MCP Uptime Monitor
Check that an agent can connect and discover the tools it needs. Tool calls and schema monitoring are optional.
Create a monitor
- Choose New monitor → MCP. Enter the MCP endpoint, transport and authentication settings.
- Select the desired check regions, then choose Discover tools without calling them. The preview region is shown above the button and is the first selected region.
- Inspect input/output schemas and server annotations. Selecting a tool does not enable calls.
- Enter required tool names. Leave optional schema monitoring and calls off for discovery-only checks.
- Set the interval, timeout, thresholds and alert channels, then save. Use the detail page for timings, schema review and history.
An HTTP 200 alone cannot prove an agent can discover or use tools. Preview validates discovery without creating a monitor, calling tools, establishing a baseline or sending alerts.
Transport and authentication
Auto detect supports Streamable HTTP and legacy HTTP+SSE; either may be selected explicitly. Supported protocol versions are 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05. Modern servers use server/discover; earlier versions use initialization and the initialized notification. Local stdio is not supported.
Fallback is limited to unsupported-endpoint or negotiation responses, never authentication failures. Legacy SSE message endpoints must remain on the same origin. Invalid JSON-RPC, protocol errors, incomplete pagination and missing required tools fail the check.
Use request headers for static credentials, for example Authorization: Bearer …. OAuth supports client credentials and refresh-token grants. Explicitly trust an HTTPS issuer and supply its client ID, required credentials, optional scopes/resource and token authentication method. The issuer metadata supplies its token endpoint. Client-credentials mode requires a client secret.
{
"mode": "client_credentials",
"issuer": "https://auth.example.com",
"clientId": "YOUR_CLIENT_ID",
"clientSecret": "YOUR_CLIENT_SECRET",
"scopes": [
"mcp:read"
],
"resource": "https://mcp.example.com",
"tokenAuthMethod": "client_secret_basic"
}This is the optional mcpConfig.oauth object. For a previously authorized connection use mode: "refresh_token" with a refreshToken. Interactive browser sign-in is not provided. On PATCH, omit oauth to preserve the latest credentials; send null to remove them.
OAuth tokens renew automatically. A refresh token is write-only: the API never returns it, because the issuer rotates it and any copy goes stale. On PATCH, omit refreshToken to keep the stored (latest) token, or send a new one to replace it. Preview may consume and rotate a refresh token even though it does not call tools, so refresh-token preview needs a saved monitor: pass its monitorId and save changed endpoint/OAuth settings first; the stored token is updated on rotation. Without a monitorId it returns 400 mcp_refresh_requires_saved_monitor. Client-credentials preview works before saving.
Tool, prompt and resource discovery
Tool lists follow pagination and required names match exactly. Optional prompts and resources list names and identifiers without rendering prompts or reading resource contents. Read-only and destructive annotations are server claims, not safety guarantees; they never authorize tool calls.
Each list is limited to 20 pages and 1,000 entries. Responses are capped at 1 MiB each and 4 MiB across the check. The timeout covers protocol exchange, discovery and the optional call. Streamable HTTP SSE resumption uses at most three GET reconnects, never replaying a tool-call POST.
Optional repeated calls
Enable repeated tool calls is off by default. Enabling authorizes one call per scheduled check per selected region, plus manual checks. Calls may incur charges or write data. Use a dedicated test account, safe arguments and predictable tools. The form estimates 30-day call volume from interval and regions; it is not a price quote.
Choose a discovered tool or enter its exact name. Arguments must be a JSON object. JSON-RPC errors, isError: true and failed assertions fail checks. Pausing stops scheduled checks. Disabling calls preserves valid arguments for later use.
Assertions use JSON Pointer, such as /structuredContent/ok or /content/0/text; empty selects the whole result. Exists checks presence, Equals compares JSON values, and Contains checks a string substring or array element. Values are JSON: true is boolean and "ok" is text.
Imports reject enabled calls. Import with calls disabled, review, then enable explicitly. Exports omit the refresh token and client secret, and imports refuse a row that carries mcpConfig.oauth: import without it, then enter the OAuth settings on the monitor. Configuration is at most 16 KiB of UTF-8 JSON, with 100 required names (128 characters each) and 20 assertions.
Review schema changes
Enable schema monitoring to save the first successful check as the approved baseline. Later discoveries compare input/output contracts, required parameters, types and supported constraints. Changes are breaking, warning or informational. This cannot prove every possible JSON Schema behavior compatible.
- Mark down and alert: breaking changes fail the check before any tool call.
- Mark degraded and alert: continue an explicitly enabled call; if successful, report degradation and use incident alerts.
- Record only: retain schema drift without a schema incident and continue an explicitly enabled call.
Tool and assertion failures still fail under every policy. Warning and informational changes are recorded in history.
Compare the approved and discovered schemas side by side. Tick I reviewed this discovered schema version, then choose Accept reviewed schema version. Approval names the exact observationId and schemaHash. A newer observation requires another review: no unknown future version is accepted, and approval never calls tools. Probe-setting edits preserve the baseline; connection/authentication changes establish a new context.
History, regions and alerts
The 7/30-day history includes total and per-stage p50/p95, region-labelled charts, timing samples and schema-change events. Charts show up to 120 recent results; metrics cover all retained samples in the selected window. Missing stages remain absent. History stores diagnostics, not raw tool outputs or credentials.
Configured regions can run MCP checks; keep probes updated for MCP support. Each region counts as a check and may execute the enabled tool, increasing call volume. Existing failure/recovery thresholds, channels, dependencies and maintenance rules apply. Status pages publish health without credentials or tool arguments.
Owners/admins configure connections, preview, manually check, inspect MCP schemas/history and approve baselines. Other roles can read normal health and check history.
Notifications use at-least-once delivery: a provider can receive a duplicate if delivery succeeds but the process stops before saving its acknowledgement. Quota authorization is persisted and reused, but an interruption between an external quota debit and saving that authorization can rarely debit quota twice. Unknown or denied authorization does not permit delivery.
For multi-region checks, each stage duration is the maximum among responding regions; total latency follows the regional aggregation. Schema changes retain their region in history. Establishing or accepting a baseline requires complete, matching tool contracts from the responding regions.
Private-network MCP endpoints
Run a Node probe inside the network. A deployment administrator must mark its API region private: true and enable ALLOW_PRIVATE_TARGETS=true on that probe. Workspace users cannot declare private regions.
Use private regions only on a single-tenant deployment. A private region is available to every workspace on the deployment, and an MCP monitor that checks only from private regions skips the coordinator's private-target check. Anyone who can create a monitor can then reach addresses inside that network through the probe.
# API coordinator: deployment administrator configuration
PROBE_REGIONS='{"office":{"url":"https://office-probe.example.com/","name":"Office network","private":true}}'
# Node probe inside that network
ALLOW_PRIVATE_TARGETS=true
# Set the same PROBE_SECRET on the coordinator and probe.Select only approved private regions under Check from, excluding auto. The coordinator can accept that private MCP target without globally allowing its own private-target access. Preview sends the first selected region: check its displayed label. Header-authenticated discovery and calls run on the remote probe. Unreachable MCP probes never trigger automatic local retries.
OAuth still performs central discovery. The coordinator must be able and permitted to fetch MCP protected-resource metadata and trusted issuer metadata/token endpoints. A private probe does not grant this access. Provide centrally reachable metadata and suitable coordinator network policy, or use header authentication for endpoints accessible only inside the probe network. Private probes alone do not guarantee private OAuth compatibility.
API examples
POST /api/monitors using your OpenUptime credentials. Headers in this JSON belong to the monitored server.
{
"name": "Production MCP",
"type": "mcp",
"target": "https://mcp.example.com/mcp",
"headers": {
"Authorization": "Bearer YOUR_MCP_TOKEN"
},
"intervalSec": 300,
"timeoutMs": 10000,
"mcpConfig": {
"transport": "auto",
"requiredTools": [
"get_status"
],
"schemaCheck": false,
"toolCall": null
}
}After reviewing a safe tool, PATCH /api/monitors/:id. Adapt arguments and result paths to your service.
{
"mcpConfig": {
"transport": "auto",
"requiredTools": [
"get_status"
],
"schemaCheck": true,
"driftPolicy": "down",
"toolCall": {
"enabled": true,
"name": "get_status",
"arguments": {
"environment": "test"
},
"assertions": [
{
"path": "/structuredContent/ok",
"operator": "equals",
"value": true
}
]
}
}
}POST /api/monitors/mcp/preview accepts target, headers, timeoutMs, mcpConfig, region and optional monitorId. GET /api/monitors/:id/mcp-history?days=7 returns history (7 or 30 days). POST /api/monitors/:id/mcp-baseline/accept accepts the reviewed observationId and schemaHash.
Understand failures
The failed stage locates OAuth, service discovery/initialization, catalog listing, required names, schema comparison, tool calls or assertions. Check server logs for details: raw server errors and outputs are not retained. Failure/recovery thresholds control incident opening and resolution.
To let an agent manage OpenUptime itself, see the separate MCP server guide.
MCP Uptime Monitor：MCP 可用性监控
检查 Agent 能否连接并发现所需工具。工具调用与 schema 监控可选开启。
创建监控
- 选择新建监控 → MCP，填写端点、传输方式和鉴权配置。
- 选择检测区域，然后点击发现工具（不调用）。预览使用第一个已选区域，按钮上方显示其名称。
- 检查输入/输出 schema 和注解。选择工具不会自动启用调用。
- 填写必需工具名称。仅检查发现能力时，关闭可选 schema 监控和调用。
- 设置间隔、超时、阈值与渠道并保存；在详情页查看耗时、schema 审阅与历史。
HTTP 200 不能证明 Agent 可以发现或使用工具。预览验证发现能力，不创建监控、不调用工具、不建立基线，也不发送告警。
传输与鉴权
自动检测支持 Streamable HTTP 和旧版 HTTP+SSE，也可显式指定。支持 2026-07-28、2025-11-25、2025-06-18、2025-03-26、2024-11-05 协议。新版本使用 server/discover，旧版本执行初始化和 initialized 通知。不支持本地 stdio。
仅在端点不支持或协商错误时回退，鉴权失败不会触发回退。旧版 SSE 消息端点必须同源。JSON-RPC 错误、协议错误、分页不完整或缺少必需工具使检测失败。
静态凭据可使用请求头，例如 Authorization: Bearer …。OAuth 支持客户端凭据和刷新令牌授权：明确指定受信任的 HTTPS 签发方、客户端 ID、必要凭据，以及可选权限范围、资源和令牌鉴权方式。令牌端点由签发方元数据提供。客户端凭据模式必须提供客户端密钥。
{
"mode": "client_credentials",
"issuer": "https://auth.example.com",
"clientId": "YOUR_CLIENT_ID",
"clientSecret": "YOUR_CLIENT_SECRET",
"scopes": [
"mcp:read"
],
"resource": "https://mcp.example.com",
"tokenAuthMethod": "client_secret_basic"
}以上是可选 mcpConfig.oauth 对象。已有授权使用 mode: "refresh_token" 和 refreshToken。不提供浏览器交互登录。PATCH 省略 oauth 保留最新凭据，传 null 才移除。
OAuth 令牌自动续期。刷新令牌只写不读：签发方会轮换它，任何副本很快失效，因此 API 从不返回它。PATCH 时省略 refreshToken 即保留已存储的最新令牌，传入新值则替换。预览虽然不调用工具，也可能消费并轮换刷新令牌，所以刷新令牌模式的预览需要已保存的监控：传入 monitorId，并先保存端点/OAuth 改动，轮换后的令牌会写回存储。未传 monitorId 时返回 400 mcp_refresh_requires_saved_monitor。客户端凭据模式可在保存前预览。
发现工具、提示词和资源
工具列表支持分页，必需名称完全匹配。可选提示词/资源发现仅列出名称与标识，不渲染提示词或读取资源内容。只读和破坏性注解是服务端声明，不是安全保证，也不会自动授权调用。
每类列表最多 20 页、1,000 条；单响应最多 1 MiB，整次检测最多 4 MiB。协议、发现和可选调用共用超时预算。Streamable HTTP 的 SSE 续传最多通过 GET 重连三次，不重发工具调用 POST。
可选周期调用
启用周期工具调用默认关闭。开启后，每个所选区域的每次定时检测及手动检测都会调用一次，可能产生费用或写入数据。请使用专用测试账号、安全参数和可预测工具。表单按间隔和区域估算 30 天调用次数，不代表报价。
选择已发现工具或填写准确名称，参数为 JSON 对象。JSON-RPC 错误、isError: true 或断言失败使检测失败。暂停停止定时检测；关闭调用保留合法参数。
断言使用 JSON Pointer，例如 /structuredContent/ok、/content/0/text；留空选择整个结果。存在检查路径，等于比较 JSON 值，包含检查子串或数组元素。期望值为 JSON：true 是布尔值，"ok" 是文本。
导入拒绝已开启的调用。先关闭调用再导入，审阅后显式开启。导出不含刷新令牌和客户端密钥；导入会拒绝带 mcpConfig.oauth 的条目：请去掉后导入，再在监控上填写 OAuth 设置。配置最多 16 KiB UTF-8 JSON，100 个必需工具名称（每个 128 字符）和 20 条断言。
审阅 Schema 变化
开启 schema 监控，首次完整检测成功的结果成为基线。后续比较输入/输出接口、必填参数、类型及受支持约束，分为破坏性、警告和信息级别；不能证明全部 JSON Schema 行为兼容。
- 标记为宕机并告警：破坏性变化使检测失败，在调用工具前停止。
- 标记为降级并告警：继续显式开启的调用，成功后报告降级并通过事件告警。
- 仅记录：保留漂移历史，不因 schema 创建事件，并继续显式开启的调用。
任何策略下，工具和断言失败仍使检测失败；警告与信息记录历史。
并排比较已批准和新发现的 schema，勾选我已审阅此 schema 版本，再点击接受已审阅的 schema 版本。批准绑定准确的 observationId 和 schemaHash。新观测需要重新审阅，不会接受未知的未来版本，批准也不调用工具。探测设置变更保留基线；连接/鉴权变化会建立新的上下文。
历史、区域和告警
7/30 天历史含整体与各阶段 p50/p95、区分区域的曲线、耗时样本和 schema 事件。图表最多 120 条最近结果，指标覆盖所选窗口保留的全部样本；未执行阶段留空。只保存诊断，不保存原始输出和凭据。
MCP 可使用已配置的区域，请更新探针以支持 MCP。每个区域计一次检测，也可能执行已开启工具，增加调用次数。沿用失败/恢复阈值、渠道、依赖和维护规则。状态页公开健康状态，不公开凭据或工具参数。
所有者/管理员可配置、预览、手动检测、查看 MCP schema/历史和批准基线；其他角色可读常规健康状态与检测历史。
通知采用至少一次投递：服务商接收成功后、确认落库前进程中断，可能重复发送。额度授权会持久化并复用，但外部额度扣减与本地授权落库之间极窄的中断窗口可能重复扣额；授权未知或被拒绝均不会放行投递。
多区域检测的每阶段耗时取回答区域中的最大值，总耗时沿用区域聚合规则。Schema 变化在历史中带有区域来源；建立或接受基线要求所有回答区域的工具契约完整且一致。
内网 MCP 与私有探针
在目标网络运行 Node 探针。部署管理员须将 API 区域标记 private: true，并在探针开启 ALLOW_PRIVATE_TARGETS=true。普通用户不能自行声明私有区域。
私有区域只适合单租户部署。部署上的每个工作区都能使用私有区域；只从私有区域检测的 MCP 监控会跳过协调器对私有目标的检查。任何能创建监控的人都可以借探针访问该网络内的地址。
# API coordinator: deployment administrator configuration
PROBE_REGIONS='{"office":{"url":"https://office-probe.example.com/","name":"Office network","private":true}}'
# Node probe inside that network
ALLOW_PRIVATE_TARGETS=true
# Set the same PROBE_SECRET on the coordinator and probe.检查位置仅选择已批准私有区域，排除 auto；协调器即可接受此私有 MCP 目标，无需全局开启自身私有访问。预览发送第一个已选区域，运行前请核对名称。请求头鉴权的发现/调用在远端探针执行，探针无法连接时不自动改为本地重试。
OAuth 仍需中央发现。协调器必须能够且被策略允许访问 MCP 受保护资源元数据，以及受信任签发方的元数据/令牌端点。私有探针不赋予协调器这种访问权限。请提供中央可达元数据并配置网络策略；完全仅在探针网络可达的端点可使用请求头鉴权。不能假定私有探针保证内网 OAuth 完整兼容。
API 示例
使用 OpenUptime 凭据 POST /api/monitors；JSON 内请求头属于被监控服务。
{
"name": "Production MCP",
"type": "mcp",
"target": "https://mcp.example.com/mcp",
"headers": {
"Authorization": "Bearer YOUR_MCP_TOKEN"
},
"intervalSec": 300,
"timeoutMs": 10000,
"mcpConfig": {
"transport": "auto",
"requiredTools": [
"get_status"
],
"schemaCheck": false,
"toolCall": null
}
}审阅安全工具后 PATCH /api/monitors/:id，按服务调整参数和结果路径：
{
"mcpConfig": {
"transport": "auto",
"requiredTools": [
"get_status"
],
"schemaCheck": true,
"driftPolicy": "down",
"toolCall": {
"enabled": true,
"name": "get_status",
"arguments": {
"environment": "test"
},
"assertions": [
{
"path": "/structuredContent/ok",
"operator": "equals",
"value": true
}
]
}
}
}POST /api/monitors/mcp/preview 接受 target、headers、timeoutMs、mcpConfig、region 和可选 monitorId。GET /api/monitors/:id/mcp-history?days=7 返回 7 或 30 天历史。POST /api/monitors/:id/mcp-baseline/accept 提交已审阅 observationId 和 schemaHash。
排查失败
阶段定位 OAuth、服务发现/初始化、目录列表、必需名称、schema、工具调用或断言。详细原因查服务端日志，不保留原始服务错误和输出。失败/恢复阈值控制事件开启与恢复。
如需 Agent 管理 OpenUptime，见单独的 MCP 服务指南。
Last updated 2026-10-31最后更新：2026-10-31