One tool, not thirteen. Servers, websites, security and on-call in one place.

No. The Free plan runs agentless checks - uptime, SSL, DNS, TCP, domain expiry, cron heartbeats - and accepts alerts from the tools you already run over a webhook, with a roster and an escalation policy to route them. The agent is what adds the per-server view: resources, SSH sessions, file changes, rootkits and the rest. It is one command to install and one line to remove.

Metrics on a short interval, plus kernel-level events through eBPF: SSH sessions, process starts, file changes in watched paths, network connections, container and service changes. It sends structured events, not raw logs, so the volume stays low. Linux is the primary platform; a Windows agent covers metrics, services and Event Log security telemetry - the docs describe exactly what each collects.

Each security alert is read in context - the user, the source address, the time window, whether a change record is open - and comes back with a verdict (benign, suspicious or unknown) and a short reason a person on call can act on. Routine events stay on the host timeline; the ones that need a human are the ones that page. AI triage is included on paid plans and during the 30-day trial.

No. Plans are flat and priced by infrastructure: Free, £39 a month for 5 hosts, £149 a month for 25 hosts. Each plan carries a user allowance and there is no per-seat charge, so adding someone to the rotation never changes the bill. The pricing page lists the allowances for each plan.

The escalation policy keeps climbing. Each level has its own wait time and its own channel, so an unacknowledged page moves from the primary on-call to the backup, then to a roster or a manager, then to a catch-all. Acknowledging stops the climb immediately.

Mobile push, SMS, WhatsApp, Telegram, Slack, email, and webhooks. You pick the channel per escalation level, so a warning can go to a Slack channel while a critical page hits SMS and mobile push. On Android, critical pushes use a channel that bypasses Do Not Disturb. There are no automated voice calls yet - SMS and WhatsApp are the loudest channels.

Yes. AlertKick accepts alerts from Prometheus Alertmanager, Grafana, Datadog, CloudWatch, Zabbix, Nagios, Icinga2, and a generic webhook. Point your existing alerts at it and use it purely as the on-call and escalation layer, or add the agent later for the servers you want watched from the inside.

For the on-call and paging job, yes: rosters, rotations, overrides, escalation policies, per-level channels, and alerts in from the usual monitoring sources, with an importer that brings schedules and policies across from either tool. What you will not find is a voice-call channel, a several-hundred-item integration catalogue, or enterprise incident workflows. The alternatives pages set out the differences plainly.

Yes. AlertKick is listed in the Claude connector directory. Connect it once and Claude can create monitors, read alerts, incidents and security events, acknowledge and resolve, and open change windows - 38 tools, scoped to your workspace, with every write marked as a write so Claude asks first. Claude Code, Cursor, and any other MCP client work the same way, and an AlertKick page opened in the ChatGPT desktop browser hands it the same tools over WebMCP.

Yes. Only the person the roster says is on call for that window gets paged, plus whoever the escalation policy names above them. There is no all-hands channel ping at 3 AM.