MCP tool reference
The Monitorable MCP server offers 19 tools, generated from the server’s own tool catalog. Your assistant sees only the tools your API key may use: a tool needs every scope listed for it, and a tool that changes data is shown only to an admin-role key. Scopes are explained on API keys and scopes; the overview, connection snippets and limits are on MCP server.
acknowledge_incident
Section titled “acknowledge_incident”Acknowledge an incident
Scope: alerts:write. Changes data. Repeating the same call has the same effect (idempotent).
Acknowledges an open incident as this API key (the dashboard shows it as “(API key)”), or, over a connected app, as the signed-in user; a resolved incident is a tool error (incident_resolved). Marks the incident acknowledged: stops reminders, notifies nobody. Idempotent.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
incident_id |
integer | yes | the incident’s id, as list_incidents returns it |
Returns: acked_at, acked_by, incident_id, state.
create_server
Section titled “create_server”Create a server
Scope: servers:write. Changes data. Not idempotent: repeating the call repeats the change.
Registers a new server to monitor and returns the command that installs its agent. Not idempotent: calling it twice creates two servers. Creates a server and counts toward the plan limit; returns the agent key once.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
name |
string | yes | the server’s display name, 1 to 100 characters |
Returns: agent_api_key, install_command, server, warning.
get_incident
Section titled “get_incident”Get an incident
Scope: alerts:read. Read-only: it changes nothing.
One incident with the notifications sent for it, oldest first (at most 200): which channel, what kind (fire, resolve, reminder, escalation, or why nothing was sent) and whether it was accepted. Read-only; one API call against the key’s rate limit.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
incident_id |
integer | yes | the incident’s id, as list_incidents returns it |
Returns: deliveries, incident.
get_server
Section titled “get_server”Get a server
Scope: servers:read. Read-only: it changes nothing.
One server in full: its row from list_servers plus the IPv4 and IPv6 address it connects from, its mute state, its alert template and the hardware and operating-system facts the agent reported (metadata is null until the agent has reported them). For history use get_server_metrics. Read-only; two API calls against the key’s rate limit.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
server_id |
integer | yes | the server’s id, as list_servers returns it |
Returns: alert_template_id, alerts_muted_reason, alerts_muted_until, ipv4, ipv6, metadata, server.
get_server_current
Section titled “get_server_current”Get a server’s current metrics
Scope: metrics:read. Read-only: it changes nothing.
The latest value of each headline metric of one server: processor load and usage, memory, the root filesystem, swap and network throughput with the per-interface rates. Bytes are IEC, network rates are bits per second, percentages run 0-100, and a value the agent does not report is 0. For history use get_server_metrics. Read-only; one API call against the key’s rate limit.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
server_id |
integer | yes | the server’s id, as list_servers returns it |
Returns: cpu, disk, memory, network, server_id, swap, timestamp.
get_server_metrics
Section titled “get_server_metrics”Get a server’s metrics over time
Scope: metrics:read. Read-only: it changes nothing.
Metrics of one server over a window as named series (cpu.usage_percent, memory.used_bytes, disk.busy_percent, network.rx_bits_per_sec, …) on one shared list of up to 120 timestamps, each with a value per timestamp (null where it has no point) and a summary (current, avg, max, p95) taken over all the points before they were thinned. Pick the window with range (1h, 6h, 24h, 7d or 30d; default 24h) or an exact start and end (RFC 3339, both). series picks the groups: cpu, memory, swap, disk, network, connections, ports; it defaults to cpu, memory and disk, so ask for network or the rest by name; disk and ports return one series per device or port; pass series to narrow. Units: bytes are IEC, network rates are bits per second, percentages run 0-100. A window older than the plan’s retention is refused with range_not_in_plan. Use get_server_current for the latest values only. Read-only; one API call against the key’s rate limit (a window over 7 days counts against a stricter one).
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
server_id |
integer | yes | the server’s id, as list_servers returns it |
end |
string | no | end of an exact window (RFC 3339); needs start |
range |
string | no | the last 1h, 6h, 24h, 7d or 30d (default 24h); ignored when start and end are given |
series |
string[] | no | metric groups to return: cpu, memory, swap, disk, network, connections, ports (default cpu, memory and disk) |
start |
string | no | start of an exact window (RFC 3339, e.g. 2026-11-01T00:00:00Z); needs end, and replaces range |
Returns: end, series, server_id, start, step_seconds, timestamps.
list_alert_templates
Section titled “list_alert_templates”List alert templates
Scope: alerts:read. Read-only: it changes nothing.
Lists the organization’s alert templates with their rules: which rule types are enabled, their thresholds and windows, and the channels each notifies. A server uses one template (get_server shows its alert_template_id; 0 is the default template). Read-only; one API call against the key’s rate limit.
Input parameters: none.
Returns: templates.
list_incidents
Section titled “list_incidents”List incidents
Scope: alerts:read. Read-only: it changes nothing.
Lists the alert incidents of the key’s organization, newest first. By default only open incidents (pending or firing) are listed; state=resolved or state=all widens that. Filter by server_id or by since (RFC 3339). Use get_incident for the notifications sent for one. Read-only; one page per call, pass next_cursor for more.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
cursor |
string | no | the next_cursor of the previous page; omit for the first page |
limit |
integer | no | page size, 1-100 (default 25; larger values are clamped to 100) |
server_id |
integer | no | only incidents of this server, as list_servers returns its id; omit for every server |
since |
string | no | only incidents that started at or after this time, RFC 3339 (e.g. 2026-11-01T00:00:00Z) |
state |
string | no | open (pending or firing, the default), resolved or all |
Returns: incidents, next_cursor.
list_notification_channels
Section titled “list_notification_channels”List notification channels
Scope: alerts:read. Read-only: it changes nothing.
Lists the organization’s notification channels with the outcome of their latest delivery. A channel’s settings (URLs, tokens, addresses) are never returned. Read-only; one API call against the key’s rate limit.
Input parameters: none.
Returns: channels.
list_server_containers
Section titled “list_server_containers”List a server’s Docker containers
Scope: servers:read. Read-only: it changes nothing.
The Docker containers the agent reported for a server, with status, health, CPU, memory, network rates and restart counts. At most 100 rows; total is how many the agent reported. Read-only; one API call against the key’s rate limit.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
server_id |
integer | yes | the server’s id, as list_servers returns it |
Returns: containers, shown, total.
list_server_disks
Section titled “list_server_disks”List a server’s disks
Scope: servers:read. Read-only: it changes nothing.
The physical disks of a server and their SMART health: capacity, wear, temperature and error counts. Bare-metal servers only; a virtual machine reports none. At most 100 rows; total is how many the agent reported. Read-only; one API call against the key’s rate limit.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
server_id |
integer | yes | the server’s id, as list_servers returns it |
Returns: disks, shown, total.
list_server_ports
Section titled “list_server_ports”List a server’s listening ports
Scope: servers:read. Read-only: it changes nothing.
The ports a server listens on and the snapshot they came from (snapshot.received_at says how fresh the list is, all_ports_truncated whether it is partial). At most 100 rows; total is how many the agent reported. Read-only; one API call against the key’s rate limit.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
server_id |
integer | yes | the server’s id, as list_servers returns it |
Returns: ports, shown, snapshot, total.
list_server_services
Section titled “list_server_services”List a server’s systemd services
Scope: servers:read. Read-only: it changes nothing.
The systemd services the agent reported for a server, with state, restarts, CPU and memory. By default only failed units are returned (failed_only=false lists every unit); total is how many services the agent reported and at most 100 rows are returned. Read-only; one API call against the key’s rate limit.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
server_id |
integer | yes | the server’s id, as list_servers returns it |
failed_only |
boolean | no | only units in state failed (default true) |
Returns: services, shown, total.
list_servers
Section titled “list_servers”List servers
Scope: servers:read. Read-only: it changes nothing.
Lists the servers of the key’s organization, oldest id first, as compact rows: liveness status, triage tier, last report, agent version, location, uptime and incident counts. Filter by status (online, stale, offline or dormant) or by part of the name. Use get_server for one server’s addresses, mute state and hardware. Read-only; one page per call, pass next_cursor for more.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
cursor |
string | no | the next_cursor of the previous page; omit for the first page |
limit |
integer | no | page size, 1-100 (default 25; larger values are clamped to 100) |
q |
string | no | only servers whose name contains this text, ignoring case |
status |
string | no | only servers with this liveness: online, stale, offline or dormant; omit for every server |
Returns: next_cursor, servers.
mute_server_alerts
Section titled “mute_server_alerts”Mute a server’s alerts
Scope: alerts:write. Destructive: your AI client should ask you before it runs. Repeating the same call has the same effect (idempotent).
Mutes a server’s alerts: silences every alert for this server until lifted or until until; incidents still open stay open. Muting an already muted server replaces the end and the reason. Lift it with unmute_server_alerts. Changes the server’s mute state; idempotent.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
server_id |
integer | yes | the server’s id, as list_servers returns it |
reason |
string | no | why the server is muted, shown in the dashboard; at most 200 characters, no control characters |
until |
string | no | when the mute ends, RFC 3339 (e.g. 2026-11-04T06:00:00Z); in the future, at most 366 days ahead; omit to mute until lifted |
Returns: muted, reason, server_id, until.
remove_server
Section titled “remove_server”Remove a server
Scope: servers:write and servers:read (both). Destructive: your AI client should ask you before it runs. Not idempotent: repeating the call repeats the change.
Permanently deletes the server and all its history. Pass confirm = the server’s exact name. If confirm is refused, re-check server_id with list_servers; never retry with the name from the error unless it is the server you mean to delete. Two API calls against the key’s rate limit.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
confirm |
string | yes | the server’s exact name, character for character (case-sensitive); the deletion is refused otherwise |
server_id |
integer | yes | the server’s id, as list_servers returns it |
Returns: deleted, name, server_id.
search_docs
Section titled “search_docs”Search the documentation
Scope: Any key. Read-only: it changes nothing.
Finds pages of the Monitorable documentation by keyword and returns each page’s title, address and a short excerpt, best match first. Use it for how-to questions: installing the agent, enrolling a server, alert rules, API keys. Searches the published Monitorable docs; costs nothing.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
query |
string | yes | what to look for, in a few plain words, e.g. enroll a server or alert rules |
limit |
integer | no | how many pages to return, 1-10 (default 5; larger values are clamped to 10) |
Returns: docs_url, results.
unmute_server_alerts
Section titled “unmute_server_alerts”Unmute a server’s alerts
Scope: alerts:write. Changes data. Repeating the same call has the same effect (idempotent).
Lifts a server’s mute now, so its alerts notify again; unmuting a server that is not muted answers muted=false. Changes the server’s mute state; idempotent.
Input parameters
| Name | Type | Required | Description |
|---|---|---|---|
server_id |
integer | yes | the server’s id, as list_servers returns it |
Returns: muted, reason, server_id, until.
whoami
Section titled “whoami”Current API key and organization
Scope: Any key. Read-only: it changes nothing.
Describes the API key or connected app this connection uses: who is acting, its name, role, scopes and expiry, the organization it acts in and the plan. With the account:read scope it also returns the plan’s count limits and the organization’s current usage. Use it to learn which tools the key can call and why one is missing. Changes nothing; one API call against the key’s rate limit, two with account:read.
Input parameters: none.
Returns: actor, auth, key, limits, note, organization, plan_name, usage.