MCP for AI assistants

Warden exposes a Streamable HTTP MCP endpoint at https://YOUR_WARDEN_HOST/api/mcp. It lets an MCP-compatible assistant answer operational questions from live Warden data. An editor key can also perform a limited set of monitoring changes.

Authentication

Create a role-scoped API key in Warden and send it as a bearer token. Use a viewer key by default. Create a separate editor key only when the assistant must change monitoring configuration.

{
  "mcpServers": {
    "warden": {
      "type": "http",
      "url": "https://warden.example.com/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

For Claude Code:

claude mcp add --transport http warden https://warden.example.com/api/mcp \
  --header "Authorization: Bearer YOUR_API_KEY"

Viewer tools

• list_monitors and get_monitor
• list_incidents
• get_monitor_events
• get_monitor_latency
• get_notification_config
• list_ssl_warnings
• check_now
• list_insights

Typical questions include “What is down right now?”, “Why did checkout fail last night?” and “Which certificates expire next?”.

Editor tools

An editor key additionally enables:

• create_monitors
• create_group
• rename_group
• move_monitor
• set_monitor_paused

MCP does not expose a delete tool. It also does not administer users, status pages, notification channels, incidents or maintenance windows. Use the Warden UI or REST API for those operations.

Security boundaries

Warden never returns users, sessions, passwords, API keys or webhook URLs through MCP. The get_monitor_events result may include up to 2 KB of the monitored response body. Treat that content as untrusted because a monitored page can contain instructions meant to influence an assistant. Keep viewer and editor keys separate, and rotate any key that might have been exposed.

Verify the connection

curl -i https://warden.example.com/api/mcp \
  -H "Authorization: Bearer YOUR_API_KEY"

Then ask the assistant to list monitors. If the request fails, confirm the Warden URL, the API key role and that the Authorization header reaches Warden through your proxy.