@aaa-sentinel/mcp-server 0.2.0 → 0.3.0

package/README.md

@@ -1,9 +1,11 @@
 # @aaa-sentinel/mcp-server
 
-Lets an AI assistant read your cloud cost data — accounts, scans, findings, savings and
-chargeback — through the [Model Context Protocol](https://modelcontextprotocol.io), so you can
-ask *"which of my AWS accounts is bleeding the most money this month, and why"* in the chat
-window you already have open instead of a dashboard you have to remember to visit.
+Lets an AI assistant read your AAA Sentinel data — cloud costs, savings and forecasts, security
+posture, AI spend, uptime monitoring, the autonomous agent and your managed clients — through the
+[Model Context Protocol](https://modelcontextprotocol.io), so you can ask *"which of my AWS
+accounts is bleeding the most money this month, and why"*, *"what is down right now"* or *"how
+much have we spent on AI this month"* in the chat window you already have open instead of a
+dashboard you have to remember to visit.
 
 > **User** — Which account has the most waste right now?
 >
@@ -12,15 +14,22 @@ window you already have open instead of a dashboard you have to remember to visi
 > 11 unattached EBS volumes ($412/mo), 3 idle RDS instances ($980/mo) and an over-provisioned
 > NAT gateway ($338/mo).
 
+> **User** — Why was checkout failing this morning?
+>
+> **Assistant** *(calls `list_monitoring_services`, then `get_service_history`, then `list_monitor_results`)* —
+> *Checkout* went down at 07:42 UTC and recovered at 08:05. The culprit was *Payments API*: 23
+> consecutive checks timed out after 5 s, confirmed from a second region. The other two components
+> stayed healthy.
+
 ## Requirements
 
 - Node.js 20 or newer.
 - An OAuth2 application created in the [developer portal](https://app.aaa-sentinel.com/developer/apps).
 - Scopes depend on what you want the assistant to be able to read — see the table below. Grant
   only those; the scopes you leave out are simply not reachable from the assistant.
-- A **Pro** plan for `get_reports_summary`, `list_savings`, `get_dashboard`, `get_cost_forecast`
-  and the security tools (which also need the security add-on on the account), **Business** for
-  `get_chargeback` and `list_cost_anomalies`. The other tools work on any paid plan.
+- A **Pro** plan or above: the API is not available on the free plan. Chargeback, cost anomalies,
+  unit cost, managed clients and the agent need **Business**, and the security tools also need the
+  security add-on on the account — the table below says which.
 
 ## Configuration
 
@@ -80,14 +89,18 @@ connected to a server that can answer nothing is worse than a client that report
 
 ## Tools
 
-All fourteen are **read-only**.
+All of them are **read-only**, and together they cover every read endpoint of the public API
+except four that make no sense in a conversation: the data to connect a new account, the
+telemetry probe used by SDKs, the Jira/Linear configuration (it carries partially masked tokens)
+and the `health+json` endpoint for load balancers — `get_monitoring_service` returns the same
+status as plain JSON.
 
 | Tool | Arguments | Scope | Plan |
 | --- | --- | --- | --- |
-| `list_accounts` | — | `accounts:read` | any |
-| `list_scans` | `accountId` | `scans:read` | any |
-| `get_scan` | `scanId` | `scans:read` | any |
-| `list_findings` | `scanId`, `includeSuppressed?` | `findings:read` | any |
+| `list_accounts` | — | `accounts:read` | Pro |
+| `list_scans` | `accountId` | `scans:read` | Pro |
+| `get_scan` | `scanId` | `scans:read` | Pro |
+| `list_findings` | `scanId`, `includeSuppressed?` | `findings:read` | Pro |
 | `get_reports_summary` | `accountId?` | `reports:read` | Pro |
 | `list_savings` | `accountId?`, `type?` | `savings:read` | Pro |
 | `get_chargeback` | `clientId?` | `reports:read` | Business |
@@ -97,10 +110,51 @@ All fourteen are **read-only**.
 | `get_security_overview` | — | `security:read` | Pro + security add-on |
 | `get_security_score` | `accountId` | `security:read` | Pro + security add-on |
 | `list_security_findings` | `accountId`, `source?` | `security:read` | Pro + security add-on |
-| `get_security_conformance` | `accountId` or `clientId` | `security:read` (+ `reports:read` for `clientId`) | Pro (Business for `clientId`) |
-
-`type` is one of `compute`, `storage`, `network`, `database`, `serverless`, `governance`.
-`source` is one of `own`, `corroborated`, `securityhub`, `guardduty`, `defender`, `scc`.
+| `get_security_conformance` | `accountId` or `clientId` | `security:read` | Pro + security add-on |
+| `get_account` | `accountId` | `accounts:read` | Pro |
+| `get_account_monthly_costs` | `accountId` | `accounts:read` | Pro |
+| `get_cost_history` | `accountId` | `reports:read` | Pro |
+| `get_cost_by_tags` | `accountId` | `reports:read` | Pro |
+| `get_multicloud_report` | — | `reports:read` | Pro |
+| `list_alerts` | `limit?` | `alerts:read` | Pro |
+| `list_disabled_rules` | — | `rules:read` | Pro |
+| `list_business_metrics` | — | `metrics:read` | Business |
+| `get_metric_values` | `metricId`, `billingPeriod` | `metrics:read` | Business |
+| `get_unit_cost` | `metricId`, `billingPeriod` | `metrics:read` | Business |
+| `list_ai_connections` | — | `ai:read` | Pro |
+| `get_ai_usage` | `days?`, `groupBy?` | `ai:read` | Pro |
+| `get_ai_connection_usage` | `connectionId` | `ai:read` | Pro |
+| `list_clients` | — | `clients:read` | Business |
+| `get_client` | `clientId` | `clients:read` | Business |
+| `get_client_billing` | `clientId` | `clients:read` | Business |
+| `get_agent_dashboard` | `clientId?` | `agent:read` | Business |
+| `list_agent_actions` | `status?`, `accountId?`, `type?`, `limit?`, `cursor?` | `agent:read` | Business |
+| `get_agent_action` | `actionId` | `agent:read` | Business |
+| `list_agent_history` | `status?`, `limit?`, `cursor?` | `agent:read` | Business |
+| `list_agent_schedules` | — | `agent:read` | Business |
+| `get_agent_schedule` | `scheduleId` | `agent:read` | Business |
+| `list_agent_playbooks` | — | `agent:read` | Business |
+| `get_agent_playbook` | `playbookId` | `agent:read` | Business |
+| `list_agent_playbook_templates` | — | `agent:read` | Business |
+| `list_monitors` | `pinned?`, `clientId?` | `monitoring:read` | Pro |
+| `get_monitor` | `monitorId` | `monitoring:read` | Pro |
+| `list_monitor_results` | `monitorId`, `limit?`, `before?` | `monitoring:read` | Pro |
+| `get_monitor_uptime` | `monitorId`, `days?` | `monitoring:read` | Pro |
+| `list_monitoring_services` | — | `monitoring:read` | Pro |
+| `get_monitoring_service` | `serviceId` | `monitoring:read` | Pro |
+| `get_service_history` | `serviceId`, `limit?` | `monitoring:read` | Pro |
+
+In `list_savings`, `type` is one of `compute`, `storage`, `network`, `database`, `serverless`,
+`governance`. `source` is one of `own`, `corroborated`, `securityhub`, `guardduty`, `defender`,
+`scc`. `billingPeriod` is a month as `YYYY-MM`. The agent `status` filter is one of `proposed`,
+`pending_approval`, `pending_second_approval`, `approved`, `executing`, `completed`, `failed`,
+`cancelled`, `expired`; `pending_approval` also returns the second-approval queue, since both
+wait for a human.
+
+A monitor is `up`, `suspect` or `confirming` (a failure being confirmed from a second region —
+not an outage yet), `down`, or `recovering` (still counted as down until the recovery is
+confirmed). The last result carries a reason code such as `timeout`, `status_mismatch` or
+`queue_dlq_not_empty`; the full list is in the API reference.
 
 The security tools need the security add-on enabled on the account (20 €/month per account).
 Without it they answer with `access: "teaser"` and no scan data, so the assistant can tell

package/dist/cli.js

@@ -4190,6 +4190,24 @@ function defineTool(def) {
 }
 var SAVINGS_TYPES = ["compute", "storage", "network", "database", "serverless", "governance"];
 var SECURITY_SOURCES = ["own", "corroborated", "securityhub", "guardduty", "defender", "scc"];
+var AGENT_STATUSES = ["proposed", "pending_approval", "pending_second_approval", "approved", "executing", "completed", "failed", "cancelled", "expired"];
+var BillingPeriod = external_exports.string().regex(/^\d{4}-(0[1-9]|1[0-2])$/, "Use YYYY-MM");
+var ACCOUNT_ID = { type: "string", description: "Account identifier, as returned by list_accounts." };
+var CLIENT_ID = { type: "string", description: "Managed client identifier, as returned by list_clients." };
+var MONITOR_ID = { type: "string", description: "Monitor identifier, as returned by list_monitors." };
+var SERVICE_ID = { type: "string", description: "Service identifier, as returned by list_monitoring_services." };
+var METRIC_ID = { type: "string", description: "Business metric identifier, as returned by list_business_metrics." };
+var BILLING_PERIOD = { type: "string", pattern: "^\\d{4}-(0[1-9]|1[0-2])$", description: "Month, as YYYY-MM." };
+var CURSOR = { type: "string", description: "The cursor returned by the previous page (optional)." };
+var AGENT_STATUS = {
+  type: "string",
+  enum: [...AGENT_STATUSES],
+  description: 'Filter by status (optional). "pending_approval" also includes "pending_second_approval": both wait for a human.'
+};
+function objectWith(properties, required) {
+  return { type: "object", properties, ...required ? { required } : {} };
+}
+var asText = (value) => value === void 0 ? void 0 : String(value);
 var TOOLS = [
   defineTool({
     name: "list_accounts",
@@ -4358,6 +4376,275 @@ var TOOLS = [
       message: "Pass exactly one of accountId or clientId"
     }),
     handler: async ({ accountId, clientId: clientId2 }, config) => apiGet("/v1/security/conformance", { accountId, clientId: clientId2 }, config)
+  }),
+  // ── Cuentas y costes ───────────────────────────────────────
+  defineTool({
+    name: "get_account",
+    description: "Get one connected cloud account: provider, connection status, enabled modules (cost, security, monitoring) and managed client. Requires the accounts:read scope.",
+    inputSchema: objectWith({ accountId: ACCOUNT_ID }, ["accountId"]),
+    argsSchema: external_exports.object({ accountId: external_exports.string().min(1) }),
+    handler: async ({ accountId }, config) => apiGet(`/v1/accounts/${encodeURIComponent(accountId)}`, void 0, config)
+  }),
+  defineTool({
+    name: "get_account_monthly_costs",
+    description: "Get the monthly cost of one cloud account for the last 6 months (from the latest completed scan of each month). Requires the accounts:read scope.",
+    inputSchema: objectWith({ accountId: ACCOUNT_ID }, ["accountId"]),
+    argsSchema: external_exports.object({ accountId: external_exports.string().min(1) }),
+    handler: async ({ accountId }, config) => apiGet(`/v1/accounts/${encodeURIComponent(accountId)}/monthly-costs`, void 0, config)
+  }),
+  defineTool({
+    name: "get_cost_history",
+    description: "Get the spend history of one cloud account for the last 12 months. Requires the reports:read scope and the Pro plan or above.",
+    inputSchema: objectWith({ accountId: ACCOUNT_ID }, ["accountId"]),
+    argsSchema: external_exports.object({ accountId: external_exports.string().min(1) }),
+    handler: async ({ accountId }, config) => apiGet(`/v1/reports/history/${encodeURIComponent(accountId)}`, void 0, config)
+  }),
+  defineTool({
+    name: "get_cost_by_tags",
+    description: "Break down the cost of one cloud account by project/team tag and region. Requires the reports:read scope and the Pro plan or above.",
+    inputSchema: objectWith({ accountId: ACCOUNT_ID }, ["accountId"]),
+    argsSchema: external_exports.object({ accountId: external_exports.string().min(1) }),
+    handler: async ({ accountId }, config) => apiGet(`/v1/reports/by-tags/${encodeURIComponent(accountId)}`, void 0, config)
+  }),
+  defineTool({
+    name: "get_multicloud_report",
+    description: "Compare spend across AWS, Azure and GCP in one unified view, with migration recommendations. Requires the reports:read scope and the Pro plan or above.",
+    inputSchema: { type: "object", properties: {} },
+    argsSchema: external_exports.object({}),
+    handler: async (_args, config) => apiGet("/v1/reports/multicloud", void 0, config)
+  }),
+  defineTool({
+    name: "list_alerts",
+    description: "List the most recent alerts raised by the platform (cost, security, monitoring), newest first. Requires the alerts:read scope.",
+    inputSchema: objectWith({ limit: { type: "integer", minimum: 1, maximum: 100, description: "How many alerts to return (1-100, default 50)." } }),
+    argsSchema: external_exports.object({ limit: external_exports.number().int().min(1).max(100).optional() }),
+    handler: async ({ limit }, config) => apiGet("/v1/alerts", { limit: asText(limit) }, config)
+  }),
+  defineTool({
+    name: "list_disabled_rules",
+    description: 'List the detection rules the customer has turned off, so you can tell "nothing found" apart from "that check is disabled". Requires the rules:read scope.',
+    inputSchema: { type: "object", properties: {} },
+    argsSchema: external_exports.object({}),
+    handler: async (_args, config) => apiGet("/v1/rules/settings", void 0, config)
+  }),
+  // ── Unit economics ─────────────────────────────────────────
+  defineTool({
+    name: "list_business_metrics",
+    description: "List the business metrics the organisation declares (orders, active users...), used to compute unit cost. Requires the metrics:read scope and the Business plan.",
+    inputSchema: { type: "object", properties: {} },
+    argsSchema: external_exports.object({}),
+    handler: async (_args, config) => apiGet("/v1/metrics", void 0, config)
+  }),
+  defineTool({
+    name: "get_metric_values",
+    description: "Get the declared values of one business metric within a month. Requires the metrics:read scope and the Business plan.",
+    inputSchema: objectWith({ metricId: METRIC_ID, billingPeriod: BILLING_PERIOD }, ["metricId", "billingPeriod"]),
+    argsSchema: external_exports.object({ metricId: external_exports.string().min(1), billingPeriod: BillingPeriod }),
+    handler: async ({ metricId, billingPeriod }, config) => apiGet(`/v1/metrics/${encodeURIComponent(metricId)}/values`, { billingPeriod }, config)
+  }),
+  defineTool({
+    name: "get_unit_cost",
+    description: "Get the unit cost of one business metric in a month (cloud cost divided by the metric, e.g. cost per order). Requires the metrics:read scope and the Business plan.",
+    inputSchema: objectWith({ metricId: METRIC_ID, billingPeriod: BILLING_PERIOD }, ["metricId", "billingPeriod"]),
+    argsSchema: external_exports.object({ metricId: external_exports.string().min(1), billingPeriod: BillingPeriod }),
+    handler: async ({ metricId, billingPeriod }, config) => apiGet(`/v1/metrics/${encodeURIComponent(metricId)}/unit-cost`, { billingPeriod }, config)
+  }),
+  // ── Gasto en IA ────────────────────────────────────────────
+  defineTool({
+    name: "list_ai_connections",
+    description: "List the connections to AI providers (OpenAI, Anthropic, Bedrock, Vertex...) with their status and managed client. Start here to obtain a connectionId. Requires the ai:read scope and the Pro plan or above.",
+    inputSchema: { type: "object", properties: {} },
+    argsSchema: external_exports.object({}),
+    handler: async (_args, config) => apiGet("/v1/ai-providers", void 0, config)
+  }),
+  defineTool({
+    name: "get_ai_usage",
+    description: "Get aggregated AI spend and usage across every AI connection, with billed and estimated amounts kept apart. Requires the ai:read scope and the Pro plan or above.",
+    inputSchema: objectWith({
+      days: { type: "integer", minimum: 1, description: "Days back (default 30); capped to the history your plan keeps." },
+      groupBy: { type: "string", enum: ["holder"], description: 'Use "holder" to group individual connections by the person who holds them.' }
+    }),
+    argsSchema: external_exports.object({ days: external_exports.number().int().min(1).optional(), groupBy: external_exports.enum(["holder"]).optional() }),
+    handler: async ({ days, groupBy }, config) => apiGet("/v1/ai-providers/usage", { days: asText(days), groupBy }, config)
+  }),
+  defineTool({
+    name: "get_ai_connection_usage",
+    description: "Get the AI spend and usage of one connection, by day and by allocation dimension (model, project, key...). Requires the ai:read scope and the Pro plan or above.",
+    inputSchema: objectWith({ connectionId: { type: "string", description: "Connection identifier, as returned by list_ai_connections." } }, ["connectionId"]),
+    argsSchema: external_exports.object({ connectionId: external_exports.string().min(1) }),
+    handler: async ({ connectionId }, config) => apiGet(`/v1/ai-providers/${encodeURIComponent(connectionId)}/usage`, void 0, config)
+  }),
+  // ── Clientes gestionados (MSP) ─────────────────────────────
+  defineTool({
+    name: "list_clients",
+    description: "List the managed clients of an MSP or consultancy. Start here to obtain a clientId. Requires the clients:read scope and the Business plan.",
+    inputSchema: { type: "object", properties: {} },
+    argsSchema: external_exports.object({}),
+    handler: async (_args, config) => apiGet("/v1/clients", void 0, config)
+  }),
+  defineTool({
+    name: "get_client",
+    description: "Get one managed client with the cloud accounts and AI connections assigned to it. Requires the clients:read scope and the Business plan.",
+    inputSchema: objectWith({ clientId: CLIENT_ID }, ["clientId"]),
+    argsSchema: external_exports.object({ clientId: external_exports.string().min(1) }),
+    handler: async ({ clientId: clientId2 }, config) => apiGet(`/v1/clients/${encodeURIComponent(clientId2)}`, void 0, config)
+  }),
+  defineTool({
+    name: "get_client_billing",
+    description: "Get the billing base of one managed client: its cost by account plus the configured margin, ready to invoice. Requires the clients:read scope and the Business plan.",
+    inputSchema: objectWith({ clientId: CLIENT_ID }, ["clientId"]),
+    argsSchema: external_exports.object({ clientId: external_exports.string().min(1) }),
+    handler: async ({ clientId: clientId2 }, config) => apiGet(`/v1/clients/${encodeURIComponent(clientId2)}/billing`, void 0, config)
+  }),
+  // ── Agente autónomo (solo lectura: aprobar o lanzar se queda en la app) ──
+  defineTool({
+    name: "get_agent_dashboard",
+    description: "Get the autonomous agent KPIs: actions executed and pending approval, savings achieved, active schedules and playbooks \u2014 for the whole organisation, or for one managed client. Requires the agent:read scope (plus clients:read with clientId) and the Business plan.",
+    inputSchema: objectWith({ clientId: { ...CLIENT_ID, description: "Restrict the KPIs to the accounts of one managed client (optional)." } }),
+    argsSchema: external_exports.object({ clientId: external_exports.string().min(1).optional() }),
+    handler: async ({ clientId: clientId2 }, config) => apiGet(clientId2 ? `/v1/clients/${encodeURIComponent(clientId2)}/agent/dashboard` : "/v1/agent/dashboard", void 0, config)
+  }),
+  defineTool({
+    name: "list_agent_actions",
+    description: 'List the remediation actions proposed or executed by the autonomous agent, newest first, with optional filters. Use status "pending_approval" to see what is waiting for a human. Paginated: pass the returned cursor to get the next page. Requires the agent:read scope and the Business plan.',
+    inputSchema: objectWith({
+      status: AGENT_STATUS,
+      accountId: { ...ACCOUNT_ID, description: "Restrict to one account (optional)." },
+      type: { type: "string", description: 'Restrict to one action type, e.g. "stop_instance" (optional).' },
+      limit: { type: "integer", minimum: 1, maximum: 100, description: "Page size (default 20)." },
+      cursor: CURSOR
+    }),
+    argsSchema: external_exports.object({
+      status: external_exports.enum(AGENT_STATUSES).optional(),
+      accountId: external_exports.string().min(1).optional(),
+      type: external_exports.string().min(1).optional(),
+      limit: external_exports.number().int().min(1).max(100).optional(),
+      cursor: external_exports.string().min(1).optional()
+    }),
+    handler: async ({ status, accountId, type, limit, cursor }, config) => apiGet("/v1/agent/actions", { status, accountId, type, limit: asText(limit), cursor }, config)
+  }),
+  defineTool({
+    name: "get_agent_action",
+    description: "Get the full detail of one agent action: what it does, why, its estimated saving, approvals and execution result. Requires the agent:read scope and the Business plan.",
+    inputSchema: objectWith({ actionId: { type: "string", description: "Action identifier, as returned by list_agent_actions." } }, ["actionId"]),
+    argsSchema: external_exports.object({ actionId: external_exports.string().min(1) }),
+    handler: async ({ actionId }, config) => apiGet(`/v1/agent/actions/${encodeURIComponent(actionId)}`, void 0, config)
+  }),
+  defineTool({
+    name: "list_agent_history",
+    description: "List the paginated history of agent actions, optionally by status. Pass the returned cursor to get the next page. Requires the agent:read scope and the Business plan.",
+    inputSchema: objectWith({
+      status: AGENT_STATUS,
+      limit: { type: "integer", minimum: 1, maximum: 100, description: "Page size (default 50)." },
+      cursor: CURSOR
+    }),
+    argsSchema: external_exports.object({
+      status: external_exports.enum(AGENT_STATUSES).optional(),
+      limit: external_exports.number().int().min(1).max(100).optional(),
+      cursor: external_exports.string().min(1).optional()
+    }),
+    handler: async ({ status, limit, cursor }, config) => apiGet("/v1/agent/history", { status, limit: asText(limit), cursor }, config)
+  }),
+  defineTool({
+    name: "list_agent_schedules",
+    description: "List the start/stop schedules the agent applies to resources (e.g. stop dev instances at night). Requires the agent:read scope and the Business plan.",
+    inputSchema: { type: "object", properties: {} },
+    argsSchema: external_exports.object({}),
+    handler: async (_args, config) => apiGet("/v1/agent/schedules", void 0, config)
+  }),
+  defineTool({
+    name: "get_agent_schedule",
+    description: "Get one agent schedule by its id. Requires the agent:read scope and the Business plan.",
+    inputSchema: objectWith({ scheduleId: { type: "string", description: "Schedule identifier, as returned by list_agent_schedules." } }, ["scheduleId"]),
+    argsSchema: external_exports.object({ scheduleId: external_exports.string().min(1) }),
+    handler: async ({ scheduleId }, config) => apiGet(`/v1/agent/schedules/${encodeURIComponent(scheduleId)}`, void 0, config)
+  }),
+  defineTool({
+    name: "list_agent_playbooks",
+    description: "List the remediation playbooks configured for the agent. Requires the agent:read scope and the Business plan.",
+    inputSchema: { type: "object", properties: {} },
+    argsSchema: external_exports.object({}),
+    handler: async (_args, config) => apiGet("/v1/agent/playbooks", void 0, config)
+  }),
+  defineTool({
+    name: "get_agent_playbook",
+    description: "Get one remediation playbook by its id. Requires the agent:read scope and the Business plan.",
+    inputSchema: objectWith({ playbookId: { type: "string", description: "Playbook identifier, as returned by list_agent_playbooks." } }, ["playbookId"]),
+    argsSchema: external_exports.object({ playbookId: external_exports.string().min(1) }),
+    handler: async ({ playbookId }, config) => apiGet(`/v1/agent/playbooks/${encodeURIComponent(playbookId)}`, void 0, config)
+  }),
+  defineTool({
+    name: "list_agent_playbook_templates",
+    description: "List the playbook templates available to start from. Requires the agent:read scope and the Business plan.",
+    inputSchema: { type: "object", properties: {} },
+    argsSchema: external_exports.object({}),
+    handler: async (_args, config) => apiGet("/v1/agent/playbooks/templates", void 0, config)
+  }),
+  // ── Monitorización ─────────────────────────────────────────
+  defineTool({
+    name: "list_monitors",
+    description: 'List uptime and health monitors (HTTP endpoints, health contracts, cron heartbeats, cloud resources) with their current state, last result and 30-day availability. This answers "what is down right now". States: up; suspect and confirming (still being confirmed from a second region, not an outage yet); down; recovering (still counts as down). Requires the monitoring:read scope and the Pro plan or above.',
+    inputSchema: objectWith({
+      pinned: { type: "boolean", description: "Only the monitors pinned to the dashboard (optional)." },
+      clientId: { ...CLIENT_ID, description: "Only the monitors of one managed client (optional)." }
+    }),
+    argsSchema: external_exports.object({ pinned: external_exports.boolean().optional(), clientId: external_exports.string().min(1).optional() }),
+    handler: async ({ pinned, clientId: clientId2 }, config) => apiGet("/v1/monitoring/monitors", { pinned: pinned ? "true" : void 0, clientId: clientId2 }, config)
+  }),
+  defineTool({
+    name: "get_monitor",
+    description: "Get one monitor with its definition, current state, since when, and last result (outcome, reason code, status code, latency). Requires the monitoring:read scope and the Pro plan or above.",
+    inputSchema: objectWith({ monitorId: MONITOR_ID }, ["monitorId"]),
+    argsSchema: external_exports.object({ monitorId: external_exports.string().min(1) }),
+    handler: async ({ monitorId }, config) => apiGet(`/v1/monitoring/monitors/${encodeURIComponent(monitorId)}`, void 0, config)
+  }),
+  defineTool({
+    name: "list_monitor_results",
+    description: 'List the individual check results of one monitor, newest first, kept for 90 days. Use it to find when an outage started and what each failed check returned. Paginated: pass the returned "next" as "before". Requires the monitoring:read scope and the Pro plan or above.',
+    inputSchema: objectWith(
+      {
+        monitorId: MONITOR_ID,
+        limit: { type: "integer", minimum: 1, maximum: 200, description: "Page size (default 100)." },
+        before: { type: "string", description: 'The "next" value of the previous page (optional).' }
+      },
+      ["monitorId"]
+    ),
+    argsSchema: external_exports.object({ monitorId: external_exports.string().min(1), limit: external_exports.number().int().min(1).max(200).optional(), before: external_exports.string().min(1).optional() }),
+    handler: async ({ monitorId, limit, before }, config) => apiGet(`/v1/monitoring/monitors/${encodeURIComponent(monitorId)}/results`, { limit: asText(limit), before }, config)
+  }),
+  defineTool({
+    name: "get_monitor_uptime",
+    description: "Get the daily summaries of one monitor (checks, failures, downtime, p50/p95 latency) and its availability over that period. Days close at 00:00 UTC; today is not included. Requires the monitoring:read scope and the Pro plan or above.",
+    inputSchema: objectWith(
+      { monitorId: MONITOR_ID, days: { type: "integer", minimum: 1, maximum: 90, description: "How many closed days (1-90, default 30)." } },
+      ["monitorId"]
+    ),
+    argsSchema: external_exports.object({ monitorId: external_exports.string().min(1), days: external_exports.number().int().min(1).max(90).optional() }),
+    handler: async ({ monitorId, days }, config) => apiGet(`/v1/monitoring/monitors/${encodeURIComponent(monitorId)}/days`, { days: asText(days) }, config)
+  }),
+  defineTool({
+    name: "list_monitoring_services",
+    description: 'List the services (groups of monitors and other services, e.g. "Checkout") with their computed status (pass, warn, fail) and the components that cause it. Requires the monitoring:read scope and the Pro plan or above.',
+    inputSchema: { type: "object", properties: {} },
+    argsSchema: external_exports.object({}),
+    handler: async (_args, config) => apiGet("/v1/monitoring/services", void 0, config)
+  }),
+  defineTool({
+    name: "get_monitoring_service",
+    description: "Get one service with its status, its components (monitors and services it depends on) and the culprits when it is not healthy. Requires the monitoring:read scope and the Pro plan or above.",
+    inputSchema: objectWith({ serviceId: SERVICE_ID }, ["serviceId"]),
+    argsSchema: external_exports.object({ serviceId: external_exports.string().min(1) }),
+    handler: async ({ serviceId }, config) => apiGet(`/v1/monitoring/services/${encodeURIComponent(serviceId)}`, void 0, config)
+  }),
+  defineTool({
+    name: "get_service_history",
+    description: 'Get the status changes of one service, newest first, each with the components that caused it, kept for 90 days. This answers "what took the checkout down yesterday". Requires the monitoring:read scope and the Pro plan or above.',
+    inputSchema: objectWith(
+      { serviceId: SERVICE_ID, limit: { type: "integer", minimum: 1, maximum: 200, description: "How many changes (default 50)." } },
+      ["serviceId"]
+    ),
+    argsSchema: external_exports.object({ serviceId: external_exports.string().min(1), limit: external_exports.number().int().min(1).max(200).optional() }),
+    handler: async ({ serviceId, limit }, config) => apiGet(`/v1/monitoring/services/${encodeURIComponent(serviceId)}/history`, { limit: asText(limit) }, config)
   })
 ];
 function findTool(name) {
@@ -4366,7 +4653,7 @@ function findTool(name) {
 
 // src/protocol.ts
 var SERVER_NAME = "aaa-sentinel-mcp";
-var SERVER_VERSION = "0.2.0";
+var SERVER_VERSION = "0.3.0";
 var SUPPORTED_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
 var PARSE_ERROR = -32700;
 var INVALID_REQUEST = -32600;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aaa-sentinel/mcp-server",
-  "version": "0.2.0",
-  "description": "Read-only MCP server for AAA Sentinel: query accounts, scans, findings, savings, forecasts, anomalies and security posture from an AI agent",
+  "version": "0.3.0",
+  "description": "Read-only MCP server for AAA Sentinel: query cloud costs, savings, security posture, AI spend, uptime monitoring, the remediation agent and managed clients from an AI assistant",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -14,7 +14,11 @@
     "mcp",
     "modelcontextprotocol",
     "finops",
-    "cost"
+    "cost",
+    "monitoring",
+    "uptime",
+    "security",
+    "ai-spend"
   ],
   "publishConfig": {
     "access": "public"