Skip to content

OutageDeck

by outagedeck.com · remote · no sign-in to list tools · v1.1.0 · published by com.outagedeck

Live status for 172 cloud and SaaS vendors from their official feeds. Is it you, or is it them?

Deletes · 1Changes · 4

14 tools: 1 can delete or cancel things, 4 change things and 9 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http outagedeck-status https://outagedeck.com/api/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

14 tools

Deletes or cancels 1Claude Code: deny
  • remove_custom_providerDeletes one of the caller's custom providers and its stored incident history, freeing a slot on their plan.No findings

    Why it is in this group

    • The name "remove_custom_provider" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes one of the caller's custom providers and its stored incident history, freeing a slot on their plan. Requires an API key.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Changes things 4Claude Code: ask
  • add_custom_providerRegisters a vendor OutageDeck does not track by pointing at its Statuspage or Instatus status page, so it joins the caller's account with live status, incident history, and alertin…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "add_custom_provider" says "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...set up on the account page instead, so credentials never travel through a conversation."

      What this check looks for
    Description, as the server wrote it
    Registers a vendor OutageDeck does not track by pointing at its Statuspage or Instatus status page, so it joins the caller's account with live status, incident history, and alerting. Requires an API key and a plan that includes custom providers. The feed is read live before anything is saved, and it must be reachable from the public internet. Feeds behind authentication are set up on the account page instead, so credentials never travel through a conversation.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • check_my_stackOne verdict across up to 12 providers: whether any vendor in the list is reported as having a problem right now.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    One verdict across up to 12 providers: whether any vendor in the list is reported as having a problem right now. Use before debugging an integration failure to answer "is it us or them?" in a single call. Returns a shareable status-board link and a prefilled alert setup link.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • update_custom_providerRenames one of the caller's custom providers, points it at a different status page, or pauses and resumes its checks.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "update_custom_provider" says "update": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Renames one of the caller's custom providers, points it at a different status page, or pauses and resumes its checks. Requires an API key. A new address is read live before it is stored.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • watch_providerStarts sending the caller outage alerts for one provider, either from the tracked catalog or from their own custom providers.No findings

    Why it is in this group

    • The description's first verb is "start": a word for a change.
    Description, as the server wrote it
    Starts sending the caller outage alerts for one provider, either from the tracked catalog or from their own custom providers. Requires an API key. A new watch is added to the owner's email alert. An existing alert counts only when delivery is allowed; otherwise a new owner-email watch is added or the request is refused with an explanation. A successful result always means delivery is allowed and reports the alert's channel. Other channels are set up on the account page; their destination URLs are never returned.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 9Claude Code: allow
  • fetchRetrieve the full text of one search result by its id: a provider's current status with its services and open incidents, or an incident's complete timeline.No findings

    Why it is in this group

    • The name "fetch" says "fetch": a word for reading.
    Description, as the server wrote it
    Retrieve the full text of one search result by its id: a provider's current status with its services and open incidents, or an incident's complete timeline. Ids come from the search tool.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_incident_detailsFull detail for one incident: updates from the official incident source in chronological order, the services OutageDeck matched to it, severity, and resolution state.No findings

    Why it is in this group

    • The name "get_incident_details" says "get": a word for reading.
    Description, as the server wrote it
    Full detail for one incident: updates from the official incident source in chronological order, the services OutageDeck matched to it, severity, and resolution state. Pass the incident slug returned by list_active_incidents or get_provider_status. Use to read what the official source has actually said about an outage.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_outage_reportA reliability summary across every tracked provider over a trailing window (7-90 days, default 30): incident totals, severity and category breakdowns, the providers hit hardest by …No findings

    Why it is in this group

    • The name "get_outage_report" says "get": a word for reading.
    Description, as the server wrote it
    A reliability summary across every tracked provider over a trailing window (7-90 days, default 30): incident totals, severity and category breakdowns, the providers hit hardest by major outages, and the longest-running severe incidents. Use to answer "which vendors had outages recently?" or to compare vendor reliability.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_provider_statusLive status for one tracked provider: overall state, non-operational services, and open incidents, read from the vendor's official status feed.No findings

    Why it is in this group

    • The name "get_provider_status" says "get": a word for reading.
    Description, as the server wrote it
    Live status for one tracked provider: overall state, non-operational services, and open incidents, read from the vendor's official status feed. Accepts a slug, provider name, or product name (e.g., "claude" resolves to Anthropic). Use this first for any "is X down?" question. When regions are present, reportedCodes lists published codes; notOperational lists impaired rows. If those rows are truncated, notOperationalCodes lists every impaired code. For an inventory feed, a reported code absent from the complete impaired list is operational; an unreported code has no published status. Withdrawn readings omit these lists.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_uptimeIndependent uptime record for one provider over a trailing window (7-90 days, default 30), computed from OutageDeck's readings of the official source that publishes the provider's …No findings

    Why it is in this group

    • The name "get_uptime" says "get": a word for reading.
    Description, as the server wrote it
    Independent uptime record for one provider over a trailing window (7-90 days, default 30), computed from OutageDeck's readings of the official source that publishes the provider's status: share of time free of major outages, strict uptime with partial outages counted as downtime, and total impaired durations.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_active_incidentsEvery incident currently open across all tracked providers, most severe first.No findings

    Why it is in this group

    • The name "list_active_incidents" says "list": a word for reading.
    Description, as the server wrote it
    Every incident currently open across all tracked providers, most severe first. Optionally filter by severity (critical, major, minor, maintenance). Use to answer "what is down right now?" across the whole cloud landscape.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_custom_providersLists the custom providers on the caller's own OutageDeck account: vendors they registered themselves by pointing at a status feed we do not track in the public catalog.No findings

    Why it is in this group

    • The name "list_custom_providers" says "list": a word for reading.
    Description, as the server wrote it
    Lists the custom providers on the caller's own OutageDeck account: vendors they registered themselves by pointing at a status feed we do not track in the public catalog. Requires an API key, and only ever returns that key owner's providers.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_providersFind tracked providers by name, product name, or fragment ("postgres", "auth", "claude").No findings

    Why it is in this group

    • The name "search_providers" says "search": a word for reading.
    Description, as the server wrote it
    Find tracked providers by name, product name, or fragment ("postgres", "auth", "claude"). Returns slugs to use with the other tools plus each match's current status. Use when a provider argument did not resolve or to discover what OutageDeck tracks.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http outagedeck-status https://outagedeck.com/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__outagedeck-status__get_provider_status",
      "mcp__outagedeck-status__list_active_incidents",
      "mcp__outagedeck-status__get_incident_details",
      "mcp__outagedeck-status__get_uptime",
      "mcp__outagedeck-status__get_outage_report",
      "mcp__outagedeck-status__search_providers",
      "mcp__outagedeck-status__list_custom_providers",
      "mcp__outagedeck-status__search",
      "mcp__outagedeck-status__fetch"
    ],
    "ask": [
      "mcp__outagedeck-status__check_my_stack",
      "mcp__outagedeck-status__add_custom_provider",
      "mcp__outagedeck-status__update_custom_provider",
      "mcp__outagedeck-status__watch_provider"
    ],
    "deny": [
      "mcp__outagedeck-status__remove_custom_provider"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as outagedeck-status. Review it before you use it.

Capability tags behind 2 rules
  • mcp__outagedeck-status__add_custom_provider untrusted-input, outbound
  • mcp__outagedeck-status__update_custom_provider untrusted-input, outbound