MCP
MCP reference
The OnlineOrNot MCP server exposes the OnlineOrNot API to compatible Model Context Protocol clients.
Endpoint
| Property | Value |
|---|---|
| URL | https://mcp.onlineornot.com/mcp |
| Transport | Streamable HTTP |
| OAuth metadata | https://mcp.onlineornot.com/.well-known/oauth-protected-resource/mcp |
| Server card | https://mcp.onlineornot.com/.well-known/mcp/server-card.json |
| Machine-readable guide | https://mcp.onlineornot.com/llms.txt |
Authentication
The server accepts OnlineOrNot OAuth access tokens and OnlineOrNot API tokens as HTTP bearer credentials.
OAuth-capable clients discover the OnlineOrNot authorization server from the protected-resource metadata. API-token clients send the token in the Authorization header.
The server card describes OAuth because that metadata enables automatic client discovery. API-token authentication is supported separately through a manually configured bearer header.
Credentials retain their OnlineOrNot organization, role, plan, endpoint, and grant restrictions. MCP does not bypass API authorization.
Tools
Code Mode is enabled by default and exposes two tools:
| Tool | Behavior |
|---|---|
search |
Runs read-only JavaScript against the generated OpenAPI description to find endpoints and schemas. |
execute |
Runs JavaScript that makes authenticated requests to allowed OnlineOrNot API endpoints. |
Appending ?codemode=false to the endpoint exposes one generated MCP tool per available API operation. This mode has a larger tool-list token cost and is intended for clients that cannot use Code Mode.
Resource categories
The generated API tool surface currently includes:
- Uptime, browser, DNS, and TCP checks
- Heartbeat monitors
- Status pages, components, status-page incidents, incident updates, and subscribers
- Maintenance windows
- API tokens
- Webhooks
- Organization users and invitations
- Audit logs
The available endpoint catalog is generated from the current OnlineOrNot OpenAPI description. Individual operations remain subject to plan availability and authorization.
Permissions
API tokens and OAuth access tokens use OnlineOrNot resource grants. READ permits retrieval operations. EDIT permits retrieval and mutation operations.
| Grant | Covers |
|---|---|
UPTIME_CHECKS |
Uptime, browser, DNS, and TCP checks |
HEARTBEAT_CHECKS |
Heartbeat monitors |
STATUS_PAGES |
Status pages, components, status-page incidents, updates, and subscribers |
MAINTENANCE_WINDOWS |
Maintenance windows |
PEOPLE |
Organization users, invitations, and audit-log reads |
INTEGRATIONS |
Notification integrations |
API_TOKENS |
API-token operations |
WEBHOOKS |
Generic webhooks |
Investigative agents normally require only the relevant READ grants. A mutation fails unless the credential has the matching EDIT grant. Token-management operations also enforce the API's privilege-escalation rules.
Audit-log retrieval requires PEOPLE:READ. There is no separate audit-log grant.
Organization selection
An API token is bound to one organization. For OAuth credentials with access to one organization, MCP selects it automatically. For OAuth credentials with access to multiple organizations, MCP requires the client to provide one of the authorized organization identifiers for each API execution.
Scope
OnlineOrNot MCP provides authenticated access to OnlineOrNot monitoring and status-page API workflows. It is not a hosted AI SRE, autonomous incident investigator, log-query product, or replacement for logs, metrics, tracing, APM, RUM, or error tracking.
See Connect an MCP client for setup instructions and the HTTP API documentation for endpoint request and response schemas.