# com.merlonix/monitoring

Monitoring for agencies — uptime, SSL, DNS, blocklists, AI visibility, MCP health. 8 no-auth tools.

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the content rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 1.0.2
- **Author:** com.merlonix
- **License:** Unknown
- **Endpoints:** streamable-http https://api.merlonix.com/mcp
- **Source:** https://merlonix.com
- **Endpoint health:** reachable (last checked 2026-09-20T05:25:30.282Z, 4 samples) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

60/100 (B), scored on the content rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: clean
- Obfuscation scan: clean
- Evidence age: 1 day

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-20T05:25:30.282Z
- **Version scanned:** live
- **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it.
**Findings**
- injection-shaped content (note) in the `check_mcp_health` tool: Links to undeclared domain: example.com
- injection-shaped content (note) in the `check_broken_links` tool: Links to undeclared domain: example.com

## Tools

16 declared. Observed from a live `tools/list` probe.
- `check_domain_health` — Check the live SSL/TLS certificate (validity + expiry + issuer), DNS records (A/AAAA/MX/NS resolution), and domain-registration (RDAP) expiry of any public host
- `check_agent_readiness` — Score how ready a website is for AI agents and answer engines. Fetches /llms.txt, /robots.txt, and the homepage and returns a letter grade with per-signal findi
- `check_mcp_health` — Health-check a live MCP (Model Context Protocol) server by URL: performs a real JSON-RPC initialize handshake, then tools/list, and returns whether it is up/deg
- `check_email_blacklist` — Check whether a domain or IP is listed on the major DNS blocklists (DNSBLs) that mail providers consult before accepting mail — the usual reason legitimate mail
- `check_broken_links` — Scan one web page for dead links (4xx/5xx/unreachable) and mixed content (http subresources on an https page). Returns each link with its status. Single-page sc
- `list_vendor_status` — List the current operational status and recent incidents of every third-party vendor Merlonix monitors (e.g. Cloudflare, GitHub, Stripe). Returns each vendor's 
- `get_vendor_status` — Get the current status plus 30-day status history of one monitored vendor by slug (e.g. "cloudflare"). Use list_vendor_status to discover valid slugs.
- `list_plans` — List Merlonix subscription plans and pricing (Starter, Team, Agency, Compliance) with their monitoring limits.
- `list_my_assets` — List the monitored assets (websites/domains) in YOUR Merlonix account. Returns each asset id, hostname, type, and monitoring status. Requires an API key (Author
- `get_asset_checks` — Get the latest check results (SSL, DNS, uptime, heartbeat, port) for ONE of your monitored assets, by its asset id (from list_my_assets). Requires an API key.
- `list_my_alerts` — List recent alerts across YOUR monitored assets (SSL changes, downtime, DNS drift, vendor incidents, etc.) with their severity and lifecycle status. Requires an
- `create_asset` — Start monitoring a new asset (website/domain) in YOUR Merlonix account. Provide a hostname and asset_type; optionally a label and which checks to enable. Return
- `update_asset` — Update one of YOUR monitored assets by its asset id (from list_my_assets): relabel it or toggle which checks run. Returns the updated asset. Requires an API key
- `delete_asset` — STOP monitoring one of YOUR assets and remove it, by its asset id (from list_my_assets). This is irreversible — its check history goes too. Requires an API key 
- `acknowledge_alert` — Acknowledge one of YOUR alerts by its alert id (from list_my_alerts) — marks it as seen/being-handled without resolving it. Optionally attach a note. Requires a
- `resolve_alert` — Resolve one of YOUR alerts by its alert id (from list_my_alerts) — closes it. Optionally set resolution ("fixed" | "false_positive" | "wontfix") and a note. Req

## Install

**Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
**Cautions** (coverage gaps and advisories — never blocking)
- No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"monitoring\": {\n      \"type\": \"http\",\n      \"url\": \"https://api.merlonix.com/mcp\"\n    }\n  }\n}"
```

## Blast radius

Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on someone else's infrastructure.
- Floor 32, ceiling 56 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/com.merlonix%2Fmonitoring
- Install plan: https://forgeregistry.com/api/v1/packages/com.merlonix%2Fmonitoring/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/com.merlonix%2Fmonitoring
- HTML page: https://forgeregistry.com/registry/com.merlonix%2Fmonitoring
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.