Name: FlareWarden
Author: flarewarden

FlareWarden MCP

Check if a site or service like Stripe is down, and monitor your sites, cron jobs and status pages.

Tool-list grade A Remote · Streamable HTTP No auth needed 65 tools v0.1.0

No reviews yet by flarewarden The publisher’s own endpoint — this marketplace is not in the path

93/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Check if a site or service like Stripe is down, and monitor your sites, cron jobs and status pages.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http flarewarden-mcp https://mcp.flarewarden.com/mcp

# 2 — ask your agent for something these tools do
#   check_service_status, check_service_status_url, recommend_monitoring and 62 more

FlareWarden costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

flarewarden1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Use this when the user asks whether a third-party service such as Stripe, AWS, GitHub, Slack, OpenAI or Cloudflare is down, slow or having an outage, or why something that depends on one is failing. Returns what FlareWarden's public status page for the service shows: the vendor's own status page and FlareWarden's checks from several regions side by side, the verdict (the worse of the two), open an

Parameter	Type	Required	Notes
service	string	yes	The service's name ("Stripe", "GitHub Actions"), its domain ("stripe.com") or its status page URL.

Use this when the user asks whether a specific website, URL or API endpoint is down, unreachable or slow: "is my site down or is it just me?", "is api.example.com reachable from Europe?". Requests the URL once from six regions (Ashburn, San Jose, London, Frankfurt, Singapore and Sydney) and returns each region's result (up, down, blocked or inconclusive), status code and timings, with an overall v

Parameter	Type	Required	Notes
url	string	yes	The website or endpoint to check, such as https://example.com or api.example.com/health. Query strings are ignored.

Use this when the user asks what they should monitor for a website, what could take their site down, or which third-party services (hosting, CDN, DNS, payments, email, analytics) a site depends on, and when someone with no FlareWarden account asks what monitoring a site would get before signing up. Reads the site's DNS records, home page and certificate and checks it from six regions. Returns the

Parameter	Type	Required	Notes
url	string	yes	The website to analyze, such as https://example.com or example.com.

Use this when the user asks what FlareWarden can do or what it costs: "can FlareWarden watch cron jobs?", "how do you confirm an outage?", "what does a status page cost?", SSL certificate expiry, DNS changes, heartbeats, third-party dependencies, SLA and uptime reports, maintenance windows, alerts to Slack. Returns a catalogue of features (what each does, when it helps, how it works, its limits an

Parameter	Type	Required	Notes
topic	string	no	Optional: what the user asked about, such as "cron jobs", "status page pricing" or "false alarms".

Use this when the user asks how to do something in FlareWarden, such as adding a custom domain to a status page, sending alerts to Slack, adding a cron job heartbeat, allowlisting probe IPs or inviting a teammate. Searches the documentation at flarewarden.com/docs and returns the best-matching passages with links to their pages.

Parameter	Type	Required	Notes
limit	integer	no	How many passages to return (default 5).
query	string	yes	The question or keywords, in the user's words.

Use this when starting any conversation about the user's own FlareWarden account, or when they ask what is wrong, what needs attention, or what they could set up next. It needs that account: on a connection not yet signed in, the call starts FlareWarden sign-in. Returns who is connected (account, plan, role, permissions), how much monitor room is left, sites by status, open incidents with how they

No parameter schema on file.

Use this when the user asks how many monitors they have left, what their plan includes, or why they cannot add more. Returns the monitor pool (used, allowed, left; websites, child checks and anomaly detection), status pages, seats, webhooks, subscribers, history kept and the fastest check interval. Not for which sites are down: use get_account_overview or list_sites.

No parameter schema on file.

Use this when the user asks which websites or APIs they monitor, which are down, slow or paused, or what is in a group. Returns each site's status, last check, response time, 24-hour uptime, group, interval and SSL days left, filtered and paged. Not for one site's detail: use get_site.

Parameter	Type	Required	Notes
cursor	string	no	The next_cursor of a previous page.
group	string	no	Only sites in this group (exact name).
limit	integer	no	Sites per page (default 50).
status	string	no	Only sites in this state.
text	string	no	Only sites whose name or URL contains this.

Use this when the user asks about one of their websites or APIs: is it up, why is it down, what is checked on it, when its certificate or domain expires. Returns status and last check; its content checks, dependencies and cron jobs (children, each with when it last and next runs, and a check's interval); SSL and domain expiry; anomaly detection; maintenance now and in the next 7 days; and open inc

Parameter	Type	Required	Notes
include	array	no	Extra sections: dns (the site's records and its DNS watches), subdomains (names found in certificate logs), certificates (certificates those logs list for the site's domain, and its certificate alert)
site	string	yes	The site's id, name or part of its URL.

Use this when the user asks what a site's recent checks, response times or failures looked like, or how a cron job, content check or dependency has been running. Returns the most recent checks of the site, or of one of its content checks, dependencies or cron jobs (runs, durations, late or failed runs), newest first. Not for uptime percentages or totals over a range: use get_report.

Parameter	Type	Required	Notes
check	string	no	A content check, dependency or cron job on the site, by id or name. Leave out for the site's own uptime checks.
from	string	no	Instead of range: where the window starts, a date such as 2026-07-01 (in your time zone) or RFC 3339. Goes with to. A window is at most 90 days, within the history your plan keeps.
limit	integer	no	Most checks to return (default 25).
range	string	no	How far back (default 24h).
site	string	yes	The site's id, name or part of its URL.
to	string	no	Instead of range: where the window ends, a date (the whole day is included) or RFC 3339.

Use this when the user wants an uptime, SLA or incident report for a site, a group (an agency's client) or the whole account, for a week, month or quarter. Returns uptime over the time FlareWarden measured (unknown is shown as unknown), downtime minutes (the time that uptime counts as down), degraded minutes (affected but up, not downtime), incident count, longest incident and mean time to recover

Parameter	Type	Required	Notes
from	string	no	Instead of range: where the window starts, a date such as 2026-07-01 (in your time zone) or RFC 3339. Goes with to. A window is at most 90 days, within the history your plan keeps.
group	string	no	For scope group: the group's exact name.
range	string	no	How far back (default 30d). Clamped to the history your plan keeps.
scope	string	yes	What the report covers.
site	string	no	For scope site: the site's id, name or part of its URL.
to	string	no	Instead of range: where the window ends, a date (the whole day is included) or RFC 3339.

Use this when the user asks what went down, whether anything is down now, what happened last night or this month, or what maintenance is planned. Returns incidents (open or resolved, with how each was confirmed) or maintenance windows, for one site, a group or the account, newest first. Not for one incident's full evidence: use get_incident.

Parameter	Type	Required	Notes
from	string	no	Instead of range: where the window starts, a date such as 2026-07-01 (in your time zone) or RFC 3339. Goes with to. A window is at most 90 days, within the history your plan keeps.
group	string	no	Only sites in this group (exact name).
kind	string	no	Incidents or maintenance windows (default incident).
limit	integer	no	Most items to return (default 25).
range	string	no	How far back (default 30d). Clamped to the history your plan keeps.
site	string	no	Only this site: its id, name or part of its URL.
status	string	no	Open, resolved or both (default all).
to	string	no	Instead of range: where the window ends, a date (the whole day is included) or RFC 3339.

Use this when the user asks whether an outage was real, how it was confirmed, when it started and ended, what else it affected, or who was told. Returns the incident with its evidence: the regions that confirmed it and how, which region failed first and when, false alarms overturned around it, checks rolled into it, its updates, and who was notified (member emails, webhook deliveries, status page

Parameter	Type	Required	Notes
incident	string	yes	The incident id, from list_incidents or get_site.
site	string	yes	The incident's site: its id, name or part of its URL.

Use this when one of the user's own sites is down, failing from some places, slow or alerting, and they want to know why right now, or want it checked from everywhere: "why is shop.acme.com down?", "is it failing everywhere or just in Asia?", "is our site reachable from every region?", "is it our certificate?". Requests the site once from every region FlareWarden checks from and returns each regio

Parameter	Type	Required	Notes
site	string	yes	The site: its id, name or part of its URL.

Use this when the user asks what they are not monitoring, what could break without them knowing, whether their monitoring is complete, or what to set up next. Returns the gaps in what the user can see, worst first, each with the tool that fixes it and, where the user may turn that suggestion off, the dismiss_suggestion key: services FlareWarden found a site relying on that no dependency watches, c

Parameter	Type	Required	Notes
group	string	no	Only sites in this group (exact name).
site	string	no	Only this site: its id, name or part of its URL.

Use this when the user asks why a site keeps alerting, which monitors are noisy or flapping, whether alerts were false alarms, or how to get fewer pointless alerts: "why does FlareWarden keep emailing us about the API?", "which of our monitors are flaky?". Returns, over the last 7 and 30 days for the sites the user can see, worst first: alerts for outages the next check found over, content checks,

Parameter	Type	Required	Notes
group	string	no	Only sites in this group (exact name).
site	string	no	Only this site: its id, name or part of its URL.

Use this when the user asks about their public status pages: which they have, their addresses, how many subscribers, or whether a custom domain works. Returns each page with its public URL, custom domain state, component and subscriber counts, and the plan's page limit. Not for another company's status: use check_service_status.

No parameter schema on file.

Use this when the user asks what one of their status pages shows, which sites and checks are on it, or why its custom domain is not working. Returns the page with its components in order (with the ids the component tools take), its public URL, its subscriber count, and its custom domain's DNS record, verification and certificate state. Not for incidents posted on it: use list_incidents.

Parameter	Type	Required	Notes
status_page	string	yes	The page's id or name.

Use this when the user asks who has access to the account, what roles people have, who was invited, or how many seats are left. Returns members with role, scope, the sites shared with them and when they joined and were last active (on the website or through an AI agent), pending invitations with the role or sites each gives, and seats used and allowed. Owners and admins only. Not for who was alert

No parameter schema on file.

Use this when the user asks whether FlareWarden can watch a third-party service their site depends on (a payment provider, cloud, CDN, email or auth service). Returns matching services with their category and status page, and FlareWarden's public status page when there is one. Not for whether a service is down now: use check_service_status.

Parameter	Type	Required	Notes
query	string	yes	The service's name, such as Stripe or AWS.

Use this when the user wants to give a person access to their FlareWarden account: a teammate at a role (admin, editor or viewer), or a client who should see only some sites (a monitor-only invitation with sites). Emails the person an invitation link and returns exactly who was emailed; inviting the same address again replaces its pending invitation of the same kind (a site invitation only one for

Parameter	Type	Required	Notes
email	string	yes	The address to invite, exactly as the user gave it.
idempotency_key	string	no	Optional. Send the same key again after a lost reply and the change is not made twice.
level	string	no	For a monitor-only invitation: view (default) or edit.
role	string	no	For an account invitation: admin (everything but billing), editor (manages monitors in their scope) or viewer (sees everything and gets alerts). Leave out for a monitor-only invitation.
scope	string	no	For an account invitation: which monitors the role covers. Default all.
site_checks	string	no	For a monitor-only invitation: which checks of each site are shared. Default all.
sites	array	no	For a monitor-only invitation: the sites to share, each by id, name or part of its URL. The person sees only these sites.

Use this when the user wants to withdraw an invitation that has not been accepted yet. Returns which invitation was cancelled; the link in its email stops working and nobody is emailed. Owners and admins only. Not for removing someone who already joined: that is done in the dashboard, and the result gives the link.

Parameter	Type	Required	Notes
invitation	string	yes	The invitation's id (from list_team) or the invited email address.

Use this when the user wants a team member to have a different role (admin, editor or viewer) or to cover different monitors. Returns the member's old and new role; FlareWarden emails the member about the change. Owners and admins only: nobody changes their own role or the owner's, and only the owner changes an admin's. Not for inviting someone new (use invite_member) or removing a member (done in

Parameter	Type	Required	Notes
member	string	yes	The member's email address, or their user id from list_team.
role	string	yes	The new role: admin (everything but billing), editor (manages monitors in their scope) or viewer (sees everything and gets alerts).
scope	string	no	Which monitors the role covers. Leave out to keep the member's current scope (all for a monitor-only member).

Use this when the user wants a monitor-only member, such as a client, to see more of the account's sites, to view or edit a site they can see, or to stop seeing one. Returns the sites the member can see after the change. A site is added at once, with no invitation or email; removing one asks the user to type the site's name where the client can show a form, as the team page does. Owners and admins

Parameter	Type	Required	Notes
access	string	yes	view or edit: the member sees, or edits, these sites; a site they could not see is added. remove: they stop seeing the site.
member	string	yes	The member's email address, or their user id from list_team.
sites	array	yes	The sites to change, each by id, name or part of its URL. To remove, one site.

Use this when the user wants the FlareWarden account's own name changed: the name its members see in the sidebar and account switcher, and invitations carry. Renames it as the Account page does and returns the old and new name. Owners and admins only. Not for a site's name (use update_monitor) or a status page's (use update_status_page).

Parameter	Type	Required	Notes
name	string	yes	The new name, 1 to 100 characters.

Use this when the user asks which alert emails they get from FlareWarden, or before changing them. Returns their own switches for this account: monitor_down (a monitor goes down), monitor_recovered (a monitor comes back up), ssl_expiring (warnings before an SSL certificate expires, at the ssl_expiry_warning_days), domain_expiring (reminders before a site's domain registration expires), certificate

No parameter schema on file.

Use this when the user wants FlareWarden to email them more or fewer kinds of alert, pause or resume all alert emails, or change when SSL expiry warnings arrive. Changes only the settings given, for the user alone, and returns all of them after the change. Not for teammates' alerts, webhooks or chat channels.

Parameter	Type	Required	Notes
certificate_changed	boolean	no	Email the user about Certificate Changed.
dns_failures	boolean	no	Email the user about DNS Failures and Changes.
domain_expiring	boolean	no	Email the user about Domain Expiring.
email_alerts	boolean	no	The master switch: false pauses every alert email to the user from this account.
issuer_changed	boolean	no	Email the user about Certificate Issuer Changed.
monitor_down	boolean	no	Email the user about Monitor Down.
monitor_recovered	boolean	no	Email the user about Monitor Recovered.
performance_anomalies	boolean	no	Email the user about Performance Anomalies.
ssl_critical_days	integer	no	Last SSL expiry warning, in days (1-365).
ssl_expiring	boolean	no	Email the user about SSL Certificate Expiring.
ssl_tls_changes	boolean	no	Email the user about SSL/TLS Changes.
ssl_urgent_days	integer	no	Second SSL expiry warning, in days (1-365). At least the critical days.
ssl_warning_days	integer	no	First SSL expiry warning, in days before expiry (1-365). At least the urgent days.

Use this when the user asks where FlareWarden sends alerts besides email: their webhooks and Slack, Discord, Google Chat or Microsoft Teams channels, which events and sites each covers, and whether deliveries are failing. Returns each destination with its host (never the full URL, which often carries a credential), events, sites, active or paused, and delivery health. Owners and admins only. Not f

No parameter schema on file.

Use this when the user asks whether a webhook or chat channel got a particular alert, why one is failing, or what was sent to it lately. Returns its latest deliveries, newest first: each one's event, when, whether it arrived, the HTTP status, how long it took, which attempt it was and, for a failure, what went wrong in a few words. Never the payload or what the endpoint answered. Not for the accou

Parameter	Type	Required	Notes
limit	integer	no	How many deliveries, newest first. Default 20.
webhook	string	yes	The webhook's id (from list_webhooks) or its name.

Use this when the user wants FlareWarden to send alert events to their own HTTPS endpoint (a generic, signed JSON webhook), or to connect Slack, Discord, Google Chat or Microsoft Teams. For an endpoint: creates the webhook and returns a one-time link where the user sees its signing secret (the secret never appears in the chat). For a chat destination: returns the page where the user pastes the cha

Parameter	Type	Required	Notes
destination	string	no	custom (default): the user's own HTTPS endpoint. slack, discord, googlechat or teams (Microsoft Teams): returns the page to connect that channel.
events	array	no	For destination custom, required: the events to send, at least one, such as incident.started and incident.recovered (the Webhooks page asks for them too).
idempotency_key	string	no	Optional. Send the same key again after a lost reply and the change is not made twice.
name	string	no	A name for the webhook, as the Webhooks page lists it.
sites	array	no	Limit the webhook to these sites, each by id, name or part of its URL. Leave out for every site.
url	string	no	For destination custom: the HTTPS endpoint. Never a Slack, Discord, Google Chat or Microsoft Teams URL.

Use this when the user wants a webhook or chat channel to get different alerts: rename it, change the events or sites it is sent, turn it off or on, or move a custom webhook to a new URL. Changes it as the Webhooks page's edit does and returns it as it is now; only the fields given change. Turning one on is held to the plan's active webhooks. Owners and admins only. Not for a chat channel's URL, i

Parameter	Type	Required	Notes
enabled	boolean	no	False turns it off (nothing is sent until it is turned on), true turns it on.
events	array	no	The events it is sent, replacing the current ones, such as incident.started and incident.recovered (list_webhooks shows each webhook's; a chat channel is never sent monitor, maintenance or cron events
every_site	boolean	no	True sends it every site's events again.
name	string	no	A new name.
sites	array	no	Send it only these sites' events, each by id, name or part of its URL.
url	string	no	For a custom webhook only: the new https endpoint.
webhook	string	yes	The webhook's id (from list_webhooks) or its name.

Use this when the user wants to check that a webhook or chat channel receives FlareWarden's alerts. Sends one test event to the destination now, records the delivery, and returns whether it arrived and the HTTP status. Owners and admins only. Not for the delivery history of real alerts: use list_webhook_deliveries.

Parameter	Type	Required	Notes
webhook	string	yes	The webhook's id (from list_webhooks) or its name.

Use this when the user wants a delivery a webhook or chat channel missed sent again, once the endpoint is fixed. Sends the same event again as a new attempt, as the Webhooks page's Retry does, and returns whether it arrived and the HTTP status. Owners and admins only. Not for a test event (use test_webhook).

Parameter	Type	Required	Notes
delivery	string	yes	The delivery's id, from list_webhook_deliveries.
webhook	string	yes	The webhook's id (from list_webhooks) or its name.

Use this when the user asks who changed something in the account and when: who paused a site, who invited someone, what an AI agent did. Returns entries newest first with the time, the member, the action, what it changed and, for changes made through an AI agent, which one (via). Owners and admins only. Not for monitoring history or incidents: use get_monitor_history or list_incidents.

Parameter	Type	Required	Notes
action	string	no	Only this action, as entries name it (for example monitor.pause or invitation.create).
from	string	no	Only entries on or after this date, YYYY-MM-DD.
member	string	no	Only changes made by this member, by email address.
page	integer	no	Page of results, 25 a page. Default 1.
text	string	no	Words to find in the entry: a site or member name, an email address, an action such as "paused".
to	string	no	Only entries on or before this date, YYYY-MM-DD.

Use this when the user wants FlareWarden to monitor a website or API they run, or up to 50 of them at once. Returns a plan: what each site runs on (hosting, CDN, cloud regions, payments and other services, found from its DNS and page), which automatic page checks hold on it now, and the decisions to put to the user with recommendations and their cost in monitors. Changes nothing; call again with t

Parameter	Type	Required	Notes
accept_recommended	boolean	no	True when the user asked FlareWarden to choose: every open decision that has a recommendation takes it.
answers	object	no	The user's answers, by decision id: services, checks, interval, group, anomaly, fit, exclude_sites, and deps.<service>.* for a service's configuration. Also timeout, never asked: the seconds each site
component_query	string	no	Searches a dependency's long component list (more than 50) by name.
from_workspace	array	no	For one site only: services the site uses that are visible in the user's own workspace and not from outside, such as its infrastructure config, package manifests or environment variable names. Each is
group	string	no	A group to put the sites in.
name	string	no	The site's name, for one site; the host name by default.
plan_id	string	no	An earlier plan_site plan's id, to read it again or answer its decisions.
url	string	no	The site's URL, such as https://acme.com, for one site.
urls	array	no	Up to 50 site URLs, for adding many at once.

Use this when the user has confirmed a plan_site plan and its cost. Returns what was created for each site (the site, its page checks and dependencies, with ids), anything left out because the plan filled up, and what to set up next. Spends the monitors the plan priced. Safe to repeat: the same plan id returns the first result. Not for a plan the user has not seen: show them plan_site's summary fi

Parameter	Type	Required	Notes
confirm	string	yes	The plan's confirm sentence, exactly as returned; show it to the user first.
plan_id	string	yes	The plan_site plan's id.

Use this when the user wants FlareWarden to watch a third-party service a site relies on (a cloud provider, CDN, payment, email or auth service), either while planning a new site or for a site already monitored. A service FlareWarden's catalogue does not list is watched through its status page (url), or a URL checked over plain HTTP. Returns how the service will be watched (its status page integra

Parameter	Type	Required	Notes
accept_recommended	boolean	no	True when the user asked FlareWarden to choose: every open decision that has a recommendation takes it. Never covers credentials.
answers	object	no	The user's answers, by decision id (deps.<service>.regions, .components, .severity.<component>, .interval, .url), or service when choosing among detected ones.
component_query	string	no	Searches a long component list (more than 50) by name.
dependency	string	no	The service: its key from a plan_site plan, or its name, such as Stripe or AWS, or a service the catalogue does not list (with url). On a one-site plan_site plan, a service detection did not find is a
integration	string	no	The integration to use when the user said which (their own monitoring's status page).
plan_id	string	no	A plan_site plan (with dependency, the service's key from it) or an earlier plan_dependency plan.
regions	array	no	Region ids the site runs in for this service, such as iad or us-east-1, when the user's code or the user says so: the service's locations there are recommended.
site	string	no	A site already monitored, by id, name or part of its URL, to add the dependency to.
url	string	no	The service's status page, or a URL to check over plain HTTP, when the user gave one.

Use this when the user has confirmed a plan_dependency plan for a site already monitored. Returns the dependency created, with its id and how it is watched. Spends one monitor. Safe to repeat: the same plan id returns the first result. Not for a dependency inside a plan_site plan: create_site adds those with the site.

Parameter	Type	Required	Notes
confirm	string	yes	The plan's confirm sentence, exactly as returned; show it to the user first.
plan_id	string	yes	The plan_dependency plan's id.

Use this when the user has confirmed a plan_dependency plan that changes which components of a dependency the site already watches, or how serious each is. Returns the dependency as it now watches. Spends no monitors. Safe to repeat: the same plan id returns the first result. Not for adding a dependency the site does not watch yet: add_dependency adds one.

Parameter	Type	Required	Notes
confirm	string	yes	The plan's confirm sentence, exactly as returned; show it to the user first.
plan_id	string	yes	The plan_dependency plan's id.

Use this when the user wants FlareWarden to watch what a page of their site says or shows: that a text or button is there, an error message is not, a price stays in a range, or the page changes. Returns the check tried against the live page right now (passes or not) and where the page holds its text, or the automatic checks that hold there when no check is named; any check of the site that already

Parameter	Type	Required	Notes
accept_recommended	boolean	no	True when the user asked FlareWarden to choose.
answers	object	no	The user's answers, by decision id: check, severity, interval, name.
attribute	string	no	For attribute_check: the attribute to read.
case_sensitive	boolean	no	Match the text's case exactly.
check_type	string	no	What to check.
max	number	no	For numeric_range or element_count: the highest value allowed.
min	number	no	For numeric_range or element_count: the lowest value allowed.
name	string	no	A name for the check.
page	string	no	The page's path on the site, such as /pricing; the home page by default.
plan_id	string	no	An earlier plan_content_check plan, to change it or answer its decisions.
selector	string	no	A CSS selector narrowing where to look, such as #buy-button (no :has()); an empty string clears it. A plan of a text with no selector lists each place the page shows it, with a selector for each; a fa
site	string	no	The site, by id, name or part of its URL.
text	string	no	The text (or, for regex, the pattern) the check looks for.

Use this when the user has confirmed a plan_content_check plan. Returns the content check created, with its id. Spends one monitor. Safe to repeat: the same plan id returns the first result. Not for changing an existing check: use update_monitor.

Parameter	Type	Required	Notes
confirm	string	yes	The plan's confirm sentence, exactly as returned; show it to the user first.
plan_id	string	yes	The plan_content_check plan's id.

Use this when the user wants to know if a scheduled job, backup, queue worker or other background task stops running, runs late or fails. Returns the schedule understood (with the next five runs in the user's time zone), its cost in monitors against the room the plan has left, and the decisions to put to the user: when the job runs, if the schedule given could not be read; then how late is too lat

Parameter	Type	Required	Notes
accept_recommended	boolean	no	True when the user asked FlareWarden to choose.
answers	object	no	The user's answers, by decision id: schedule, interval, grace, max_run, severity.
job	string	no	What the job is, as the user put it, such as nightly backup.
plan_id	string	no	An earlier plan_cron_monitor plan, to change it or answer its decisions.
schedule	string	no	When it runs: a cron expression (read in UTC), every N minutes, hours or days, or heartbeat for a process that checks in.
site	string	no	The site the job belongs to, by id, name or part of its URL.

Use this when the user has confirmed a plan_cron_monitor plan. Returns the job's ping URL and ready-to-paste code for crontab, start/complete/fail reporting, GitHub Actions, a Kubernetes CronJob and a systemd timer. Spends one monitor. Safe to repeat: the same plan id returns the first result and the same URL. Not for changing an existing job's schedule: use update_monitor.

Parameter	Type	Required	Notes
confirm	string	yes	The plan's confirm sentence, exactly as returned; show it to the user first.
plan_id	string	yes	The plan_cron_monitor plan's id.

Use this when the user wants to change how a site or one of its checks is watched: a site's name, interval, timeout or group; a content check's text, selector, page, kind, attribute, limits, description, severity or interval; a dependency's name, description, severity or interval, and a plain HTTP dependency's URL and expected text; a cron job's schedule, grace period, longest run, description or

Parameter	Type	Required	Notes
attribute	string	no	A content check's attribute to read, for attribute_check.
case_sensitive	boolean	no	Whether a content check matches case exactly.
check	string	no	One of the site's content checks, dependencies or cron jobs, by id or name; leave out to change the site itself.
check_type	string	no	A content check's kind.
description	string	no	A check's description.
expected_text	string	no	A plain HTTP dependency's text its answer must hold (or, with match, must not hold or match); an empty string stops checking it.
grace	integer	no	A cron job's grace period in seconds.
group	string	no	A site's group; an empty string removes it.
interval	integer	no	Seconds between checks (30, 60, 300, 600, 1800 or 3600, as the plan allows).
match	string	no	How expected_text is matched. Default contains.
max	number	no	A content check's highest value allowed, for numeric_range or element_count.
max_run	integer	no	A cron job's longest normal run in seconds; 0 turns it off.
min	number	no	A content check's lowest value allowed, for numeric_range or element_count.
name	string	no	The site's new name, or with check, the check's.
page	string	no	A content check's page path.
schedule	string	no	A cron job's schedule: a cron expression (UTC), every N minutes, hours or days, or heartbeat.
selector	string	no	A content check's CSS selector.
severity	string	no	How serious a failure is.
site	string	yes	The site, by id, name or part of its URL.
text	string	no	A content check's text or pattern.

Use this when the user wants to stop or restart checks of a site or one of its checks, for example during planned work. Returns the new state and what it means: pausing a site stops its checks, content checks and dependencies, holds its DNS watch alerts, and resolves its open automatic incidents, but its cron jobs keep alerting until each is paused; pausing frees no room on the plan; resuming must

Parameter	Type	Required	Notes
check	string	no	One of the site's content checks, dependencies or cron jobs, by id or name; leave out for the whole site.
paused	boolean	yes	True to pause, false to resume.
site	string	yes	The site, by id, name or part of its URL.

Use this when the user wants to pause or resume several sites at once: a group, a list of sites, or every site, for example during a migration or a move to a new host. Returns exactly which sites would change, which are already paused or running, and which can't be changed (no permission, shared from another account, or no room on the plan to resume), with a plan id. Changes nothing. Not for one s

Parameter	Type	Required	Notes
all	boolean	no	True for every site the user can change.
answers	object	no	The user's answers, by decision id: which sites a name that matched several means.
group	string	no	Every site in this group.
paused	boolean	no	True to pause, false to resume.
plan_id	string	no	An earlier plan_bulk_pause plan, to answer its decisions.
sites	array	no	Sites by id, name or part of their URL, up to 100.

Use this when the user has confirmed a plan_bulk_pause plan. Returns each site's outcome: paused or resumed, already so, or refused with the website's reason (a resume that does not fit the plan's running monitors is refused, the others still go ahead). Safe to repeat: the same plan id returns the first result. Not for deciding which sites: call plan_bulk_pause first.

Parameter	Type	Required	Notes
confirm	string	yes	The plan's confirm sentence, exactly as returned; show it to the user first.
plan_id	string	yes	The plan_bulk_pause plan's id.

Use this when the user wants FlareWarden to alert on unusual response times of a site, or unusual run times of a cron job, or to stop doing so or change how sensitive it is. Returns whether it is on, its sensitivity, and its recent anomalies. Turning it on costs one monitor; turning it off frees it. It learns for 3 days before reporting. Not for ordinary up or down alerts, which every monitor send

Parameter	Type	Required	Notes
check	string	no	A cron job on the site, by id or name; leave out for the site's response times.
enabled	boolean	yes	True to turn it on (or change sensitivity), false to turn it off.
sensitivity	string	no	low (fewer alerts), normal or high.
site	string	yes	The site, by id, name or part of its URL.

Use this when the user says an unusual response or run time was expected (a deploy, a sale, a migration). Returns the anomaly's new state. A dismissed anomaly no longer counts and is left out of future baselines; dismissed false restores it. Not for turning anomaly detection off: use set_anomaly_detection.

Parameter	Type	Required	Notes
dismissed	boolean	no	False to restore a dismissed anomaly; true by default.
event	integer	yes	The anomaly's event number, from set_anomaly_detection or get_site.
note	string	no	Why it was expected, up to 200 characters.
site	string	yes	The site, by id, name or part of its URL.

Use this when the user wants FlareWarden to watch the TLS certificate of a subdomain it found under a site (from public certificate logs), or to stop. Returns the subdomain's tracking state and, when tracking starts, its certificate's issuer and expiry. A tracked subdomain gets a daily certificate check and expiry alerts, at no cost to the plan. Not for checking the subdomain itself is up: plan it

Parameter	Type	Required	Notes
site	string	yes	The site the subdomain was found under, by id, name or part of its URL.
subdomain	string	yes	The subdomain, such as api.acme.com, or its id.
tracked	boolean	no	False to stop tracking; true by default.

Use this when the user wants to know if DNS records under one of their sites change or stop resolving: their MX records, _dmarc, SPF, or the CNAME a subdomain points at (such as www pointing at Vercel). Returns the name's values today for the record types asked (or all of them), and the decisions to put to the user: which record types, and whether to alert when the values change or when the name s

Parameter	Type	Required	Notes
accept_recommended	boolean	no	True when the user asked FlareWarden to choose.
answers	object	no	The user's answers, by decision id: record_types, alert_on.
host	string	no	The name to watch: a label under the site's domain (www, _dmarc, mail), @ for the domain itself, or a full name such as mail.acme.com.
plan_id	string	no	An earlier plan_dns_watch plan, to answer its decisions.
record_types	array	no	The record types to watch: A, AAAA, CNAME, MX, TXT, NS or CAA. Leave out to see them all and decide.
site	string	no	The site whose domain the name is under, by id, name or part of its URL.

Use this when the user has confirmed a plan_dns_watch plan. Returns the watch with the values it starts from. It costs no monitors. Safe to repeat: the same plan id returns the first result. Not for removing or changing a watch: that is done on the site's DNS page, which the result links.

Parameter	Type	Required	Notes
confirm	string	yes	The plan's confirm sentence, exactly as returned; show it to the user first.
plan_id	string	yes	The plan_dns_watch plan's id.

Use this when the user says not to suggest something again: a status page, an alert channel, inviting a teammate, cron monitoring, subdomains or anomaly detection. Returns which suggestion is off. It stays off for this member in every assistant's conversations; the dashboard's own prompts are dismissed on the dashboard. Not for declining once: leaving a suggestion unanswered is enough.

Parameter	Type	Required	Notes
suggestion	string	yes	The suggestion's key, as results give it.

Use this when the user wants a public status page for their customers, made from one of their sites or empty. Returns a suggested address (with free alternatives when one is taken), the branding found on the site, the components the page would show grouped as the editor groups them, what the plan allows (components per page, custom domains), and the decisions for the user: the address, which of th

Parameter	Type	Required	Notes
accept_recommended	boolean	no	True when the user asked FlareWarden to choose. It never publishes: that needs the user's yes.
answers	object	no	The user's answers, by decision id: name, slug, dependencies (ids to show), publish (true once the user confirms creating the public page).
brand_color	string	no	The user's brand colour as #rrggbb, if they gave one: the page's colours are made from it instead of the colour found on the site. A page made from a site only.
from_site	string	no	The site to make the page from, by id, name or part of its URL. Leave out for an empty page.
name	string	no	The page's name, if the user gave one.
plan_id	string	no	An earlier plan_status_page plan, to answer its decisions.
slug	string	no	The page's address, if the user gave one: the part before .status.flarewarden.com.

Use this when the user has confirmed a plan_status_page plan, including publishing it. Returns the new page's public address and what it shows. The page is public as soon as it is created. Safe to repeat: the same plan id returns the first result and never a second page. Not for changing an existing page: use update_status_page.

Parameter	Type	Required	Notes
confirm	string	yes	The plan's confirm sentence, exactly as returned; show it to the user first.
plan_id	string	yes	The plan_status_page plan's id.

Use this when the user wants to change an existing status page's name, description or custom domain, its colours or logo, what it displays (time zone, incident history, uptime days, subscribe form), or its search title and description. Changes one section at a time (general, branding, display or seo) with the editor's own checks and returns the section as saved; setting a custom domain returns the

Parameter	Type	Required	Notes
fields	object	yes	Only the settings to change. general: name, description (the same field as seo's meta_description: saving either sets both), custom_domain ("" removes it). branding: header_bg_color, header_text_color
section	string	yes	Which settings to change.
status_page	string	yes	The page's id, name or address.

Use this when the user wants another of their sites, or a group heading, shown on one of their status pages. Returns what was added: a site with the checks chosen under it, placed in a group if one is named. A site already on the page gains only the checks it did not show, and a group that exists is not added twice. Not for creating a page: use plan_status_page.

Parameter	Type	Required	Notes
children	array	no	Only these of the site's checks, by id or name.
description	string	no	Optional text visitors see under the name.
group	string	no	The group heading to put the site under, by name or id; created when the page has none of that name.
include_children	boolean	no	True to show every content check, dependency and cron job of the site under it.
name	string	no	The name visitors see; the site's name when left out. Required for a group.
site	string	no	The site to show, by id, name or part of its URL. Leave out to add a group heading named name.
status_page	string	yes	The page's id, name or address.

Use this when the user wants a service or group on one of their status pages renamed, described differently, moved into or out of a group, or moved up or down. Returns the component as saved and the page's components in order. Not for taking one off the page: use remove_status_page_component.

Parameter	Type	Required	Notes
component	string	yes	The component's id or name, as get_status_page lists them.
description	string	no	The new text under the name; "" removes it.
group	string	no	The group to move it into, by name or id; "" moves it out of its group to the top level.
name	string	no	The new name visitors see.
order	integer	no	Its position within its group, or the top level: 0 is first.
status_page	string	yes	The page's id, name or address.

Use this when the user wants a site, check or group heading taken off one of their public status pages. A site goes with its own content, dependency and cron rows, wherever they are placed. A group goes alone and its items move to the top level where it was, unless group_contents is remove, which takes everything in it off the page too. The sites and checks themselves stay monitored. Returns what

Parameter	Type	Required	Notes
component	string	yes	The component's id or name, as get_status_page lists them.
group_contents	string	no	For a group only. keep (the default): only the group goes, and its items stay on the page at the top level where it was. remove: everything in the group comes off the page too, each item as removing i
status_page	string	yes	The page's id, name or address.

Use this when the user wants to tell customers about a problem on one of their sites: declare a new incident, post an update on one, or resolve one. Returns the exact text, every status page it will appear on, how many subscribers, members and webhooks will be notified, and any conflict (such as an incident already open on that site), with a draft id. Posts nothing. Not for reading what happened:

Parameter	Type	Required	Notes
components	array	no	For new: what the incident is about: site for the site itself (the default), or a dependency, content check or cron job of it by name or id. The first check named decides the incident's type.
incident	string	no	For update or resolve: the incident's id (list_incidents gives it). Leave out when the site has one open incident.
internal_only	boolean	no	For update: a note only the team sees; no status page shows it and nobody is emailed.
kind	string	yes	new declares an incident, update posts on an open one, resolve closes one.
message	string	no	For new (needed): the first public message. For update: the update. For resolve: an optional closing message.
severity	string	no	For new: critical (an outage: the site shows Down and the time counts as downtime), degraded (slow, or part of the site), or notify_only (shown, never counted as downtime, no subscriber email). Defaul
site	string	yes	The site: its id, name or part of its URL.
status	string	no	For update: where the incident stands. Default: its latest status. A new incident always starts as investigating.
title	string	no	For new (needed, as on the Incidents tab): the incident's public title, as the user wants it shown.

Use this when the user has approved a draft_incident_post draft's exact text and recipients. Posts it as the dashboard's Incidents tab does: it shows on the status pages and FlareWarden emails the subscribers, members and webhooks the draft named. Returns the incident. Safe to repeat: the same draft id posts once and returns the first result. Not for changing the text: make a new draft.

Parameter	Type	Required	Notes
confirm	string	yes	The plan's confirm sentence, exactly as returned; show it to the user first.
draft_id	string	yes	The draft's id from draft_incident_post (it starts with pl_).

Use this when the user plans work on a site (a deploy, an upgrade, a migration) and wants it marked as maintenance, once or on a schedule, optionally telling status page subscribers. Returns the window in the user's time zone (and the next occurrences of a recurring one), the status pages it shows on and how many subscribers would be emailed, with a draft id. Schedules nothing. Not for an outage t

Parameter	Type	Required	Notes
day_of_month	integer	no	For monthly on a date: the day, 1 to 31.
days	array	no	For weekly or biweekly: the weekdays, such as saturday. Default: the weekday of when's date.
description	string	no	Optional details shown with the window.
duration_minutes	integer	yes	How long it lasts, 1 to 720 minutes (12 hours).
notify_subscribers	boolean	no	Email the status page subscribers about it. Only when the user asks; default false.
recurrence	string	no	none (once, the default), daily, weekly, biweekly or monthly.
site	string	yes	The site: its id, name or part of its URL.
timezone	string	no	The IANA time zone the time is in, such as Europe/London. Default: the user's own zone.
title	string	yes	What the work is, as subscribers will read it.
week_of_month	string	no	For monthly on a weekday: which one.
weekday	string	no	For monthly on a weekday: the day.
when	string	yes	When it starts: a date and time such as 2026-11-02 02:00 (read in timezone), or RFC 3339. For a recurring window, the time of day such as 02:00.

Use this when the user has approved a draft_maintenance draft. Schedules it as the dashboard's Maintenance page does: it shows on the status pages, and subscribers are emailed only if the draft said so. Returns the window and its id. Safe to repeat: the same draft id schedules once. Not for changing a window already scheduled: update_maintenance moves, extends, renames or ends it.

Parameter	Type	Required	Notes
confirm	string	yes	The plan's confirm sentence, exactly as returned; show it to the user first.
draft_id	string	yes	The draft's id from draft_maintenance (it starts with pl_).

Use this when the user wants to change planned or running maintenance: end it early or start it now, extend or move it, rename it, or pause or resume a recurring schedule. Changes it as the dashboard's Maintenance page does and returns the window as it is now. A window that asked to tell subscribers emails them as the page's would: the new time when a one-time window moves, and that it started or

Parameter	Type	Required	Notes
action	string	yes	edit changes the fields given and keeps the rest; start begins a scheduled window now; end finishes one in progress now; pause and resume a recurring schedule.
description	string	no	For edit: new details shown with the window; an empty string clears them.
duration_minutes	integer	no	For edit: the new length, 1 to 720 minutes; a window in progress ends this long after it started.
maintenance	string	yes	The window: its id from list_incidents with kind maintenance, or its title.
notify_subscribers	boolean	no	For edit: whether status page subscribers are emailed about the window. Only when the user asks.
site	string	yes	The window's site: its id, name or part of its URL.
timezone	string	no	For edit: the IANA time zone when is read in. Default: the window's own zone.
title	string	no	For edit: the new title, as subscribers will read it.
when	string	no	For edit: the new start, a date and time such as 2026-11-02 02:00 (read in timezone), or RFC 3339; for a recurring window, the time of day.

Use this when the user calls off planned work: a scheduled or running maintenance window, or a recurring schedule as a whole. Cancels it as the dashboard's Maintenance page does; the subscribers who were told about it are emailed that it will not happen. Returns the cancelled window. A window already cancelled is left as it is. Not for an incident: use draft_incident_post with kind resolve.

Parameter	Type	Required	Notes
maintenance	string	yes	The window: its id from list_incidents with kind maintenance, or its title.
site	string	yes	The window's site: its id, name or part of its URL.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install FlareWarden or to call it, at any volume.

ATool-list grade · score 93 / 100

Release 0.1.0 · scanned 2 Nov 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings0 threat · 8 capability

Capabilitymoderate

Coveragemanifest

Verificationnot in this report

Surface digest3482732155cb44c7ebd5f7a6243305a55ef53bdc7c98c4a1c7b3bdfd60b09b1d

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
check_service_status	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
check_service_status_url	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
recommend_monitoring	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
explain_features	no tags
search_help	no tags
get_account_overview	no tags
get_usage	no tags
list_sites	no tags
get_site	no tags
get_monitor_history	no tags
get_report	no tags
list_incidents	no tags
get_incident	no tags
diagnose_site	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
review_coverage	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
review_noise	no tags
list_status_pages	no tags
get_status_page	no tags
list_team	no tags
search_service_catalog	no tags
invite_member	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
revoke_invitation	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
change_member_role	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
change_member_access	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
rename_account	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
get_my_notifications	no tags
update_my_notifications	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_webhooks	no tags
list_webhook_deliveries	no tags
add_webhook	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, openWorldHint: true
update_webhook	external-sinkstate-write	external-sink: keyword "webhook", parameter "webhook"; state-write: declares readOnlyHint: false, destructiveHint: true
test_webhook	external-sink	external-sink: keyword "webhook", parameter "webhook", declares readOnlyHint: false, openWorldHint: true
retry_webhook_delivery	external-sink	external-sink: keyword "webhook", parameter "webhook", declares readOnlyHint: false, openWorldHint: true
search_audit_log	no tags
plan_site	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
create_site	state-write	state-write: declares readOnlyHint: false
plan_dependency	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
add_dependency	state-write	state-write: declares readOnlyHint: false
apply_dependency_change	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
plan_content_check	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
add_content_check	state-write	state-write: declares readOnlyHint: false
plan_cron_monitor	no tags
add_cron_monitor	state-write	state-write: declares readOnlyHint: false
update_monitor	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
set_monitor_paused	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
plan_bulk_pause	no tags
apply_bulk_pause	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
set_anomaly_detection	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
dismiss_anomaly	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
track_subdomain_certificate	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
plan_dns_watch	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
add_dns_watch	state-write	state-write: declares readOnlyHint: false
dismiss_suggestion	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
plan_status_page	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
create_status_page	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
update_status_page	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
add_status_page_component	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
update_status_page_component	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
remove_status_page_component	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
draft_incident_post	no tags
publish_incident_post	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
draft_maintenance	no tags
schedule_maintenance	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
update_maintenance	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
cancel_maintenance	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digest3482732155cb44c7

Scanned2026-11-02

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

FlareWarden MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also