with no FlareWarden account asks what monitoring a site would get before signing up. Reads the site's DNS records, home page and certificate and checks it from six regions. Returns the services it recognizes with the evidence for each and their status now, the certificate's expiry, a DNS summary, whether the site is up now, the page checks that would work on it, and what FlareWarden would create and how many monitors that is, on each FlareWarden plan. Needs no sign-in and stores nothing about the user; results are cached per site for a day. Not for whether a site is up right now on its own: use check_service_status_url. Not for creating monitoring: once the user is signed in, the account tools plan and create it. What it detects is documented at https://flarewarden.com/docs/smart-setup.
{
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"description": "The website to analyze, such as https://example.com or example.com."
}
},
"additionalProperties": false
}{
"title": "Recommend what to monitor for a website",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}explain_features — Explain FlareWarden's features and plans
Use this when the user asks what FlareWarden can do or what it costs: "can FlareWarden watch cron jobs?", "how do you confirm an outage?", "what does a status page cost?", SSL certificate expiry, DNS changes, heartbeats, third-party dependencies, SLA and uptime reports, maintenance windows, alerts to Slack. Returns a catalogue of features (what each does, when it helps, how it works, its limits and plans) and the plans with their prices and limits. Pass a topic to get only the matching features; leave it out for all of them.
{
"type": "object",
"properties": {
"topic": {
"type": "string",
"description": "Optional: what the user asked about, such as \"cron jobs\", \"status page pricing\" or \"false alarms\"."
}
},
"additionalProperties": false
}{
"title": "Explain FlareWarden's features and plans",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}search_help — Search FlareWarden's help docs
Use this when the user asks how to do something in FlareWarden, such as adding a custom domain to a status page, sending alerts to Slack, adding a cron job heartbeat, allowlisting probe IPs or inviting a teammate. Searches the documentation at flarewarden.com/docs and returns the best-matching passages with links to their pages.
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"maximum": 10,
"minimum": 1,
"description": "How many passages to return (default 5)."
},
"query": {
"type": "string",
"description": "The question or keywords, in the user's words."
}
},
"additionalProperties": false
}{
"title": "Search FlareWarden's help docs",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}get_account_overview — Get the account overview
Use this when starting any conversation about the user's own FlareWarden account, or when they ask what is wrong, what needs attention, or what they could set up next. It needs that account: on a connection not yet signed in, the call starts FlareWarden sign-in. Returns who is connected (account, plan, role, permissions), how much monitor room is left, sites by status, open incidents with how they were confirmed, an attention list worst-first, and up to three suggestions. Not for someone with no FlareWarden account who wants a site monitored. Not for another company's service status: use check_service_status.
{
"type": "object",
"properties": {},
"additionalProperties": false
}{
"title": "Get the account overview",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}get_usage — Get plan usage and limits
Use this when the user asks how many monitors they have left, what their plan includes, or why they cannot add more. Returns the monitor pool (used, allowed, left; websites, child checks and anomaly detection), status pages, seats, webhooks, subscribers, history kept and the fastest check interval. Not for which sites are down: use get_account_overview or list_sites.
{
"type": "object",
"properties": {},
"additionalProperties": false
}{
"title": "Get plan usage and limits",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}list_sites — List monitored sites
Use this when the user asks which websites or APIs they monitor, which are down, slow or paused, or what is in a group. Returns each site's status, last check, response time, 24-hour uptime, group, interval and SSL days left, filtered and paged. Not for one site's detail: use get_site.
{
"type": "object",
"properties": {
"text": {
"type": "string",
"description": "Only sites whose name or URL contains this."
},
"group": {
"type": "string",
"description": "Only sites in this group (exact name)."
},
"limit": {
"type": "integer",
"maximum": 100,
"minimum": 1,
"description": "Sites per page (default 50)."
},
"cursor": {
"type": "string",
"description": "The next_cursor of a previous page."
},
"status": {
"enum": [
"up",
"down",
"degraded",
"paused",
"pending",
"maintenance"
],
"type": "string",
"description": "Only sites in this state."
}
},
"additionalProperties": false
}{
"title": "List monitored sites",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}get_site — Get one site
Use this when the user asks about one of their websites or APIs: is it up, why is it down, what is checked on it, when its certificate or domain expires. Returns status and last check; its content checks, dependencies and cron jobs (children, each with when it last and next runs, and a check's interval); SSL and domain expiry; anomaly detection; maintenance now and in the next 7 days; and open incidents; with include, its DNS records and DNS watches, the subdomains found in certificate logs, or the certificates those logs list for its domain and which issuers it expects. Not for past checks or uptime over a range: use get_monitor_history or get_report.
{
"type": "object",
"required": [
"site"
],
"properties": {
"site": {
"type": "string",
"description": "The site's id, name or part of its URL."
},
"include": {
"type": "array",
"items": {
"enum": [
"dns",
"subdomains",
"certificates"
],
"type": "string"
},
"description": "Extra sections: dns (the site's records and its DNS watches), subdomains (names found in certificate logs), certificates (certificates those logs list for the site's domain, and its certificate alert)."
}
},
"additionalProperties": false
}{
"title": "Get one site",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}get_monitor_history — Get recent checks
Use this when the user asks what a site's recent checks, response times or failures looked like, or how a cron job, content check or dependency has been running. Returns the most recent checks of the site, or of one of its content checks, dependencies or cron jobs (runs, durations, late or failed runs), newest first. Not for uptime percentages or totals over a range: use get_report.
{
"type": "object",
"required": [
"site"
],
"properties": {
"to": {
"type": "string",
"description": "Instead of range: where the window ends, a date (the whole day is included) or RFC 3339."
},
"from": {
"type": "string",
"description": "Instead of range: where the window starts, a date such as 2026-07-01 (in your time zone) or RFC 3339. Goes with to. A window is at most 90 days, within the history your plan keeps."
},
"site": {
"type": "string",
"description": "The site's id, name or part of its URL."
},
"check": {
"type": "string",
"description": "A content check, dependency or cron job on the site, by id or name. Leave out for the site's own uptime checks."
},
"limit": {
"type": "integer",
"maximum": 100,
"minimum": 1,
"description": "Most checks to return (default 25)."
},
"range": {
"enum": [
"24h",
"7d",
"30d"
],
"type": "string",
"description": "How far back (default 24h)."
}
},
"additionalProperties": false
}{
"title": "Get recent checks",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}get_report — Get an uptime report
Use this when the user wants an uptime, SLA or incident report for a site, a group (an agency's client) or the whole account, for a week, month or quarter. Returns uptime over the time FlareWarden measured (unknown is shown as unknown), downtime minutes (the time that uptime counts as down), degraded minutes (affected but up, not downtime), incident count, longest incident and mean time to recover, response time p50 and p95, and certificate and domain expiry; for one site, also uptime, downtime and degraded time by day, response times over the range and each incident. Not for the latest checks: use get_monitor_history.
{
"type": "object",
"required": [
"scope"
],
"properties": {
"to": {
"type": "string",
"description": "Instead of range: where the window ends, a date (the whole day is included) or RFC 3339."
},
"from": {
"type": "string",
"description": "Instead of range: where the window starts, a date such as 2026-07-01 (in your time zone) or RFC 3339. Goes with to. A window is at most 90 days, within the history your plan keeps."
},
"site": {
"type": "string",
"description": "For scope site: the site's id, name or part of its URL."
},
"group": {
"type": "string",
"description": "For scope group: the group's exact name."
},
"range": {
"enum": [
"24h",
"7d",
"30d",
"90d"
],
"type": "string",
"description": "How far back (default 30d). Clamped to the history your plan keeps."
},
"scope": {
"enum": [
"site",
"group",
"account"
],
"type": "string",
"description": "What the report covers."
}
},
"additionalProperties": false
}{
"title": "Get an uptime report",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}list_incidents — List incidents and maintenance
Use this when the user asks what went down, whether anything is down now, what happened last night or this month, or what maintenance is planned. Returns incidents (open or resolved, with how each was confirmed) or maintenance windows, for one site, a group or the account, newest first. Not for one incident's full evidence: use get_incident.
{
"type": "object",
"properties": {
"to": {
"type": "string",
"description": "Instead of range: where the window ends, a date (the whole day is included) or RFC 3339."
},
"from": {
"type": "string",
"description": "Instead of range: where the window starts, a date such as 2026-07-01 (in your time zone) or RFC 3339. Goes with to. A window is at most 90 days, within the history your plan keeps."
},
"kind": {
"enum": [
"incident",
"maintenance"
],
"type": "string",
"description": "Incidents or maintenance windows (default incident)."
},
"site": {
"type": "string",
"description": "Only this site: its id, name or part of its URL."
},
"group": {
"type": "string",
"description": "Only sites in this group (exact name)."
},
"limit": {
"type": "integer",
"maximum": 100,
"minimum": 1,
"description": "Most items to return (default 25)."
},
"range": {
"enum": [
"24h",
"7d",
"30d",
"90d"
],
"type": "string",
"description": "How far back (default 30d). Clamped to the history your plan keeps."
},
"status": {
"enum": [
"open",
"resolved",
"all"
],
"type": "string",
"description": "Open, resolved or both (default all)."
}
},
"additionalProperties": false
}{
"title": "List incidents and maintenance",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}get_incident — Get an incident with its evidence
Use this when the user asks whether an outage was real, how it was confirmed, when it started and ended, what else it affected, or who was told. Returns the incident with its evidence: the regions that confirmed it and how, which region failed first and when, false alarms overturned around it, checks rolled into it, its updates, and who was notified (member emails, webhook deliveries, status page subscriber notices). Also what was happening outside the site at that time, with a one-line finding: the site's dependency checks by region, and for each third-party service it relies on, what the vendor's status page reported and what FlareWarden's own checks of that service recorded. Not for listing incidents: use list_incidents.
{
"type": "object",
"required": [
"site",
"incident"
],
"properties": {
"site": {
"type": "string",
"description": "The incident's site: its id, name or part of its URL."
},
"incident": {
"type": "string",
"description": "The incident id, from list_incidents or get_site."
}
},
"additionalProperties": false
}{
"title": "Get an incident with its evidence",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}diagnose_site — Diagnose a site now
Use this when one of the user's own sites is down, failing from some places, slow or alerting, and they want to know why right now, or want it checked from everywhere: "why is shop.acme.com down?", "is it failing everywhere or just in Asia?", "is our site reachable from every region?", "is it our certificate?". Requests the site once from every region FlareWarden checks from and returns each region's result, status code, DNS, connect, TLS and first-byte times, where a failure stopped, and the certificate's issuer and expiry, with a one-line finding such as "fails only from Singapore: TLS handshake timed out". At most 10 an hour for one site; a repeat within a minute returns the same result. Never returns page content. Not for past outages or why a site keeps alerting: use get_incident or review_noise. Not for a site outside the user's FlareWarden account: use check_service_status_url.
{
"type": "object",
"required": [
"site"
],
"properties": {
"site": {
"type": "string",
"description": "The site: its id, name or part of its URL."
}
},
"additionalProperties": false
}{
"title": "Diagnose a site now",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}review_coverage — Review what is not monitored
Use this when the user asks what they are not monitoring, what could break without them knowing, whether their monitoring is complete, or what to set up next. Returns the gaps in what the user can see, worst first, each with the tool that fixes it and, where the user may turn that suggestion off, the dismiss_suggestion key: services FlareWarden found a site relying on that no dependency watches, certificates expiring within 30 days (tracked subdomains included), sites on no status page, sites whose alerts reach one person or nobody, and monitors paused for weeks. Changes nothing in the account. A site whose services FlareWarden has not looked at in the last week has its DNS records and home page read in the background, and a later call includes what that finds. Not for what is down now: use get_account_overview.
{
"type": "object",
"properties": {
"site": {
"type": "string",
"description": "Only this site: its id, name or part of its URL."
},
"group": {
"type": "string",
"description": "Only sites in this group (exact name)."
}
},
"additionalProperties": false
}{
"title": "Review what is not monitored",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}review_noise — Review noisy monitors
Use this when the user asks why a site keeps alerting, which monitors are noisy or flapping, whether alerts were false alarms, or how to get fewer pointless alerts: "why does FlareWarden keep emailing us about the API?", "which of our monitors are flaky?". Returns, over the last 7 and 30 days for the sites the user can see, worst first: alerts for outages the next check found over, content checks, dependencies and cron jobs that alert often, anomaly alerts, sites whose status keeps changing, and failed checks other regions overturned as false alarms (by region); each with a suggested change and the tool that makes it. Changes nothing. Not for what is down now: use get_account_overview or diagnose_site. Not for what is not monitored: use review_coverage.
{
"type": "object",
"properties": {
"site": {
"type": "string",
"description": "Only this site: its id, name or part of its URL."
},
"group": {
"type": "string",
"description": "Only sites in this group (exact name)."
}
},
"additionalProperties": false
}{
"title": "Review noisy monitors",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}list_status_pages — List status pages
Use this when the user asks about their public status pages: which they have, their addresses, how many subscribers, or whether a custom domain works. Returns each page with its public URL, custom domain state, component and subscriber counts, and the plan's page limit. Not for another company's status: use check_service_status.
{
"type": "object",
"properties": {},
"additionalProperties": false
}{
"title": "List status pages",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}get_status_page — Get one status page
Use this when the user asks what one of their status pages shows, which sites and checks are on it, or why its custom domain is not working. Returns the page with its components in order (with the ids the component tools take), its public URL, its subscriber count, and its custom domain's DNS record, verification and certificate state. Not for incidents posted on it: use list_incidents.
{
"type": "object",
"required": [
"status_page"
],
"properties": {
"status_page": {
"type": "string",
"description": "The page's id or name."
}
},
"additionalProperties": false
}{
"title": "Get one status page",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}list_team — List the team
Use this when the user asks who has access to the account, what roles people have, who was invited, or how many seats are left. Returns members with role, scope, the sites shared with them and when they joined and were last active (on the website or through an AI agent), pending invitations with the role or sites each gives, and seats used and allowed. Owners and admins only. Not for who was alerted about an incident: use get_incident.
{
"type": "object",
"properties": {},
"additionalProperties": false
}{
"title": "List the team",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}search_service_catalog — Search the services FlareWarden can watch
Use this when the user asks whether FlareWarden can watch a third-party service their site depends on (a payment provider, cloud, CDN, email or auth service). Returns matching services with their category and status page, and FlareWarden's public status page when there is one. Not for whether a service is down now: use check_service_status.
{
"type": "object",
"required": [
"query"
],
"properties": {
"query": {
"type": "string",
"description": "The service's name, such as Stripe or AWS."
}
},
"additionalProperties": false
}{
"title": "Search the services FlareWarden can watch",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}invite_member — Invite someone to the account
Use this when the user wants to give a person access to their FlareWarden account: a teammate at a role (admin, editor or viewer), or a client who should see only some sites (a monitor-only invitation with sites). Emails the person an invitation link and returns exactly who was emailed; inviting the same address again replaces its pending invitation of the same kind (a site invitation only one for exactly the same sites) and emails it again. Owners and admins only; an admin cannot invite an admin. Not for changing the role of someone already on the team: use change_member_role.
{
"type": "object",
"required": [
"email"
],
"properties": {
"role": {
"enum": [
"admin",
"editor",
"viewer"
],
"type": "string",
"description": "For an account invitation: admin (everything but billing), editor (manages monitors in their scope) or viewer (sees everything and gets alerts). Leave out for a monitor-only invitation."
},
"email": {
"type": "string",
"description": "The address to invite, exactly as the user gave it."
},
"level": {
"enum": [
"view",
"edit"
],
"type": "string",
"description": "For a monitor-only invitation: view (default) or edit."
},
"scope": {
"enum": [
"all",
"monitors",
"content",
"dependencies"
],
"type": "string",
"description": "For an account invitation: which monitors the role covers. Default all."
},
"sites": {
"type": "array",
"items": {
"type": "string"
},
"description": "For a monitor-only invitation: the sites to share, each by id, name or part of its URL. The person sees only these sites."
},
"site_checks": {
"enum": [
"all",
"content",
"dependencies"
],
"type": "string",
"description": "For a monitor-only invitation: which checks of each site are shared. Default all."
},
"idempotency_key": {
"type": "string",
"description": "Optional. Send the same key again after a lost reply and the change is not made twice."
}
},
"additionalProperties": false
}{
"title": "Invite someone to the account",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}revoke_invitation — Cancel an invitation
Use this when the user wants to withdraw an invitation that has not been accepted yet. Returns which invitation was cancelled; the link in its email stops working and nobody is emailed. Owners and admins only. Not for removing someone who already joined: that is done in the dashboard, and the result gives the link.
{
"type": "object",
"required": [
"invitation"
],
"properties": {
"invitation": {
"type": "string",
"description": "The invitation's id (from list_team) or the invited email address."
}
},
"additionalProperties": false
}{
"title": "Cancel an invitation",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}change_member_role — Change a member's role
Use this when the user wants a team member to have a different role (admin, editor or viewer) or to cover different monitors. Returns the member's old and new role; FlareWarden emails the member about the change. Owners and admins only: nobody changes their own role or the owner's, and only the owner changes an admin's. Not for inviting someone new (use invite_member) or removing a member (done in the dashboard).
{
"type": "object",
"required": [
"member",
"role"
],
"properties": {
"role": {
"enum": [
"admin",
"editor",
"viewer"
],
"type": "string",
"description": "The new role: admin (everything but billing), editor (manages monitors in their scope) or viewer (sees everything and gets alerts)."
},
"scope": {
"enum": [
"all",
"monitors",
"content",
"dependencies"
],
"type": "string",
"description": "Which monitors the role covers. Leave out to keep the member's current scope (all for a monitor-only member)."
},
"member": {
"type": "string",
"description": "The member's email address, or their user id from list_team."
}
},
"additionalProperties": false
}{
"title": "Change a member's role",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": true
}change_member_access — Change which sites a member can see
Use this when the user wants a monitor-only member, such as a client, to see more of the account's sites, to view or edit a site they can see, or to stop seeing one. Returns the sites the member can see after the change. A site is added at once, with no invitation or email; removing one asks the user to type the site's name where the client can show a form, as the team page does. Owners and admins only. Not for someone not on the team (use invite_member), an account-level member (change_member_role changes their role; the website makes one monitor-only only by removing them in the dashboard and inviting them again with sites), or a member's last site, whose removal removes them from the team (done in the dashboard).
{
"type": "object",
"required": [
"member",
"sites",
"access"
],
"properties": {
"sites": {
"type": "array",
"items": {
"type": "string"
},
"description": "The sites to change, each by id, name or part of its URL. To remove, one site."
},
"access": {
"enum": [
"view",
"edit",
"remove"
],
"type": "string",
"description": "view or edit: the member sees, or edits, these sites; a site they could not see is added. remove: they stop seeing the site."
},
"member": {
"type": "string",
"description": "The member's email address, or their user id from list_team."
}
},
"additionalProperties": false
}{
"title": "Change which sites a member can see",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}rename_account — Rename the account
Use this when the user wants the FlareWarden account's own name changed: the name its members see in the sidebar and account switcher, and invitations carry. Renames it as the Account page does and returns the old and new name. Owners and admins only. Not for a site's name (use update_monitor) or a status page's (use update_status_page).
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "The new name, 1 to 100 characters."
}
},
"additionalProperties": false
}{
"title": "Rename the account",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}get_my_notifications — Get my alert emails
Use this when the user asks which alert emails they get from FlareWarden, or before changing them. Returns their own switches for this account: monitor_down (a monitor goes down), monitor_recovered (a monitor comes back up), ssl_expiring (warnings before an SSL certificate expires, at the ssl_expiry_warning_days), domain_expiring (reminders before a site's domain registration expires), certificate_changed (a site's SSL/TLS certificate has been replaced), issuer_changed (a certificate for the site's domain from an issuer it does not expect appears in public Certificate Transparency logs), ssl_tls_changes (protocol version or cipher suite changes), dns_failures (one switch for DNS resolution failures, changes to a site's DNS records and alerts from the DNS records the user watches), performance_anomalies (an unusual slowdown while the monitor is still up, for monitors with anomaly detection on); the master email switch; and their SSL expiry warning days. Not for webhooks or Slack, Discord, Google Chat and Microsoft Teams alerts: use list_webhooks.
{
"type": "object",
"properties": {},
"additionalProperties": false
}{
"title": "Get my alert emails",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}update_my_notifications — Change my alert emails
Use this when the user wants FlareWarden to email them more or fewer kinds of alert, pause or resume all alert emails, or change when SSL expiry warnings arrive. Changes only the settings given, for the user alone, and returns all of them after the change. Not for teammates' alerts, webhooks or chat channels.
{
"type": "object",
"properties": {
"dns_failures": {
"type": "boolean",
"description": "Email the user about DNS Failures and Changes."
},
"email_alerts": {
"type": "boolean",
"description": "The master switch: false pauses every alert email to the user from this account."
},
"monitor_down": {
"type": "boolean",
"description": "Email the user about Monitor Down."
},
"ssl_expiring": {
"type": "boolean",
"description": "Email the user about SSL Certificate Expiring."
},
"issuer_changed": {
"type": "boolean",
"description": "Email the user about Certificate Issuer Changed."
},
"domain_expiring": {
"type": "boolean",
"description": "Email the user about Domain Expiring."
},
"ssl_tls_changes": {
"type": "boolean",
"description": "Email the user about SSL/TLS Changes."
},
"ssl_urgent_days": {
"type": "integer",
"maximum": 365,
"minimum": 1,
"description": "Second SSL expiry warning, in days (1-365). At least the critical days."
},
"ssl_warning_days": {
"type": "integer",
"maximum": 365,
"minimum": 1,
"description": "First SSL expiry warning, in days before expiry (1-365). At least the urgent days."
},
"monitor_recovered": {
"type": "boolean",
"description": "Email the user about Monitor Recovered."
},
"ssl_critical_days": {
"type": "integer",
"maximum": 365,
"minimum": 1,
"description": "Last SSL expiry warning, in days (1-365)."
},
"certificate_changed": {
"type": "boolean",
"description": "Email the user about Certificate Changed."
},
"performance_anomalies": {
"type": "boolean",
"description": "Email the user about Performance Anomalies."
}
},
"additionalProperties": false
}{
"title": "Change my alert emails",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}list_webhooks — List webhooks and chat alerts
Use this when the user asks where FlareWarden sends alerts besides email: their webhooks and Slack, Discord, Google Chat or Microsoft Teams channels, which events and sites each covers, and whether deliveries are failing. Returns each destination with its host (never the full URL, which often carries a credential), events, sites, active or paused, and delivery health. Owners and admins only. Not for the user's own alert emails: use get_my_notifications.
{
"type": "object",
"properties": {},
"additionalProperties": false
}{
"title": "List webhooks and chat alerts",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}list_webhook_deliveries — List a webhook's deliveries
Use this when the user asks whether a webhook or chat channel got a particular alert, why one is failing, or what was sent to it lately. Returns its latest deliveries, newest first: each one's event, when, whether it arrived, the HTTP status, how long it took, which attempt it was and, for a failure, what went wrong in a few words. Never the payload or what the endpoint answered. Not for the account's webhooks as a whole (use list_webhooks) or sending one again (use retry_webhook_delivery).
{
"type": "object",
"required": [
"webhook"
],
"properties": {
"limit": {
"type": "integer",
"maximum": 50,
"minimum": 1,
"description": "How many deliveries, newest first. Default 20."
},
"webhook": {
"type": "string",
"description": "The webhook's id (from list_webhooks) or its name."
}
},
"additionalProperties": false
}{
"title": "List a webhook's deliveries",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}add_webhook — Add a webhook
Use this when the user wants FlareWarden to send alert events to their own HTTPS endpoint (a generic, signed JSON webhook), or to connect Slack, Discord, Google Chat or Microsoft Teams. For an endpoint: creates the webhook and returns a one-time link where the user sees its signing secret (the secret never appears in the chat). For a chat destination: returns the page where the user pastes the channel's webhook URL, which works as a password and is never a tool argument. Owners and admins only. Not for the user's own alert emails: use update_my_notifications. The webhook format, events and signature are documented at https://flarewarden.com/docs/alerts/webhooks.
{
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "For destination custom: the HTTPS endpoint. Never a Slack, Discord, Google Chat or Microsoft Teams URL."
},
"name": {
"type": "string",
"description": "A name for the webhook, as the Webhooks page lists it."
},
"sites": {
"type": "array",
"items": {
"type": "string"
},
"description": "Limit the webhook to these sites, each by id, name or part of its URL. Leave out for every site."
},
"events": {
"type": "array",
"items": {
"enum": [
"incident.started",
"incident.recovered",
"ssl.expiring",
"ssl.expired",
"ssl.changed",
"ssl.issued",
"dns.failed",
"dns.recovered",
"dns.changed",
"domain.expiring",
"domain.expired",
"monitor.created",
"monitor.deleted",
"monitor.paused",
"monitor.resumed",
"maintenance.started",
"maintenance.completed",
"maintenance.cancelled",
"cron.failed",
"cron.late",
"anomaly.detected",
"anomaly.resolved"
],
"type": "string"
},
"description": "For destination custom, required: the events to send, at least one, such as incident.started and incident.recovered (the Webhooks page asks for them too)."
},
"destination": {
"enum": [
"custom",
"slack",
"discord",
"googlechat",
"teams"
],
"type": "string",
"description": "custom (default): the user's own HTTPS endpoint. slack, discord, googlechat or teams (Microsoft Teams): returns the page to connect that channel."
},
"idempotency_key": {
"type": "string",
"description": "Optional. Send the same key again after a lost reply and the change is not made twice."
}
},
"additionalProperties": false
}{
"title": "Add a webhook",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}update_webhook — Change a webhook
Use this when the user wants a webhook or chat channel to get different alerts: rename it, change the events or sites it is sent, turn it off or on, or move a custom webhook to a new URL. Changes it as the Webhooks page's edit does and returns it as it is now; only the fields given change. Turning one on is held to the plan's active webhooks. Owners and admins only. Not for a chat channel's URL, its request headers or its signing secret, which stay on the Webhooks page, or for adding one (use add_webhook). The webhook format, events and signature are documented at https://flarewarden.com/docs/alerts/webhooks.
{
"type": "object",
"required": [
"webhook"
],
"properties": {
"url": {
"type": "string",
"description": "For a custom webhook only: the new https endpoint."
},
"name": {
"type": "string",
"description": "A new name."
},
"sites": {
"type": "array",
"items": {
"type": "string"
},
"description": "Send it only these sites' events, each by id, name or part of its URL."
},
"events": {
"type": "array",
"items": {
"type": "string"
},
"description": "The events it is sent, replacing the current ones, such as incident.started and incident.recovered (list_webhooks shows each webhook's; a chat channel is never sent monitor, maintenance or cron events)."
},
"enabled": {
"type": "boolean",
"description": "False turns it off (nothing is sent until it is turned on), true turns it on."
},
"webhook": {
"type": "string",
"description": "The webhook's id (from list_webhooks) or its name."
},
"every_site": {
"type": "boolean",
"description": "True sends it every site's events again."
}
},
"additionalProperties": false
}{
"title": "Change a webhook",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}test_webhook — Send a test to a webhook
Use this when the user wants to check that a webhook or chat channel receives FlareWarden's alerts. Sends one test event to the destination now, records the delivery, and returns whether it arrived and the HTTP status. Owners and admins only. Not for the delivery history of real alerts: use list_webhook_deliveries.
{
"type": "object",
"required": [
"webhook"
],
"properties": {
"webhook": {
"type": "string",
"description": "The webhook's id (from list_webhooks) or its name."
}
},
"additionalProperties": false
}{
"title": "Send a test to a webhook",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}retry_webhook_delivery — Send a webhook delivery again
Use this when the user wants a delivery a webhook or chat channel missed sent again, once the endpoint is fixed. Sends the same event again as a new attempt, as the Webhooks page's Retry does, and returns whether it arrived and the HTTP status. Owners and admins only. Not for a test event (use test_webhook).
{
"type": "object",
"required": [
"webhook",
"delivery"
],
"properties": {
"webhook": {
"type": "string",
"description": "The webhook's id (from list_webhooks) or its name."
},
"delivery": {
"type": "string",
"description": "The delivery's id, from list_webhook_deliveries."
}
},
"additionalProperties": false
}{
"title": "Send a webhook delivery again",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}search_audit_log — Search the audit log
Use this when the user asks who changed something in the account and when: who paused a site, who invited someone, what an AI agent did. Returns entries newest first with the time, the member, the action, what it changed and, for changes made through an AI agent, which one (via). Owners and admins only. Not for monitoring history or incidents: use get_monitor_history or list_incidents.
{
"type": "object",
"properties": {
"to": {
"type": "string",
"description": "Only entries on or before this date, YYYY-MM-DD."
},
"from": {
"type": "string",
"description": "Only entries on or after this date, YYYY-MM-DD."
},
"page": {
"type": "integer",
"maximum": 1000,
"minimum": 1,
"description": "Page of results, 25 a page. Default 1."
},
"text": {
"type": "string",
"description": "Words to find in the entry: a site or member name, an email address, an action such as \"paused\"."
},
"action": {
"type": "string",
"description": "Only this action, as entries name it (for example monitor.pause or invitation.create)."
},
"member": {
"type": "string",
"description": "Only changes made by this member, by email address."
}
},
"additionalProperties": false
}{
"title": "Search the audit log",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}plan_site — Plan monitoring for websites
Use this when the user wants FlareWarden to monitor a website or API they run, or up to 50 of them at once. Returns a plan: what each site runs on (hosting, CDN, cloud regions, payments and other services, found from its DNS and page), which automatic page checks hold on it now, and the decisions to put to the user with recommendations and their cost in monitors. Changes nothing; call again with the plan id and the user's answers. Not for adding a check to a site already monitored: use plan_dependency, plan_content_check or plan_cron_monitor.
{
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "The site's URL, such as https://acme.com, for one site."
},
"name": {
"type": "string",
"description": "The site's name, for one site; the host name by default."
},
"urls": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 50,
"description": "Up to 50 site URLs, for adding many at once."
},
"group": {
"type": "string",
"description": "A group to put the sites in."
},
"answers": {
"type": "object",
"description": "The user's answers, by decision id: services, checks, interval, group, anomaly, fit, exclude_sites, and deps.<service>.* for a service's configuration. Also timeout, never asked: the seconds each site's checks wait for an answer (5, 10, 15 or 30; 10 unless given), longer for a page that is slow but up."
},
"plan_id": {
"type": "string",
"description": "An earlier plan_site plan's id, to read it again or answer its decisions."
},
"from_workspace": {
"type": "array",
"items": {
"type": "object",
"required": [
"service",
"source"
],
"properties": {
"kind": {
"enum": [
"hosting",
"cloud",
"cdn",
"dns",
"database",
"payments",
"sign-in",
"email",
"search",
"storage",
"other"
],
"type": "string",
"description": "For a service the catalogue does not list: what it does for the site."
},
"source": {
"type": "string",
"description": "The file the service was found in, relative to the workspace, such as fly.toml or infra/main.tf."
},
"regions": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 10,
"description": "Region ids the site uses for this service, such as iad, us-east-1 or europe-west1."
},
"service": {
"type": "string",
"description": "The service's name in FlareWarden's catalogue, such as Fly.io, AWS, Stripe or Turso (search_service_catalog finds it), or the service's own name when the catalogue does not list it."
},
"status_page_url": {
"type": "string",
"description": "For a service the catalogue does not list: its public status page, or a public URL that answers while it is up. At most 5 a plan."
}
},
"additionalProperties": false
},
"maxItems": 20,
"description": "For one site only: services the site uses that are visible in the user's own workspace and not from outside, such as its infrastructure config, package manifests or environment variable names. Each is a service by its FlareWarden catalogue name, the regions it runs in as region ids, and the file it was found in; a service the catalogue does not list also needs its kind and status page. Names, regions, file paths and status pages only: no values, secrets or file contents. They are pre-selected in the plan and labelled as the assistant's; the user still confirms."
},
"component_query": {
"type": "string",
"description": "Searches a dependency's long component list (more than 50) by name."
},
"accept_recommended": {
"type": "boolean",
"description": "True when the user asked FlareWarden to choose: every open decision that has a recommendation takes it."
}
},
"additionalProperties": false
}{
"title": "Plan monitoring for websites",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}create_site — Create the planned sites
Use this when the user has confirmed a plan_site plan and its cost. Returns what was created for each site (the site, its page checks and dependencies, with ids), anything left out because the plan filled up, and what to set up next. Spends the monitors the plan priced. Safe to repeat: the same plan id returns the first result. Not for a plan the user has not seen: show them plan_site's summary first.
{
"type": "object",
"required": [
"plan_id",
"confirm"
],
"properties": {
"confirm": {
"type": "string",
"description": "The plan's confirm sentence, exactly as returned; show it to the user first."
},
"plan_id": {
"type": "string",
"description": "The plan_site plan's id."
}
},
"additionalProperties": false
}{
"title": "Create the planned sites",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}plan_dependency — Plan a dependency
Use this when the user wants FlareWarden to watch a third-party service a site relies on (a cloud provider, CDN, payment, email or auth service), either while planning a new site or for a site already monitored. A service FlareWarden's catalogue does not list is watched through its status page (url), or a URL checked over plain HTTP. Returns how the service will be watched (its status page integration, or a plain HTTP check), its cost in monitors against the room the plan has left, then the decisions one step at a time: regions (recommended from the site's DNS), which components count, then, once they are chosen, how serious each one's failure is; the interval is the recommended one unless the user names another. Credentials such as an API token are entered on a secure link it returns, never in the chat. Changes nothing. Not for checking whether a service is down right now: use check_service_status.
{
"type": "object",
"properties": {
"url": {
"type": "string",
"description": "The service's status page, or a URL to check over plain HTTP, when the user gave one."
},
"site": {
"type": "string",
"description": "A site already monitored, by id, name or part of its URL, to add the dependency to."
},
"answers": {
"type": "object",
"description": "The user's answers, by decision id (deps.<service>.regions, .components, .severity.<component>, .interval, .url), or service when choosing among detected ones."
},
"plan_id": {
"type": "string",
"description": "A plan_site plan (with dependency, the service's key from it) or an earlier plan_dependency plan."
},
"regions": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 10,
"description": "Region ids the site runs in for this service, such as iad or us-east-1, when the user's code or the user says so: the service's locations there are recommended."
},
"dependency": {
"type": "string",
"description": "The service: its key from a plan_site plan, or its name, such as Stripe or AWS, or a service the catalogue does not list (with url). On a one-site plan_site plan, a service detection did not find is added to the plan."
},
"integration": {
"enum": [
"better_stack",
"checkly",
"pulsetic",
"updown_io",
"xitoring",
"freshstatus",
"adminlabs",
"statuscast"
],
"type": "string",
"description": "The integration to use when the user said which (their own monitoring's status page)."
},
"component_query": {
"type": "string",
"description": "Searches a long component list (more than 50) by name."
},
"accept_recommended": {
"type": "boolean",
"description": "True when the user asked FlareWarden to choose: every open decision that has a recommendation takes it. Never covers credentials."
}
},
"additionalProperties": false
}{
"title": "Plan a dependency",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}add_dependency — Add the planned dependency
Use this when the user has confirmed a plan_dependency plan for a site already monitored. Returns the dependency created, with its id and how it is watched. Spends one monitor. Safe to repeat: the same plan id returns the first result. Not for a dependency inside a plan_site plan: create_site adds those with the site.
{
"type": "object",
"required": [
"plan_id",
"confirm"
],
"properties": {
"confirm": {
"type": "string",
"description": "The plan's confirm sentence, exactly as returned; show it to the user first."
},
"plan_id": {
"type": "string",
"description": "The plan_dependency plan's id."
}
},
"additionalProperties": false
}{
"title": "Add the planned dependency",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}apply_dependency_change — Change a dependency's components
Use this when the user has confirmed a plan_dependency plan that changes which components of a dependency the site already watches, or how serious each is. Returns the dependency as it now watches. Spends no monitors. Safe to repeat: the same plan id returns the first result. Not for adding a dependency the site does not watch yet: add_dependency adds one.
{
"type": "object",
"required": [
"plan_id",
"confirm"
],
"properties": {
"confirm": {
"type": "string",
"description": "The plan's confirm sentence, exactly as returned; show it to the user first."
},
"plan_id": {
"type": "string",
"description": "The plan_dependency plan's id."
}
},
"additionalProperties": false
}{
"title": "Change a dependency's components",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}plan_content_check — Plan a content check
Use this when the user wants FlareWarden to watch what a page of their site says or shows: that a text or button is there, an error message is not, a price stays in a range, or the page changes. Returns the check tried against the live page right now (passes or not) and where the page holds its text, or the automatic checks that hold there when no check is named; any check of the site that already looks for the same text; its cost in monitors against the room the plan has left; and the decisions to put to the user: how serious a failure is and how often to check. Changes nothing. Not for whether the site is up: plan_site watches that.
{
"type": "object",
"properties": {
"max": {
"type": "number",
"description": "For numeric_range or element_count: the highest value allowed."
},
"min": {
"type": "number",
"description": "For numeric_range or element_count: the lowest value allowed."
},
"name": {
"type": "string",
"description": "A name for the check."
},
"page": {
"type": "string",
"description": "The page's path on the site, such as /pricing; the home page by default."
},
"site": {
"type": "string",
"description": "The site, by id, name or part of its URL."
},
"text": {
"type": "string",
"description": "The text (or, for regex, the pattern) the check looks for."
},
"answers": {
"type": "object",
"description": "The user's answers, by decision id: check, severity, interval, name."
},
"plan_id": {
"type": "string",
"description": "An earlier plan_content_check plan, to change it or answer its decisions."
},
"selector": {
"type": "string",
"description": "A CSS selector narrowing where to look, such as #buy-button (no :has()); an empty string clears it. A plan of a text with no selector lists each place the page shows it, with a selector for each; a failing selector shows what it holds and where the page shows the text; a plan with neither, or whose text or selector finds nothing, outlines the page: its headings with the buttons and links under each."
},
"attribute": {
"type": "string",
"description": "For attribute_check: the attribute to read."
},
"check_type": {
"enum": [
"presence",
"absence",
"regex",
"element_count",
"attribute_check",
"numeric_range",
"change_detection"
],
"type": "string",
"description": "What to check."
},
"case_sensitive": {
"type": "boolean",
"description": "Match the text's case exactly."
},
"accept_recommended": {
"type": "boolean",
"description": "True when the user asked FlareWarden to choose."
}
},
"additionalProperties": false
}{
"title": "Plan a content check",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}add_content_check — Add the planned content check
Use this when the user has confirmed a plan_content_check plan. Returns the content check created, with its id. Spends one monitor. Safe to repeat: the same plan id returns the first result. Not for changing an existing check: use update_monitor.
{
"type": "object",
"required": [
"plan_id",
"confirm"
],
"properties": {
"confirm": {
"type": "string",
"description": "The plan's confirm sentence, exactly as returned; show it to the user first."
},
"plan_id": {
"type": "string",
"description": "The plan_content_check plan's id."
}
},
"additionalProperties": false
}{
"title": "Add the planned content check",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}plan_cron_monitor — Plan a cron job monitor
Use this when the user wants to know if a scheduled job, backup, queue worker or other background task stops running, runs late or fails. Returns the schedule understood (with the next five runs in the user's time zone), its cost in monitors against the room the plan has left, and the decisions to put to the user: when the job runs, if the schedule given could not be read; then how late is too late (with a recommended grace period), the longest normal run and how serious a miss is. Cron expressions are read in UTC: there is no time zone setting. Changes nothing. Not for checking a website or API endpoint: use plan_site.
{
"type": "object",
"properties": {
"job": {
"type": "string",
"description": "What the job is, as the user put it, such as nightly backup."
},
"site": {
"type": "string",
"description": "The site the job belongs to, by id, name or part of its URL."
},
"answers": {
"type": "object",
"description": "The user's answers, by decision id: schedule, interval, grace, max_run, severity."
},
"plan_id": {
"type": "string",
"description": "An earlier plan_cron_monitor plan, to change it or answer its decisions."
},
"schedule": {
"type": "string",
"description": "When it runs: a cron expression (read in UTC), every N minutes, hours or days, or heartbeat for a process that checks in."
},
"accept_recommended": {
"type": "boolean",
"description": "True when the user asked FlareWarden to choose."
}
},
"additionalProperties": false
}{
"title": "Plan a cron job monitor",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}add_cron_monitor — Add the planned cron job monitor
Use this when the user has confirmed a plan_cron_monitor plan. Returns the job's ping URL and ready-to-paste code for crontab, start/complete/fail reporting, GitHub Actions, a Kubernetes CronJob and a systemd timer. Spends one monitor. Safe to repeat: the same plan id returns the first result and the same URL. Not for changing an existing job's schedule: use update_monitor.
{
"type": "object",
"required": [
"plan_id",
"confirm"
],
"properties": {
"confirm": {
"type": "string",
"description": "The plan's confirm sentence, exactly as returned; show it to the user first."
},
"plan_id": {
"type": "string",
"description": "The plan_cron_monitor plan's id."
}
},
"additionalProperties": false
}{
"title": "Add the planned cron job monitor",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}update_monitor — Change a monitor's settings
Use this when the user wants to change how a site or one of its checks is watched: a site's name, interval, timeout or group; a content check's text, selector, page, kind, attribute, limits, description, severity or interval; a dependency's name, description, severity or interval, and a plain HTTP dependency's URL and expected text; a cron job's schedule, grace period, longest run, description or severity. Returns the settings now in force. Only the fields given change. Not for pausing (use set_monitor_paused), deleting (the dashboard does that), or a dependency's components (plan it again with plan_dependency). Each setting is documented at https://flarewarden.com/docs/monitors.
{
"type": "object",
"required": [
"site"
],
"properties": {
"max": {
"type": "number",
"description": "A content check's highest value allowed, for numeric_range or element_count."
},
"min": {
"type": "number",
"description": "A content check's lowest value allowed, for numeric_range or element_count."
},
"url": {
"type": "string",
"description": "A plain HTTP dependency's URL; a status page dependency is changed with plan_dependency."
},
"name": {
"type": "string",
"description": "The site's new name, or with check, the check's."
},
"page": {
"type": "string",
"description": "A content check's page path."
},
"site": {
"type": "string",
"description": "The site, by id, name or part of its URL."
},
"text": {
"type": "string",
"description": "A content check's text or pattern."
},
"check": {
"type": "string",
"description": "One of the site's content checks, dependencies or cron jobs, by id or name; leave out to change the site itself."
},
"grace": {
"type": "integer",
"maximum": 86400,
"minimum": 0,
"description": "A cron job's grace period in seconds."
},
"group": {
"type": "string",
"description": "A site's group; an empty string removes it."
},
"match": {
"enum": [
"contains",
"not_contains",
"regex"
],
"type": "string",
"description": "How expected_text is matched. Default contains."
},
"max_run": {
"type": "integer",
"maximum": 86400,
"minimum": 0,
"description": "A cron job's longest normal run in seconds; 0 turns it off."
},
"timeout": {
"type": "integer",
"maximum": 30,
"minimum": 5,
"description": "Seconds a site's checks wait for an answer before they count as failed (5, 10, 15 or 30; 10 unless changed). A longer one lets a slow page pass."
},
"interval": {
"type": "integer",
"maximum": 3600,
"minimum": 30,
"description": "Seconds between checks (30, 60, 300, 600, 1800 or 3600, as the plan allows)."
},
"schedule": {
"type": "string",
"description": "A cron job's schedule: a cron expression (UTC), every N minutes, hours or days, or heartbeat."
},
"selector": {
"type": "string",
"description": "A content check's CSS selector."
},
"severity": {
"enum": [
"critical",
"degraded",
"notify_only"
],
"type": "string",
"description": "How serious a failure is."
},
"attribute": {
"type": "string",
"description": "A content check's attribute to read, for attribute_check."
},
"check_type": {
"enum": [
"presence",
"absence",
"regex",
"element_count",
"attribute_check",
"numeric_range",
"change_detection"
],
"type": "string",
"description": "A content check's kind."
},
"description": {
"type": "string",
"description": "A check's description."
},
"expected_text": {
"type": "string",
"description": "A plain HTTP dependency's text its answer must hold (or, with match, must not hold or match); an empty string stops checking it."
},
"case_sensitive": {
"type": "boolean",
"description": "Whether a content check matches case exactly."
}
},
"additionalProperties": false
}{
"title": "Change a monitor's settings",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}set_monitor_paused — Pause or resume a monitor
Use this when the user wants to stop or restart checks of a site or one of its checks, for example during planned work. Returns the new state and what it means: pausing a site stops its checks, content checks and dependencies, holds its DNS watch alerts, and resolves its open automatic incidents, but its cron jobs keep alerting until each is paused; pausing frees no room on the plan; resuming must fit the plan's active monitors. Not for scheduling maintenance windows or deleting a monitor: those are in the dashboard.
{
"type": "object",
"required": [
"site",
"paused"
],
"properties": {
"site": {
"type": "string",
"description": "The site, by id, name or part of its URL."
},
"check": {
"type": "string",
"description": "One of the site's content checks, dependencies or cron jobs, by id or name; leave out for the whole site."
},
"paused": {
"type": "boolean",
"description": "True to pause, false to resume."
}
},
"additionalProperties": false
}{
"title": "Pause or resume a monitor",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}plan_bulk_pause — Plan pausing or resuming several sites
Use this when the user wants to pause or resume several sites at once: a group, a list of sites, or every site, for example during a migration or a move to a new host. Returns exactly which sites would change, which are already paused or running, and which can't be changed (no permission, shared from another account, or no room on the plan to resume), with a plan id. Changes nothing. Not for one site or one of its checks (use set_monitor_paused), or for planned work with an end time on one site (draft_maintenance).
{
"type": "object",
"properties": {
"all": {
"type": "boolean",
"description": "True for every site the user can change."
},
"group": {
"type": "string",
"description": "Every site in this group."
},
"sites": {
"type": "array",
"items": {
"type": "string"
},
"description": "Sites by id, name or part of their URL, up to 100."
},
"paused": {
"type": "boolean",
"description": "True to pause, false to resume."
},
"answers": {
"type": "object",
"description": "The user's answers, by decision id: which sites a name that matched several means."
},
"plan_id": {
"type": "string",
"description": "An earlier plan_bulk_pause plan, to answer its decisions."
}
},
"additionalProperties": false
}{
"title": "Plan pausing or resuming several sites",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}apply_bulk_pause — Pause or resume the planned sites
Use this when the user has confirmed a plan_bulk_pause plan. Returns each site's outcome: paused or resumed, already so, or refused with the website's reason (a resume that does not fit the plan's running monitors is refused, the others still go ahead). Safe to repeat: the same plan id returns the first result. Not for deciding which sites: call plan_bulk_pause first.
{
"type": "object",
"required": [
"plan_id",
"confirm"
],
"properties": {
"confirm": {
"type": "string",
"description": "The plan's confirm sentence, exactly as returned; show it to the user first."
},
"plan_id": {
"type": "string",
"description": "The plan_bulk_pause plan's id."
}
},
"additionalProperties": false
}{
"title": "Pause or resume the planned sites",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}set_anomaly_detection — Turn anomaly detection on or off
Use this when the user wants FlareWarden to alert on unusual response times of a site, or unusual run times of a cron job, or to stop doing so or change how sensitive it is. Returns whether it is on, its sensitivity, and its recent anomalies. Turning it on costs one monitor; turning it off frees it. It learns for 3 days before reporting. Not for ordinary up or down alerts, which every monitor sends.
{
"type": "object",
"required": [
"site",
"enabled"
],
"properties": {
"site": {
"type": "string",
"description": "The site, by id, name or part of its URL."
},
"check": {
"type": "string",
"description": "A cron job on the site, by id or name; leave out for the site's response times."
},
"enabled": {
"type": "boolean",
"description": "True to turn it on (or change sensitivity), false to turn it off."
},
"sensitivity": {
"enum": [
"low",
"normal",
"high"
],
"type": "string",
"description": "low (fewer alerts), normal or high."
}
},
"additionalProperties": false
}{
"title": "Turn anomaly detection on or off",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}dismiss_anomaly — Mark an anomaly as expected
Use this when the user says an unusual response or run time was expected (a deploy, a sale, a migration). Returns the anomaly's new state. A dismissed anomaly no longer counts and is left out of future baselines; dismissed false restores it. Not for turning anomaly detection off: use set_anomaly_detection.
{
"type": "object",
"required": [
"site",
"event"
],
"properties": {
"note": {
"type": "string",
"description": "Why it was expected, up to 200 characters."
},
"site": {
"type": "string",
"description": "The site, by id, name or part of its URL."
},
"event": {
"type": "integer",
"maximum": 9007199254740992,
"minimum": 1,
"description": "The anomaly's event number, from set_anomaly_detection or get_site."
},
"dismissed": {
"type": "boolean",
"description": "False to restore a dismissed anomaly; true by default."
}
},
"additionalProperties": false
}{
"title": "Mark an anomaly as expected",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}track_subdomain_certificate — Track a subdomain's certificate
Use this when the user wants FlareWarden to watch the TLS certificate of a subdomain it found under a site (from public certificate logs), or to stop. Returns the subdomain's tracking state and, when tracking starts, its certificate's issuer and expiry. A tracked subdomain gets a daily certificate check and expiry alerts, at no cost to the plan. Not for checking the subdomain itself is up: plan it as a site with plan_site.
{
"type": "object",
"required": [
"site",
"subdomain"
],
"properties": {
"site": {
"type": "string",
"description": "The site the subdomain was found under, by id, name or part of its URL."
},
"tracked": {
"type": "boolean",
"description": "False to stop tracking; true by default."
},
"subdomain": {
"type": "string",
"description": "The subdomain, such as api.acme.com, or its id."
}
},
"additionalProperties": false
}{
"title": "Track a subdomain's certificate",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}plan_dns_watch — Plan a DNS watch
Use this when the user wants to know if DNS records under one of their sites change or stop resolving: their MX records, _dmarc, SPF, or the CNAME a subdomain points at (such as www pointing at Vercel). Returns the name's values today for the record types asked (or all of them), and the decisions to put to the user: which record types, and whether to alert when the values change or when the name stops resolving. Watches cost no monitors; a site can have 20. Changes nothing. Not for the site's own uptime, DNS health or certificate: FlareWarden checks those already.
{
"type": "object",
"properties": {
"host": {
"type": "string",
"description": "The name to watch: a label under the site's domain (www, _dmarc, mail), @ for the domain itself, or a full name such as mail.acme.com."
},
"site": {
"type": "string",
"description": "The site whose domain the name is under, by id, name or part of its URL."
},
"answers": {
"type": "object",
"description": "The user's answers, by decision id: record_types, alert_on."
},
"plan_id": {
"type": "string",
"description": "An earlier plan_dns_watch plan, to answer its decisions."
},
"record_types": {
"type": "array",
"items": {
"type": "string"
},
"description": "The record types to watch: A, AAAA, CNAME, MX, TXT, NS or CAA. Leave out to see them all and decide."
},
"accept_recommended": {
"type": "boolean",
"description": "True when the user asked FlareWarden to choose."
}
},
"additionalProperties": false
}{
"title": "Plan a DNS watch",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}add_dns_watch — Add the planned DNS watch
Use this when the user has confirmed a plan_dns_watch plan. Returns the watch with the values it starts from. It costs no monitors. Safe to repeat: the same plan id returns the first result. Not for removing or changing a watch: that is done on the site's DNS page, which the result links.
{
"type": "object",
"required": [
"plan_id",
"confirm"
],
"properties": {
"confirm": {
"type": "string",
"description": "The plan's confirm sentence, exactly as returned; show it to the user first."
},
"plan_id": {
"type": "string",
"description": "The plan_dns_watch plan's id."
}
},
"additionalProperties": false
}{
"title": "Add the planned DNS watch",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}dismiss_suggestion — Stop a suggestion
Use this when the user says not to suggest something again: a status page, an alert channel, inviting a teammate, cron monitoring, subdomains or anomaly detection. Returns which suggestion is off. It stays off for this member in every assistant's conversations; the dashboard's own prompts are dismissed on the dashboard. Not for declining once: leaving a suggestion unanswered is enough.
{
"type": "object",
"required": [
"suggestion"
],
"properties": {
"suggestion": {
"enum": [
"status_page",
"alert_channel",
"invite",
"cron",
"subdomains",
"anomaly"
],
"type": "string",
"description": "The suggestion's key, as results give it."
}
},
"additionalProperties": false
}{
"title": "Stop a suggestion",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": true
}plan_status_page — Plan a status page
Use this when the user wants a public status page for their customers, made from one of their sites or empty. Returns a suggested address (with free alternatives when one is taken), the branding found on the site, the components the page would show grouped as the editor groups them, what the plan allows (components per page, custom domains), and the decisions for the user: the address, which of the site's services to show, and whether to publish. Changes nothing. Not for another company's status: use check_service_status.
{
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "The page's name, if the user gave one."
},
"slug": {
"type": "string",
"description": "The page's address, if the user gave one: the part before .status.flarewarden.com."
},
"answers": {
"type": "object",
"description": "The user's answers, by decision id: name, slug, dependencies (ids to show), publish (true once the user confirms creating the public page)."
},
"plan_id": {
"type": "string",
"description": "An earlier plan_status_page plan, to answer its decisions."
},
"from_site": {
"type": "string",
"description": "The site to make the page from, by id, name or part of its URL. Leave out for an empty page."
},
"brand_color": {
"type": "string",
"description": "The user's brand colour as #rrggbb, if they gave one: the page's colours are made from it instead of the colour found on the site. A page made from a site only."
},
"accept_recommended": {
"type": "boolean",
"description": "True when the user asked FlareWarden to choose. It never publishes: that needs the user's yes."
}
},
"additionalProperties": false
}{
"title": "Plan a status page",
"readOnlyHint": true,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}create_status_page — Create the planned status page
Use this when the user has confirmed a plan_status_page plan, including publishing it. Returns the new page's public address and what it shows. The page is public as soon as it is created. Safe to repeat: the same plan id returns the first result and never a second page. Not for changing an existing page: use update_status_page.
{
"type": "object",
"required": [
"plan_id",
"confirm"
],
"properties": {
"confirm": {
"type": "string",
"description": "The plan's confirm sentence, exactly as returned; show it to the user first."
},
"plan_id": {
"type": "string",
"description": "The plan_status_page plan's id."
}
},
"additionalProperties": false
}{
"title": "Create the planned status page",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}update_status_page — Change a status page's settings
Use this when the user wants to change an existing status page's name, description or custom domain, its colours or logo, what it displays (time zone, incident history, uptime days, subscribe form), or its search title and description. Changes one section at a time (general, branding, display or seo) with the editor's own checks and returns the section as saved; setting a custom domain returns the DNS record to create. The page's address (slug) never changes. Not for the services it shows: use add_status_page_component or update_status_page_component.
{
"type": "object",
"required": [
"status_page",
"section",
"fields"
],
"properties": {
"fields": {
"type": "object",
"description": "Only the settings to change. general: name, description (the same field as seo's meta_description: saving either sets both), custom_domain (\"\" removes it). branding: header_bg_color, header_text_color, header_link_color, header_link_hover_color, footer_bg_color, footer_text_color, footer_link_color, footer_link_hover_color, subscribe_button_bg_color, subscribe_button_hover_color, subscribe_button_text_color (hex like #10b981; \"\" is the default), body_gradient (teal, purple, blue, amber, orange, slate), logo_url, favicon_url (\"\" removes), hide_name_with_logo. display: timezone (IANA, such as America/New_York), uptime_days (30, 60, 90), default_time_range (24h, 7d, 30d, 60d, 90d), incident_history (calendar, list, none), incident_days (7, 14, 30, 90), default_view (uptime, performance), show_performance, show_subscribe_form, show_powered_by, show_upcoming_maintenance, maintenance_days (3, 7, 14, 30). seo: page_title (up to 70 characters), meta_description (up to 160; the same field as general's description)."
},
"section": {
"enum": [
"general",
"branding",
"display",
"seo"
],
"type": "string",
"description": "Which settings to change."
},
"status_page": {
"type": "string",
"description": "The page's id, name or address."
}
},
"additionalProperties": false
}{
"title": "Change a status page's settings",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": true
}add_status_page_component — Add a site or group to a status page
Use this when the user wants another of their sites, or a group heading, shown on one of their status pages. Returns what was added: a site with the checks chosen under it, placed in a group if one is named. A site already on the page gains only the checks it did not show, and a group that exists is not added twice. Not for creating a page: use plan_status_page.
{
"type": "object",
"required": [
"status_page"
],
"properties": {
"name": {
"type": "string",
"description": "The name visitors see; the site's name when left out. Required for a group."
},
"site": {
"type": "string",
"description": "The site to show, by id, name or part of its URL. Leave out to add a group heading named name."
},
"group": {
"type": "string",
"description": "The group heading to put the site under, by name or id; created when the page has none of that name."
},
"children": {
"type": "array",
"items": {
"type": "string"
},
"description": "Only these of the site's checks, by id or name."
},
"description": {
"type": "string",
"description": "Optional text visitors see under the name."
},
"status_page": {
"type": "string",
"description": "The page's id, name or address."
},
"include_children": {
"type": "boolean",
"description": "True to show every content check, dependency and cron job of the site under it."
}
},
"additionalProperties": false
}{
"title": "Add a site or group to a status page",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}update_status_page_component — Change a status page component
Use this when the user wants a service or group on one of their status pages renamed, described differently, moved into or out of a group, or moved up or down. Returns the component as saved and the page's components in order. Not for taking one off the page: use remove_status_page_component.
{
"type": "object",
"required": [
"status_page",
"component"
],
"properties": {
"name": {
"type": "string",
"description": "The new name visitors see."
},
"group": {
"type": "string",
"description": "The group to move it into, by name or id; \"\" moves it out of its group to the top level."
},
"order": {
"type": "integer",
"maximum": 1000,
"minimum": 0,
"description": "Its position within its group, or the top level: 0 is first."
},
"component": {
"type": "string",
"description": "The component's id or name, as get_status_page lists them."
},
"description": {
"type": "string",
"description": "The new text under the name; \"\" removes it."
},
"status_page": {
"type": "string",
"description": "The page's id, name or address."
}
},
"additionalProperties": false
}{
"title": "Change a status page component",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": true
}remove_status_page_component — Remove a component from a status page
Use this when the user wants a site, check or group heading taken off one of their public status pages. A site goes with its own content, dependency and cron rows, wherever they are placed. A group goes alone and its items move to the top level where it was, unless group_contents is remove, which takes everything in it off the page too. The sites and checks themselves stay monitored. Returns what was removed and the page's components after. Not for deleting a site, a check or the page itself, which is done in the dashboard.
{
"type": "object",
"required": [
"status_page",
"component"
],
"properties": {
"component": {
"type": "string",
"description": "The component's id or name, as get_status_page lists them."
},
"status_page": {
"type": "string",
"description": "The page's id, name or address."
},
"group_contents": {
"enum": [
"keep",
"remove"
],
"type": "string",
"description": "For a group only. keep (the default): only the group goes, and its items stay on the page at the top level where it was. remove: everything in the group comes off the page too, each item as removing it alone would (a site with its check rows)."
}
},
"additionalProperties": false
}{
"title": "Remove a component from a status page",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": true
}draft_incident_post — Draft a status page incident post
Use this when the user wants to tell customers about a problem on one of their sites: declare a new incident, post an update on one, or resolve one. Returns the exact text, every status page it will appear on, how many subscribers, members and webhooks will be notified, and any conflict (such as an incident already open on that site), with a draft id. Posts nothing. Not for reading what happened: use get_incident.
{
"type": "object",
"required": [
"kind",
"site"
],
"properties": {
"kind": {
"enum": [
"new",
"update",
"resolve"
],
"type": "string",
"description": "new declares an incident, update posts on an open one, resolve closes one."
},
"site": {
"type": "string",
"description": "The site: its id, name or part of its URL."
},
"title": {
"type": "string",
"description": "For new (needed, as on the Incidents tab): the incident's public title, as the user wants it shown."
},
"status": {
"enum": [
"investigating",
"identified",
"monitoring",
"postmortem"
],
"type": "string",
"description": "For update: where the incident stands. Default: its latest status. A new incident always starts as investigating."
},
"message": {
"type": "string",
"description": "For new (needed): the first public message. For update: the update. For resolve: an optional closing message."
},
"incident": {
"type": "string",
"description": "For update or resolve: the incident's id (list_incidents gives it). Leave out when the site has one open incident."
},
"severity": {
"enum": [
"critical",
"degraded",
"notify_only"
],
"type": "string",
"description": "For new: critical (an outage: the site shows Down and the time counts as downtime), degraded (slow, or part of the site), or notify_only (shown, never counted as downtime, no subscriber email). Default critical, as the Incidents tab's form starts."
},
"components": {
"type": "array",
"items": {
"type": "string"
},
"description": "For new: what the incident is about: site for the site itself (the default), or a dependency, content check or cron job of it by name or id. The first check named decides the incident's type."
},
"internal_only": {
"type": "boolean",
"description": "For update: a note only the team sees; no status page shows it and nobody is emailed."
}
},
"additionalProperties": false
}{
"title": "Draft a status page incident post",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}publish_incident_post — Publish a drafted incident post
Use this when the user has approved a draft_incident_post draft's exact text and recipients. Posts it as the dashboard's Incidents tab does: it shows on the status pages and FlareWarden emails the subscribers, members and webhooks the draft named. Returns the incident. Safe to repeat: the same draft id posts once and returns the first result. Not for changing the text: make a new draft.
{
"type": "object",
"required": [
"draft_id",
"confirm"
],
"properties": {
"confirm": {
"type": "string",
"description": "The plan's confirm sentence, exactly as returned; show it to the user first."
},
"draft_id": {
"type": "string",
"description": "The draft's id from draft_incident_post (it starts with pl_)."
}
},
"additionalProperties": false
}{
"title": "Publish a drafted incident post",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": true
}draft_maintenance — Draft a maintenance window
Use this when the user plans work on a site (a deploy, an upgrade, a migration) and wants it marked as maintenance, once or on a schedule, optionally telling status page subscribers. Returns the window in the user's time zone (and the next occurrences of a recurring one), the status pages it shows on and how many subscribers would be emailed, with a draft id. Schedules nothing. Not for an outage that is already happening: use draft_incident_post.
{
"type": "object",
"required": [
"site",
"title",
"when",
"duration_minutes"
],
"properties": {
"days": {
"type": "array",
"items": {
"type": "string"
},
"description": "For weekly or biweekly: the weekdays, such as saturday. Default: the weekday of when's date."
},
"site": {
"type": "string",
"description": "The site: its id, name or part of its URL."
},
"when": {
"type": "string",
"description": "When it starts: a date and time such as 2026-11-02 02:00 (read in timezone), or RFC 3339. For a recurring window, the time of day such as 02:00."
},
"title": {
"type": "string",
"description": "What the work is, as subscribers will read it."
},
"weekday": {
"enum": [
"sunday",
"monday",
"tuesday",
"wednesday",
"thursday",
"friday",
"saturday"
],
"type": "string",
"description": "For monthly on a weekday: the day."
},
"timezone": {
"type": "string",
"description": "The IANA time zone the time is in, such as Europe/London. Default: the user's own zone."
},
"recurrence": {
"enum": [
"none",
"daily",
"weekly",
"biweekly",
"monthly"
],
"type": "string",
"description": "none (once, the default), daily, weekly, biweekly or monthly."
},
"description": {
"type": "string",
"description": "Optional details shown with the window."
},
"day_of_month": {
"type": "integer",
"maximum": 31,
"minimum": 1,
"description": "For monthly on a date: the day, 1 to 31."
},
"week_of_month": {
"enum": [
"first",
"second",
"third",
"fourth",
"last"
],
"type": "string",
"description": "For monthly on a weekday: which one."
},
"duration_minutes": {
"type": "integer",
"maximum": 720,
"minimum": 1,
"description": "How long it lasts, 1 to 720 minutes (12 hours)."
},
"notify_subscribers": {
"type": "boolean",
"description": "Email the status page subscribers about it. Only when the user asks; default false."
}
},
"additionalProperties": false
}{
"title": "Draft a maintenance window",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}schedule_maintenance — Schedule a drafted maintenance window
Use this when the user has approved a draft_maintenance draft. Schedules it as the dashboard's Maintenance page does: it shows on the status pages, and subscribers are emailed only if the draft said so. Returns the window and its id. Safe to repeat: the same draft id schedules once. Not for changing a window already scheduled: update_maintenance moves, extends, renames or ends it.
{
"type": "object",
"required": [
"draft_id",
"confirm"
],
"properties": {
"confirm": {
"type": "string",
"description": "The plan's confirm sentence, exactly as returned; show it to the user first."
},
"draft_id": {
"type": "string",
"description": "The draft's id from draft_maintenance (it starts with pl_)."
}
},
"additionalProperties": false
}{
"title": "Schedule a drafted maintenance window",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}update_maintenance — Change a maintenance window
Use this when the user wants to change planned or running maintenance: end it early or start it now, extend or move it, rename it, or pause or resume a recurring schedule. Changes it as the dashboard's Maintenance page does and returns the window as it is now. A window that asked to tell subscribers emails them as the page's would: the new time when a one-time window moves, and that it started or ended. Not for new work (use draft_maintenance), calling it off (use cancel_maintenance) or an outage (use draft_incident_post).
{
"type": "object",
"required": [
"site",
"maintenance",
"action"
],
"properties": {
"site": {
"type": "string",
"description": "The window's site: its id, name or part of its URL."
},
"when": {
"type": "string",
"description": "For edit: the new start, a date and time such as 2026-11-02 02:00 (read in timezone), or RFC 3339; for a recurring window, the time of day."
},
"title": {
"type": "string",
"description": "For edit: the new title, as subscribers will read it."
},
"action": {
"enum": [
"edit",
"start",
"end",
"pause",
"resume"
],
"type": "string",
"description": "edit changes the fields given and keeps the rest; start begins a scheduled window now; end finishes one in progress now; pause and resume a recurring schedule."
},
"timezone": {
"type": "string",
"description": "For edit: the IANA time zone when is read in. Default: the window's own zone."
},
"description": {
"type": "string",
"description": "For edit: new details shown with the window; an empty string clears them."
},
"maintenance": {
"type": "string",
"description": "The window: its id from list_incidents with kind maintenance, or its title."
},
"duration_minutes": {
"type": "integer",
"maximum": 720,
"minimum": 1,
"description": "For edit: the new length, 1 to 720 minutes; a window in progress ends this long after it started."
},
"notify_subscribers": {
"type": "boolean",
"description": "For edit: whether status page subscribers are emailed about the window. Only when the user asks."
}
},
"additionalProperties": false
}{
"title": "Change a maintenance window",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": true
}cancel_maintenance — Cancel a maintenance window
Use this when the user calls off planned work: a scheduled or running maintenance window, or a recurring schedule as a whole. Cancels it as the dashboard's Maintenance page does; the subscribers who were told about it are emailed that it will not happen. Returns the cancelled window. A window already cancelled is left as it is. Not for an incident: use draft_incident_post with kind resolve.
{
"type": "object",
"required": [
"site",
"maintenance"
],
"properties": {
"site": {
"type": "string",
"description": "The window's site: its id, name or part of its URL."
},
"maintenance": {
"type": "string",
"description": "The window: its id from list_incidents with kind maintenance, or its title."
}
},
"additionalProperties": false
}{
"title": "Cancel a maintenance window",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": true
}Prompts
5 advertised
is-it-down — Is it down?
Check whether a service or website is down right now, with its recent history.
- target
- A service name (Stripe, GitHub, AWS) or a website URL (https://example.com) (required)
setup — Set up monitoring
Plan and set up FlareWarden monitoring for a website: what to watch, what it costs, and nothing created until you say yes.
- url
- The website or API to monitor (https://example.com) (required)
report — Write an uptime report
Write an uptime report for a group of sites (such as one client's) or the whole account, from FlareWarden's measured figures.
- group
- A group's exact name, such as a client's (leave empty for the whole account)
- range
- 24h, 7d, 30d or 90d (default 30d)
incident-check — Check incidents
Open and recent incidents on your FlareWarden account, with the evidence: was each one real?
whats-wrong — What's wrong?
What needs attention on your FlareWarden account, worst first, and how to fix each item.
Resources
10 advertised
checking-service-status
Use when the user asks whether a website, API or third-party service (Stripe, AWS, GitHub, Slack, Cloudflare, OpenAI, Vercel and others) is down, slow or having an outage, or why something that depends on one is failing ("is X down?", "is it just me?", "checkout is failing, is it Stripe?", "git push hangs for the whole team", "our deploys to us-east-1 time out", "customers in Germany can't load our site"). Reads FlareWarden's public status pages, which put each vendor's own status page beside FlareWarden's checks from several regions, or checks one URL from six regions. No account or sign-in needed. Not for alerts and incidents on the user's own FlareWarden account, which triaging-incidents covers.
skill://checking-service-status/SKILL.mdmanaging-alerts-and-team
Use when the user wants to change who can use their FlareWarden account or where its alerts go, like inviting a teammate at a role, changing a member's role, withdrawing an invitation, seeing who is on the team, getting more or fewer alert emails, pausing them, sending alerts to Slack, Discord, Google Chat, Teams or their own webhook endpoint, testing that alerts arrive, or finding out who changed something in the account ("add Sam to our account as an admin", "make Dana an editor", "stop emailing me about SSL changes", "pause my alerts while I'm on holiday", "send our down alerts to Slack", "add a webhook to our incident endpoint", "did the webhook get the test?", "who paused the API monitor?"). Uses the signed-in FlareWarden MCP tools (list_team, invite_member, change_member_role, update_my_notifications, add_webhook, test_webhook, search_audit_log). For a client who should see only their own sites, or an agency's client sites, use onboarding-client-portfolio. Not for on-call schedules or paging rotations.
skill://managing-alerts-and-team/SKILL.mdmonitoring-cron-jobs
Use when the user has a scheduled job, cron entry, backup, queue worker, scheduled GitHub Actions workflow, Kubernetes CronJob or systemd timer that could silently stop running, run late, fail or hang, and wants to be told when it does, or asks whether last night's run happened ("our nightly backup stopped for a week and nobody noticed", "alert me if the invoice job doesn't run", "add a heartbeat for this script", "a dead man's switch for the weekly export", "did the backup run last night?"). Plans the schedule and grace period with the signed-in FlareWarden MCP tools (plan_cron_monitor, add_cron_monitor), then adds the ping to the job itself when its code is in reach. Not for writing a cron expression or scheduling a job on its own.
skill://monitoring-cron-jobs/SKILL.mdmonitoring-third-party-dependencies
Use when the user wants to be alerted when a third-party service that a site they already monitor relies on (a cloud region, CDN, DNS, payment, email, sign-in or search service) has an outage, asks which of its services, components or regions to watch, asks whether a vendor's outage should count as their site being down or only degraded, or asks how a watched dependency has been doing ("alert us when AWS us-east-1 has problems", "our checkout depends on Stripe, watch it too", "which third-party services does acme.com depend on?", "only watch Cloudflare's CDN, not every data centre", "our status page runs on Better Stack, watch that too", "has the Stripe dependency been flapping this week?"). Plans each one with the signed-in FlareWarden MCP tools (plan_dependency, add_dependency, get_monitor_history) before anything is spent. For a site not monitored yet, even when the user names the services it runs on, use setting-up-website-monitoring; for whether a service is down right now use checking-service-status.
skill://monitoring-third-party-dependencies/SKILL.mdonboarding-client-portfolio
Use when an agency, freelancer or consultant wants to monitor many client websites at once, add a list, spreadsheet or CSV of sites, keep each client's sites in their own group, give a client access to only their own sites, or set up regular reports for each client ("add these 20 client sites", "we only have room for 10 of these 12", "let Bluebird see just their two sites", "we signed three new clients, here are their domains", "how do I organise 50 client sites?"). Uses FlareWarden's bulk plan (one plan for up to 50 URLs, with shared decisions and the total cost against the plan's room), groups and monitor-only invitations through the signed-in FlareWarden MCP tools (plan_site, create_site, invite_member, change_member_access). For one site of the user's own use setting-up-website-monitoring.
skill://onboarding-client-portfolio/SKILL.mdrunning-status-pages
Use when the user wants a public status page for their customers, or wants to change one they already have, such as its name, address or custom domain (and the DNS record it needs), its colours and logo, what it displays, its search title, or which sites, checks and groups it shows ("give our customers a status page", "put our status page on status.acme.com", "add the API to our status page", "rename the Payments group", "take the old blog off the status page", "why isn't our status page's custom domain working?", "make the status page match our brand colours"). Plans the page from one of the user's sites and publishes it only on the user's yes, then edits it one section or component at a time with the signed-in FlareWarden MCP tools (plan_status_page, create_status_page, update_status_page, add_status_page_component, remove_status_page_component). For posting an incident or maintenance notice on the page use triaging-incidents; for another company's status use checking-service-status.
skill://running-status-pages/SKILL.mdsetting-up-website-monitoring
Use when the user wants to start monitoring a website or API, be alerted when it goes down, or set up a new site together with the services it runs on (AWS, Cloudflare, Stripe and others, even when the user lists them) and checks on a page's content ("set up monitoring for acme.com", "tell me if my store goes offline", "we just launched, how will we know if it breaks?", "add our API to FlareWarden", "make sure the Buy button stays on the pricing page", "help me get my first site monitored"). Walks through FlareWarden's plan, decide, create loop with the signed-in FlareWarden MCP tools (plan_site, plan_dependency, create_site), so nothing is created or spent until the user has seen the plan and its cost. For many client sites at once use onboarding-client-portfolio; for cron jobs use monitoring-cron-jobs; for a status page use running-status-pages; for a third-party service on a site already monitored use monitoring-third-party-dependencies; for DNS records and certificates use watching-dns-and-certificates.
skill://setting-up-website-monitoring/SKILL.mdtriaging-incidents
Use when one of the user's own sites, APIs or cron jobs is down or was down, a FlareWarden alert fired, or the user asks whether an outage was real, what went down last night, what needs attention, why a site keeps alerting, or wants to tell customers on their status page or plan a maintenance window ("we got a down alert at 3am, was it real?", "is anything wrong with our sites?", "FlareWarden says the API is down but it loads for me", "was that outage us or Cloudflare?", "post an update that we're investigating", "schedule maintenance for Saturday night"). Reads the incident's evidence through the signed-in FlareWarden MCP tools (get_account_overview, list_incidents, get_incident, diagnose_site, review_noise) and drafts any status page post or maintenance notice for the user to approve. For a third-party service's status with no account involved use checking-service-status.
skill://triaging-incidents/SKILL.mdwatching-dns-and-certificates
Use when the user wants to know when DNS records or TLS certificates for their own domain change, stop resolving or are about to expire, such as MX, SPF or DMARC records, a CNAME like www pointing at Vercel, an SSL certificate nearing expiry, a certificate issued for their domain by an authority they don't use, or a subdomain's certificate, or asks what a DNS or certificate alert from FlareWarden means ("tell me if our MX records change", "alert me if www stops pointing at Vercel", "watch _dmarc for changes", "warn me well before our certificate runs out", "was a certificate issued for our domain that we didn't ask for?", "watch the certificate on api.acme.com too", "what DNS records does acme.com have?"). Uses the signed-in FlareWarden MCP tools (plan_dns_watch, add_dns_watch, get_site, track_subdomain_certificate, update_my_notifications). For whether a site is down right now use triaging-incidents; for many client sites at once use onboarding-client-portfolio.
skill://watching-dns-and-certificates/SKILL.mdwriting-uptime-reports
Use when the user wants an uptime, availability, SLA or incident report for a website, an agency's client or the whole account over a day, week, month or quarter, or asks what uptime or SLA their own sites actually achieved, how much downtime there was, whether an uptime target was met, how fast sites recovered, or how response times compare ("write October's report for Bluebird", "how did we do against our SLA last quarter?", "did we hit 99.9% this quarter?", "uptime numbers for the board deck", "send each client a monthly report", "what was our mean time to recover?"). Builds the report from FlareWarden's measured figures through the signed-in FlareWarden MCP tools (get_report, list_incidents, get_incident) and writes the words around them without changing a number. Not for whether something is down right now.
skill://writing-uptime-reports/SKILL.md30-day availability
Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.
- Successful checks
- 1 of 1 (100%)
- Average latency
- 259 ms
- 95th percentile latency
- 259 ms
Maintenance history
Public check and source-refresh events. Editorial and ownership records remain private.
- · probe · passed · 259 ms · metadata changed · 65 tool(s), 10 resource(s), 0 resource template(s), 5 prompt(s)
Connect from your client
Each snippet registers the same endpoint; pick the client you use.
Claude Code
claude mcp add --transport http flarewarden-mcp https://mcp.flarewarden.com/mcpCodex
codex mcp add flarewarden-mcp --url https://mcp.flarewarden.com/mcpCursor
{
"mcpServers": {
"flarewarden-mcp": {
"url": "https://mcp.flarewarden.com/mcp"
}
}
}Cline
{
"mcpServers": {
"flarewarden-mcp": {
"type": "streamableHttp",
"url": "https://mcp.flarewarden.com/mcp",
"disabled": false
}
}
}VS Code
{
"servers": {
"flarewarden-mcp": {
"type": "http",
"url": "https://mcp.flarewarden.com/mcp"
}
}
}Gemini CLI
gemini mcp add --transport http flarewarden-mcp https://mcp.flarewarden.com/mcpClaude Desktop
{
"mcpServers": {
"flarewarden-mcp": {
"url": "https://mcp.flarewarden.com/mcp"
}
}
}Windsurf
{
"mcpServers": {
"flarewarden-mcp": {
"serverUrl": "https://mcp.flarewarden.com/mcp"
}
}
}Let your agent find its tools
Find servers like FlareWarden MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.
Other cloud and infrastructure servers
Do you run FlareWarden MCP?
Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.