MCP tool reference

This is the tool list an MCP client sees when it connects to AlertKick, whether through the hosted connector at https://mcp.alertkick.com/mcp or the open-source akmcp binary. Setup lives in Claude & MCP connector and Use AlertKick with your AI assistant; this page is the reference.

Two conventions apply to every tool:

• Writes are marked. Tools that create, change, or delete carry the MCP write annotation, so a well-behaved client asks before calling them. A connection granted read-only access has them refused.
• Scoped to your workspace. The hosted connector acts as the user who authorised it; the local binary acts as the API key’s workspace. There is no cross-tenant access.

Parameters marked required must be supplied; everything else has the default shown. List tools paginate with offset and limit (default 50, max 200 unless stated).

Monitors

Tool	Writes	What it does
list_monitors	no	All HTTP, API, TCP, DNS, SSL, domain, and mail monitors with status, response time, and interval. offset, limit.
get_monitor	no	One monitor’s configuration, check history, and assigned pollers. uuid required.
list_poller_locations	no	The system locations by region plus your own on-prem pollers, with the location_key values the create tools accept.
create_https_monitor	yes	Uptime monitor for a URL, with TLS expiry on https.
create_dns_monitor	yes	Resolve a record on an interval; alert on failure or on a changed answer.
create_tcp_monitor	yes	Open a connection to host:port on an interval.
create_domain_expiry_monitor	yes	Daily RDAP check of registration expiry, registrar, transfer lock, nameservers, and mail posture.
create_mail_monitor	yes	Email deliverability: MX, SPF, DMARC, DKIM, MTA-STS, TLS-RPT, and blocklists.
create_monitor	yes	Generic creator for any type; prefer the typed tools.
pause_monitor	yes	Stop checks and alerts until resumed. uuid required.
resume_monitor	yes	Resume a paused monitor. uuid required.
delete_monitor	yes	Permanently delete a monitor. uuid required.

Every create tool takes display_name required and optional locations (a list of location keys; defaults to your home-region system location). New monitors route alerts to the workspace’s default escalation policy; change that in the dashboard afterwards.

create_https_monitor

Parameter	Default	Meaning
url	required	Full URL, e.g. https://example.com/health
check_interval_seconds	300	Seconds between checks; plans may enforce a higher floor
expected_status_code	200	Expected HTTP status
expected_response_contains	-	Alert unless the body contains this string
monitor_ssl_cert	true for https	Also alert before the TLS certificate expires
ssl_cert_expiry_alert_days	14	Days before expiry to alert
response_time_alert_ms	0 (off)	Alert when successful checks are slower than this
failure_threshold	3	Consecutive failures before alerting

create_dns_monitor

Parameter	Default	Meaning
hostname	required	Name to resolve, e.g. www.example.com
record_type	A	A, AAAA, CNAME, MX, TXT, or NS
expected_value	-	Alert when the answer no longer matches; without it, only resolution failure alerts, but answer changes are still tracked per location
check_interval_seconds	300	Seconds between checks

create_tcp_monitor

Parameter	Default	Meaning
host	required	Hostname or IP
port	required	TCP port
check_interval_seconds	300	Seconds between checks
failure_threshold	3	Consecutive failures before alerting

create_domain_expiry_monitor

Parameter	Default	Meaning
domain	required	Registrable domain, e.g. example.com
domain_expiry_alert_days	30	Days before expiry to alert (max 365)

The check runs daily. It also alerts if the registrar transfer lock is removed. See Domain and SSL expiry.

create_mail_monitor

Parameter	Default	Meaning
domain	required	Domain that sends or receives mail
require_dmarc_policy	-	Minimum DMARC policy: none, quarantine, or reject
check_interval_seconds	3600	Seconds between checks

Each check resolves MX, SPF (within the 10-lookup budget), DMARC, DKIM on common selectors, MTA-STS, and TLS-RPT, and queries Spamhaus, SpamCop, Barracuda, PSBL, and UCEPROTECT for every mail server address plus the Spamhaus DBL for the domain. It alerts on missing SPF or DMARC, +all, SPF PermError, a blocklist listing, or a DMARC policy weaker than the one required, and records an event when SPF or DMARC records change or a listing appears or clears.

create_monitor

The generic form takes monitor_type required (http, api, dns, tcp, domain, mail) and url required (the full URL for http and api, the hostname for dns and tcp, the registrable domain for domain and mail), plus http_method (GET), timeout_seconds (30), tcp_port, dns_record_type, expected_dns_host, ssl_cert_monitoring, ssl_cert_expiry_alert_days (14), domain_expiry_alert_days (30), response_time_alert_ms, failure_threshold (3), and the shared expected_status_code, expected_response_contains, and check_interval_seconds (300).

Heartbeats

Tool	Writes	What it does
list_heartbeats	no	All heartbeat monitors. offset, limit.
get_heartbeat	no	Full configuration and state, including the ping key. uuid required.
create_heartbeat	yes	Create a heartbeat and return the ping command. Idempotent by slug: if the slug exists it is pinged instead of duplicated.
enable_heartbeat	yes	Missed pings alert again. uuid required.
disable_heartbeat	yes	Missed pings stop alerting, for example while the job is intentionally stopped. uuid required.
delete_heartbeat	yes	Permanently delete; the ping URL stops working. uuid required.

create_heartbeat

Parameter	Default	Meaning
slug	required	Unique identifier, e.g. nightly-backup; letters, digits, dot, dash, underscore, max 64 characters
name	the slug	Display name
interval_seconds	86400	Expected ping interval
grace_seconds	3600	Grace period before a late ping counts as missed

Creation records a first ping and arms monitoring immediately, so the next real ping is expected within interval_seconds + grace_seconds. See Heartbeat monitoring.

Alerts and incidents

Tool	Writes	What it does
list_alerts	no	Alerts with name, status, severity, server, and timestamps. status filter: open, acknowledged, resolved. offset, limit.
get_alert	no	One alert with its full history and associated server. uuid required.
acknowledge_alert	yes	Acknowledge an open alert, which stops its escalation. uuid required.
resolve_alert	yes	Resolve an alert. It re-opens if the check fails again. uuid required.
list_incidents	no	Incidents with title, status, severity, and timeline. status filter: open, investigating, identified, monitoring, resolved. severity filter: minor, major, critical. offset, limit.
get_incident	no	One incident with its full timeline of updates. uuid required.

Servers and security events

Tool	Writes	What it does
add_server	yes	Register a Linux server for agent-based monitoring and return the one-line install command. server_name required, escalation_policy_uuid optional (defaults to the workspace default policy).
get_server_install_command	no	The install command for a server that has no agent reporting yet. The signed link inside it is valid for 24 hours. uuid required.
list_servers	no	Servers with status, hostname, IP addresses, OS, and agent version. offset, limit.
get_server	no	One server with checks, host info, uptime, and agent details. uuid required.
get_server_containers	no	Docker containers on a server with status, CPU, memory, and network stats. uuid required.
list_security_events	no	eBPF detections with filters. limit default 50, max 500.
get_security_event_stats	no	Counts by priority, rule, host, and AI verdict over a time range. duration default 24h.

add_server needs a free host seat on the plan; on a plan without one it returns an upgrade link instead of creating anything. The server shows as nocheckin until the agent installs and reports in.

list_security_events filters

Parameter	Default	Meaning
duration	24h	Time range, e.g. 1h, 24h, 7d
priority	-	emergency, alert, critical, error, warning, notice, informational, debug
rule	-	Rule name
host_uuid	-	Server UUID
llm_verdict	-	malicious, suspicious, benign, informational
event_class, agent_type	-	Event class and agent type

Change management

Tool	Writes	What it does
list_changes	no	Change requests with status, verification status, window, and servers. status filter: requested, approved, started, completed. host_uuid filter. offset, limit.
get_change	no	One change with its verification status: pending, running, clean, changes_detected, failed. uuid required.
create_change	yes	New change in requested status. title required, description, window_start and window_end required (RFC 3339, e.g. 2026-07-21T22:00:00Z), host_uuids required (at least one).
approve_change	yes	Move a requested change to approved. uuid required.
start_change	yes	Start an approved change. Side effect: opens a maintenance window (SSH unlock) on the change’s servers until the window end. uuid required.
complete_change	yes	Complete a started change. Side effect: re-locks the servers and starts an automatic file-integrity verification; poll get_change for the result. uuid required.
verify_change	yes	Re-run the verification for a completed change and return per-host changed-file lists. uuid required.

The loop these tools drive is described in Change tracking and change control.

Not exposed over MCP

Rosters, escalation policies, users, integrations, and billing are managed in the dashboard or through the HTTP API. Security events and incidents are read-only over MCP; there is no tool that deletes a server.