MCP Health Monitor

health-monitor-mcp

MCP server, CI workflow, and generic HTTP endpoint monitoring with health history, TLS expiry, assertions, diagnostics, and operational reports.

What This Does

health-monitor-mcp keeps local registries of MCP servers, GitHub Actions workflows, GitLab pipelines, and generic HTTP endpoints. It performs live checks, records bounded evidence in SQLite, evaluates MCP alert thresholds, and returns JSON or Markdown diagnostics suitable for agents and operators.

Supported target transports:

• Streamable HTTP for current remote MCP servers.
• SSE for legacy MCP servers.
• stdio for trusted local executables after explicit opt-in.
• GitHub Actions workflow runs, failed jobs, and failed steps for public or private repositories.
• GitLab CI/CD pipelines, failed jobs, stages, refs, commits, URLs, and bounded trace excerpts for GitLab.com or allowlisted self-hosted instances.
• Generic HTTP/HTTPS endpoints with status, header, body-substring, JSON-value, redirect, latency, and TLS-expiry checks.

Azure DevOps monitoring was retired in v1.1.0. GitHub Actions shipped in v1.2.0 and GitLab CI/CD in v1.3.0; generic HTTP/TLS monitoring completes the current multi-provider feature line.

Quick Start

Run the published package noninteractively with Node.js 24:

npx -y health-monitor-mcp --version

Example MCP client configuration:

{
  "mcpServers": {
    "health-monitor": {
      "command": "npx",
      "args": ["-y", "health-monitor-mcp"]
    }
  }
}

Tools

Expected configuration mistakes return stable error codes and remediation hints, including SERVER_NOT_FOUND, GITHUB_ACTIONS_TARGET_NOT_FOUND, GITLAB_PIPELINE_TARGET_NOT_FOUND, GITLAB_BASE_URL_NOT_ALLOWED, HTTP_TARGET_NOT_FOUND, HTTP_TARGET_URL_NOT_ALLOWED, NO_SERVERS_REGISTERED, STDIO_DISABLED, STDIO_COMMAND_REJECTED, WEBHOOK_ENCRYPTION_KEY_REQUIRED, WEBHOOK_REGISTRATION_FAILED, and WEBHOOK_NOT_FOUND.

Register Targets

Streamable HTTP:

register_server name="inventory-prod" type="http" url="https://inventory.example.com/mcp" tags=["production","inventory"]

Legacy SSE:

register_server name="legacy-search" type="sse" url="https://search.example.com/sse" tags=["legacy"]

Trusted local stdio:

export HEALTH_MONITOR_ALLOW_STDIO=1
export HEALTH_MONITOR_STDIO_ALLOWLIST=npx,node

register_server name="local-debugger" type="stdio" command="npx" args=["-y","mcp-debug-recorder"] tags=["local"]

The command field must contain one executable only. Put package names and flags in args. Remote-safe runtime profiles always disable stdio.

Register GitHub Actions

Public repositories can be checked without authentication. Private repositories and higher API rate limits require a token with Actions read access:

export GITHUB_TOKEN=your-runtime-secret

register_github_actions name="repo-ci" owner="oaslananka" repository="health-monitor-mcp" workflow="ci.yml" branch="main" token_env="GITHUB_TOKEN" tags=["production","ci"]
check_github_actions name="repo-ci" timeout_ms=5000

Only the environment-variable name in token_env is stored. The token value is read at check time and is never written to SQLite, logs, reports, or tool responses.

Register GitLab Pipelines

Public GitLab.com projects can be checked without authentication. Private projects require a token exposed only through the runtime environment:

export GITLAB_TOKEN=your-runtime-secret

register_gitlab_pipeline name="gitlab-ci" project="group/project" ref="main" token_env="GITLAB_TOKEN" tags=["production","ci"]
check_gitlab_pipeline name="gitlab-ci" timeout_ms=5000

GitLab.com is allowed by default. A self-hosted instance must use an HTTPS origin and be explicitly allowed:

export HEALTH_MONITOR_GITLAB_BASE_URL_ALLOWLIST=https://gitlab.internal.example

register_gitlab_pipeline name="private-gitlab" base_url="https://gitlab.internal.example" project="platform/service" token_env="GITLAB_TOKEN"

Only token_env is persisted. Token values, response bodies, and full traces are never stored or returned. Failed-job trace excerpts are range-requested, sanitized, and bounded.

Register HTTP Targets

Public HTTP and HTTPS endpoints are allowed by default. The provider sends GET requests only and supports bounded status, header, body-substring, JSON scalar, and TLS-expiry assertions:

register_http_target name="service-health" url="https://status.example.com/health" expected_statuses=[200] header_assertions=[{"name":"x-ready","equals":"yes"}] body_contains=["ready"] json_assertions=[{"path":"status","equals":"ready"}] tls_expiry_days=30 tags=["production","http"]
check_http_target name="service-health" timeout_ms=5000

Private, loopback, link-local, and other non-public addresses are blocked. A trusted private origin is available only in the full runtime profile and must be explicitly listed:

export HEALTH_MONITOR_HTTP_TARGET_ALLOWLIST=https://status.internal.example:8443

Every DNS answer and every redirect destination is revalidated. Responses are capped at 262144 bytes; full response bodies and certificate chains are never stored or returned.

Register Webhook Targets