OutageDeck
by outagedeck.com · remote · no sign-in to list tools · v1.1.0 · published by com.outagedeck
Live status for 172 cloud and SaaS vendors from their official feeds. Is it you, or is it them?
14 tools: 1 can delete or cancel things, 4 change things and 9 only read.
Scanned Oct 21, 2026
- Deletes or cancels1Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things4Claude Code: ask: see these tools
- Only reads9Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http outagedeck-status https://outagedeck.com/api/mcpFindings
Matches of fixed checks, with the text they matched.
The description mentions "credentials".
What this check looks forMatched text
description: "...set up on the account page instead, so credentials never travel through a conversation."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
14 tools
Deletes or cancels 1Claude Code: deny
remove_custom_providerDeletes one of the caller's custom providers and its stored incident history, freeing a slot on their plan.No findings
Why it is in this group
- The name "remove_custom_provider" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Deletes one of the caller's custom providers and its stored incident history, freeing a slot on their plan. Requires an API key.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
Changes things 4Claude Code: ask
add_custom_providerRegisters a vendor OutageDeck does not track by pointing at its Statuspage or Instatus status page, so it joins the caller's account with live status, incident history, and alertin…Reads text others writeCan send data out1 finding
Why it is in this group
- The name "add_custom_provider" says "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...set up on the account page instead, so credentials never travel through a conversation."
Description, as the server wrote it Registers a vendor OutageDeck does not track by pointing at its Statuspage or Instatus status page, so it joins the caller's account with live status, incident history, and alerting. Requires an API key and a plan that includes custom providers. The feed is read live before anything is saved, and it must be reachable from the public internet. Feeds behind authentication are set up on the account page instead, so credentials never travel through a conversation.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
check_my_stackOne verdict across up to 12 providers: whether any vendor in the list is reported as having a problem right now.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it One verdict across up to 12 providers: whether any vendor in the list is reported as having a problem right now. Use before debugging an integration failure to answer "is it us or them?" in a single call. Returns a shareable status-board link and a prefilled alert setup link.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
update_custom_providerRenames one of the caller's custom providers, points it at a different status page, or pauses and resumes its checks.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "update_custom_provider" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Renames one of the caller's custom providers, points it at a different status page, or pauses and resumes its checks. Requires an API key. A new address is read live before it is stored.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
watch_providerStarts sending the caller outage alerts for one provider, either from the tracked catalog or from their own custom providers.No findings
Why it is in this group
- The description's first verb is "start": a word for a change.
Description, as the server wrote it Starts sending the caller outage alerts for one provider, either from the tracked catalog or from their own custom providers. Requires an API key. A new watch is added to the owner's email alert. An existing alert counts only when delivery is allowed; otherwise a new owner-email watch is added or the request is refused with an explanation. A successful result always means delivery is allowed and reports the alert's channel. Other channels are set up on the account page; their destination URLs are never returned.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
Only reads 9Claude Code: allow
fetchRetrieve the full text of one search result by its id: a provider's current status with its services and open incidents, or an incident's complete timeline.No findings
Why it is in this group
- The name "fetch" says "fetch": a word for reading.
Description, as the server wrote it Retrieve the full text of one search result by its id: a provider's current status with its services and open incidents, or an incident's complete timeline. Ids come from the search tool.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_incident_detailsFull detail for one incident: updates from the official incident source in chronological order, the services OutageDeck matched to it, severity, and resolution state.No findings
Why it is in this group
- The name "get_incident_details" says "get": a word for reading.
Description, as the server wrote it Full detail for one incident: updates from the official incident source in chronological order, the services OutageDeck matched to it, severity, and resolution state. Pass the incident slug returned by list_active_incidents or get_provider_status. Use to read what the official source has actually said about an outage.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_outage_reportA reliability summary across every tracked provider over a trailing window (7-90 days, default 30): incident totals, severity and category breakdowns, the providers hit hardest by …No findings
Why it is in this group
- The name "get_outage_report" says "get": a word for reading.
Description, as the server wrote it A reliability summary across every tracked provider over a trailing window (7-90 days, default 30): incident totals, severity and category breakdowns, the providers hit hardest by major outages, and the longest-running severe incidents. Use to answer "which vendors had outages recently?" or to compare vendor reliability.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_provider_statusLive status for one tracked provider: overall state, non-operational services, and open incidents, read from the vendor's official status feed.No findings
Why it is in this group
- The name "get_provider_status" says "get": a word for reading.
Description, as the server wrote it Live status for one tracked provider: overall state, non-operational services, and open incidents, read from the vendor's official status feed. Accepts a slug, provider name, or product name (e.g., "claude" resolves to Anthropic). Use this first for any "is X down?" question. When regions are present, reportedCodes lists published codes; notOperational lists impaired rows. If those rows are truncated, notOperationalCodes lists every impaired code. For an inventory feed, a reported code absent from the complete impaired list is operational; an unreported code has no published status. Withdrawn readings omit these lists.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_uptimeIndependent uptime record for one provider over a trailing window (7-90 days, default 30), computed from OutageDeck's readings of the official source that publishes the provider's …No findings
Why it is in this group
- The name "get_uptime" says "get": a word for reading.
Description, as the server wrote it Independent uptime record for one provider over a trailing window (7-90 days, default 30), computed from OutageDeck's readings of the official source that publishes the provider's status: share of time free of major outages, strict uptime with partial outages counted as downtime, and total impaired durations.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_active_incidentsEvery incident currently open across all tracked providers, most severe first.No findings
Why it is in this group
- The name "list_active_incidents" says "list": a word for reading.
Description, as the server wrote it Every incident currently open across all tracked providers, most severe first. Optionally filter by severity (critical, major, minor, maintenance). Use to answer "what is down right now?" across the whole cloud landscape.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_custom_providersLists the custom providers on the caller's own OutageDeck account: vendors they registered themselves by pointing at a status feed we do not track in the public catalog.No findings
Why it is in this group
- The name "list_custom_providers" says "list": a word for reading.
Description, as the server wrote it Lists the custom providers on the caller's own OutageDeck account: vendors they registered themselves by pointing at a status feed we do not track in the public catalog. Requires an API key, and only ever returns that key owner's providers.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
searchSearch everything OutageDeck tracks: cloud and SaaS providers, and their incident history.No findings
Why it is in this group
- The name "search" says "search": a word for reading.
Description, as the server wrote it Search everything OutageDeck tracks: cloud and SaaS providers, and their incident history. Returns citable results with stable ids for the fetch tool. Use for open questions like "who had outages last week" or "find the GitHub Actions incident"; use get_provider_status when the question is simply whether one named vendor is down right now.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_providersFind tracked providers by name, product name, or fragment ("postgres", "auth", "claude").No findings
Why it is in this group
- The name "search_providers" says "search": a word for reading.
Description, as the server wrote it Find tracked providers by name, product name, or fragment ("postgres", "auth", "claude"). Returns slugs to use with the other tools plus each match's current status. Use when a provider argument did not resolve or to discover what OutageDeck tracks.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write2
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out2
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 1.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http outagedeck-status https://outagedeck.com/api/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__outagedeck-status__get_provider_status",
"mcp__outagedeck-status__list_active_incidents",
"mcp__outagedeck-status__get_incident_details",
"mcp__outagedeck-status__get_uptime",
"mcp__outagedeck-status__get_outage_report",
"mcp__outagedeck-status__search_providers",
"mcp__outagedeck-status__list_custom_providers",
"mcp__outagedeck-status__search",
"mcp__outagedeck-status__fetch"
],
"ask": [
"mcp__outagedeck-status__check_my_stack",
"mcp__outagedeck-status__add_custom_provider",
"mcp__outagedeck-status__update_custom_provider",
"mcp__outagedeck-status__watch_provider"
],
"deny": [
"mcp__outagedeck-status__remove_custom_provider"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as outagedeck-status. Review it before you use it.
Capability tags behind 2 rules
- mcp__outagedeck-status__add_custom_provider untrusted-input, outbound
- mcp__outagedeck-status__update_custom_provider untrusted-input, outbound