io.usefulapi/updown-io
REMOTE · UPDOWN-IO.USEFULAPI.IO · SCANNED OCT 4
Check updown.io uptime checks, downtimes, response metrics and status pages, and create checks.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security89
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability72
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2441 tokens (~174/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the io.usefulapi/updown-io MCP server?
io.usefulapi/updown-io is a hosted endpoint at https://updown-io.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · updown-io.usefulapi.io
claude mcp add --transport http io-usefulapi-updown-io 'https://updown-io.usefulapi.io/mcp'
{
"mcpServers": {
"io-usefulapi-updown-io": {
"url": "https://updown-io.usefulapi.io/mcp"
}
}
} {
"servers": {
"io-usefulapi-updown-io": {
"type": "http",
"url": "https://updown-io.usefulapi.io/mcp"
}
}
} [mcp_servers.io-usefulapi-updown-io] url = "https://updown-io.usefulapi.io/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"io-usefulapi-updown-io": {
"type": "remote",
"url": "https://updown-io.usefulapi.io/mcp",
"enabled": true
}
}
} openclaw mcp add io-usefulapi-updown-io --url 'https://updown-io.usefulapi.io/mcp' --transport streamable-http
mcp_servers:
io-usefulapi-updown-io:
url: "https://updown-io.usefulapi.io/mcp" {
"McpServers": {
"io-usefulapi-updown-io": {
"Transport": "http",
"Url": "https://updown-io.usefulapi.io/mcp"
}
}
} assistant mcp add io-usefulapi-updown-io -t streamable-http -u 'https://updown-io.usefulapi.io/mcp'
{
"mcpServers": {
"io-usefulapi-updown-io": {
"type": "http",
"url": "https://updown-io.usefulapi.io/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Oct 26 0
- Stability: unverified → 0.03 ▲ functional
- 2 Oct 26 +42
- Authorization: unverified → pass ▲ security
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- First check of Authorization: partial security
- MCP protocol: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Destructive annotations: pass functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 100 functional
- 1 Oct 26 +15
- HTTPS: unverified → pass ▲ security
- Transport: fail → pass ▲ security
- Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the whole tool list to see what that exposes. security
- Tool safety: Tool safety blocked by authentication: the endpoint requires auth we don't have to read its tools. security
- Tool coverage: Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools. functional
- Schema quality: Schema blocked by authentication: the endpoint requires auth we don't have to read it. functional
- Capabilities: Capabilities blocked by authentication: the endpoint requires auth we don't have to read them. functional
- 29 Sept 26 18
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Oct 2026 · Probed https://updown-io.usefulapi.io/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=usefulapi.io | CN=WE1,O=Google Trust Services,C=US | 13 Sept 2026 | 12 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | d9be3287b0fde9630e825ba1f79bff3f |
| SANs: usefulapi.io, *.usefulapi.io | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of updown-io.usefulapi.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 57355 | 8 | Verified |
| usefulapi.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer realm="OAuth", resource_metadata="https://updown-io.usefulapi.io/.well-known/oauth-protected-resource/mcp"
Bearer realm="OAuth", resource_metadata="https://updown-io.usefulapi.io/.well-known/oauth-protected-resource/mcp"Protected resource metadata
| Document | https://updown-io.usefulapi.io/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://updown-io.usefulapi.io/mcp |
| Authorisation server | https://updown-io.usefulapi.io |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://updown-io.usefulapi.io/mcp | Verified | 200 | |
| http (plaintext) | http://updown-io.usefulapi.io/mcp | HTTPS enforced | 301 | https://updown-io.usefulapi.io/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
updown_add_recipient Add an alert recipient ~175
Add an alert recipient: an email address, phone number (sms), webhook URL, Slack-compatible incoming-webhook URL, or Microsoft Teams webhook URL. Returns the new (or already-existing) recipient with its id. By default it is selected on ALL existing checks; pass selected=false to add it unattached. Slack/Telegram/Zapier/Statuspage integrations must be set up in the web UI. Requires the read/write API key. updown: POST /api/recipients.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Optional friendly label (webhooks only at the moment). |
| selected | boolean | – | true (default) = selected on all existing checks; false = not selected on any check. |
| type | string | yes | Recipient type. |
| value | string | yes | The email address, phone number or URL. |
No output schema declared.
No examples provided.
updown_create_check Create a check ~514
Add a new monitoring check. The type (http, https, tcp, tcps, icmp) is inferred from the URL scheme; pass type 'pulse' (and no URL) for a cron/heartbeat check. Each check consumes updown credits while enabled. Requires the read/write API key. updown: POST /api/checks.
| Name | Type | Req | Description |
|---|---|---|---|
| alias | string | – | Human-readable name for the check. |
| apdex_t | number | – | APDEX threshold in seconds: 0.125, 0.25, 0.5, 1.0, 2.0, 4.0 or 8.0 (default 0.5). |
| custom_headers | object | – | HTTP headers updown sends with each request, e.g. { "X-Api-Key": "..." }. |
| disabled_locations | array | – | Monitoring locations to disable: lan, mia, tor, rbx, fra, cap, hel, sin, tok, syd. |
| enabled | boolean | – | Whether the check runs. false pauses it (reversible). |
| http_body | string | – | HTTP body sent with the request. |
| http_verb | string | – | HTTP verb for the request (default GET/HEAD). |
| mute_until | string | – | Mute notifications until a time (ISO8601, e.g. 2026-10-01T08:00:00Z), or 'recovery', or 'forever'. |
| period | integer | – | Interval in seconds. Regular checks: 15, 30, 60, 120, 300, 600, 1800 or 3600 (default 60). Pulse checks: anywhere from 15 s to 1 month. |
| published | boolean | – | Whether the check's public status page is visible (default false). |
| recipients | array | – | Alert recipient ids to select, e.g. ['email:12345', 'sms:67890'] (from updown_list_recipients). |
| string_match | string | – | Text that must appear in the response. For TCP/TCPS checks, '<closed>' inverts the check (alert if the port is open). |
| type | string | – | Check type; inferred from the URL by default — mainly useful for 'pulse'. |
| url | string | – | The URL to monitor, e.g. https://example.com, tcp://host:port, icmp://host. Omit for pulse checks. |
No output schema declared.
No examples provided.
updown_create_status_page Create a status page ~137
Create a status page showing the given checks, in order. Returns its token and URL. Requires the read/write API key. updown: POST /api/status_pages.
| Name | Type | Req | Description |
|---|---|---|---|
| access_key | string | – | Access key for protected pages (defaults to a random 30-byte string). |
| checks | array | yes | Check tokens to show, in display order, e.g. ['dmbe', 'ngg8']. |
| description | string | – | Text displayed below the name (supports newlines and links). |
| name | string | – | Name of the status page. |
| visibility | string | – | Page visibility (default public). |
No output schema declared.
No examples provided.
updown_find_problems Find checks with problems ~101
One-call health overview across every check: which are DOWN (since when, error), which have an invalid SSL certificate, which certificates or domains expire within N days, and which checks are paused or muted. Built from GET /api/checks.
| Name | Type | Req | Description |
|---|---|---|---|
| domain_days | integer | – | Flag domains expiring within this many days (default 30). |
| ssl_days | integer | – | Flag SSL certificates expiring within this many days (default 14). |
No output schema declared.
No examples provided.
updown_get_check Get one check ~106
Fetch a single check by token, optionally with the last hour of performance metrics and/or the detailed results of the last 5 requests. updown: GET /api/checks/:token.
| Name | Type | Req | Description |
|---|---|---|---|
| metrics | boolean | – | Include performance metrics for the last hour. |
| results | boolean | – | Include detailed results of the last 5 requests (can be large). |
| token | string | yes | The check's unique token, e.g. ngg8 (from updown_list_checks). |
No output schema declared.
No examples provided.
updown_get_check_metrics Get a check's metrics ~210
Get aggregated metrics for one check over a time range: uptime, apdex, timings (redirect/namelookup/connection/handshake/response/total, ms) and request counts by response time. Optionally group by 'time' or by 'host' (monitoring location). Data is hourly (daily after 2 days, monthly after 40 days); the range must span at least one hour. Uptime is not returned when grouping. updown: GET /api/checks/:token/metrics.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | – | Start time (ISO8601, RFC2822 or YYYY-MM-DD; UTC if no zone). Default: 1 month ago. |
| group | string | – | Group results by 'time' or by 'host' (location). |
| to | string | – | End time, same formats. Default: now. |
| token | string | yes | The check's unique token, e.g. ngg8 (from updown_list_checks). |
No output schema declared.
No examples provided.
updown_list_checks List checks ~99
List all monitoring checks on the account with their status (down, uptime, last_status, error), period, SSL certificate and domain-expiry info. Optionally filter client-side by status or a text match on URL/alias. updown: GET /api/checks.
| Name | Type | Req | Description |
|---|---|---|---|
| search | string | – | Case-insensitive substring to match against the check URL or alias. |
| status | string | – | Only checks in this state (default all). |
No output schema declared.
No examples provided.
updown_list_downtimes List a check's downtimes ~128
List the downtimes of one check, newest first, 100 per page: error, started_at, ended_at, duration (seconds) and a details URL. updown: GET /api/checks/:token/downtimes.
| Name | Type | Req | Description |
|---|---|---|---|
| page | integer | – | Page to fetch (100 per page, default 1). |
| results | boolean | – | Include detailed results (last 5 requests before the downtime and recovery). Can be large. |
| token | string | yes | The check's unique token, e.g. ngg8 (from updown_list_checks). |
No output schema declared.
No examples provided.
updown_list_node_ips List monitoring node IPs ~87
List updown.io's server IP addresses — e.g. to allowlist the monitors in a firewall. Choose all, ipv4 or ipv6. Public — no API key needed. updown: GET /api/nodes/ips, /api/nodes/ipv4, /api/nodes/ipv6.
| Name | Type | Req | Description |
|---|---|---|---|
| family | string | – | Address family (default all). |
No output schema declared.
No examples provided.
updown_list_nodes List monitoring nodes ~74
List updown.io's monitoring/webhook servers keyed by location code (lan, mia, tor, rbx, fra, cap, hel, sin, tok, syd) with IPv4, IPv6, city, country and coordinates. Public — no API key needed. updown: GET /api/nodes.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
updown_list_recipients List alert recipients ~71
List the alert recipients/channels on the account (email, sms, slack, telegram, webhook, zapier, ...). The `id` (e.g. email:3719031852) is what check `recipients` take. updown: GET /api/recipients.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
updown_list_status_pages List status pages ~50
List the account's status pages: token, public URL, name, description, visibility (public/protected/private) and the ordered check tokens shown. updown: GET /api/status_pages.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
updown_update_check Update a check ~514
Change a check's settings — URL, period, alias, string match, recipients, headers, locations — or pause/resume it (enabled) or mute its alerts (mute_until). Only the fields you pass are changed. Caution: URLs returned by a read-only key hide basic-auth credentials; re-sending such a URL erases them. Requires the read/write API key. updown: PUT /api/checks/:token.
| Name | Type | Req | Description |
|---|---|---|---|
| alias | string | – | Human-readable name for the check. |
| apdex_t | number | – | APDEX threshold in seconds: 0.125, 0.25, 0.5, 1.0, 2.0, 4.0 or 8.0 (default 0.5). |
| custom_headers | object | – | HTTP headers updown sends with each request, e.g. { "X-Api-Key": "..." }. |
| disabled_locations | array | – | Monitoring locations to disable: lan, mia, tor, rbx, fra, cap, hel, sin, tok, syd. |
| enabled | boolean | – | Whether the check runs. false pauses it (reversible). |
| http_body | string | – | HTTP body sent with the request. |
| http_verb | string | – | HTTP verb for the request (default GET/HEAD). |
| mute_until | string | – | Mute notifications until a time (ISO8601, e.g. 2026-10-01T08:00:00Z), or 'recovery', or 'forever'. |
| period | integer | – | Interval in seconds. Regular checks: 15, 30, 60, 120, 300, 600, 1800 or 3600 (default 60). Pulse checks: anywhere from 15 s to 1 month. |
| published | boolean | – | Whether the check's public status page is visible (default false). |
| recipients | array | – | Alert recipient ids to select, e.g. ['email:12345', 'sms:67890'] (from updown_list_recipients). |
| string_match | string | – | Text that must appear in the response. For TCP/TCPS checks, '<closed>' inverts the check (alert if the port is open). |
| token | string | yes | The check's unique token, e.g. ngg8 (from updown_list_checks). |
| url | string | – | New URL to monitor (not for pulse checks). |
No output schema declared.
No examples provided.
updown_update_status_page Update a status page ~175
Change a status page's checks (replaces the list, order respected), name, description, visibility or access key. Only the fields you pass are changed. Requires the read/write API key. updown: PUT /api/status_pages/:token.
| Name | Type | Req | Description |
|---|---|---|---|
| access_key | string | – | Access key for protected pages (defaults to a random 30-byte string). |
| checks | array | – | New ordered list of check tokens to show (replaces the current list). |
| description | string | – | Text displayed below the name (supports newlines and links). |
| name | string | – | Name of the status page. |
| token | string | yes | The status page's unique token, e.g. 3ji4k (from updown_list_status_pages). |
| visibility | string | – | Page visibility (default public). |
No output schema declared.
No examples provided.
What is the io.usefulapi/updown-io MCP server?
io.usefulapi/updown-io is an MCP server listed in the public MCP registry as io.usefulapi/updown-io. Check updown.io uptime checks, downtimes, response metrics and status pages, and create checks. This page covers its hosted endpoint (https://updown-io.usefulapi.io/mcp).
Is the io.usefulapi/updown-io MCP server safe to use?
io.usefulapi/updown-io scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.usefulapi/updown-io MCP server expose?
io.usefulapi/updown-io exposes 14 tools: updown_list_checks, updown_get_check, updown_list_downtimes, updown_get_check_metrics, updown_find_problems, and 9 more. Their descriptions and schemas cost roughly 2,441 tokens of context every time the server is loaded.
Does the io.usefulapi/updown-io MCP server require authentication?
Yes. io.usefulapi/updown-io asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the io.usefulapi/updown-io MCP server still maintained?
io.usefulapi/updown-io is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.