Set up your on-call without opening a dashboard
WardenPoint speaks MCP. Point Claude, Cursor or any MCP client at your account and describe the rota you want. 89 operations are available to it — recipients, groups, escalation policies, schedules, routing rules.
- Install
- One npx line. Nothing to build, nothing to host.
- Scope
- You tick the abilities when you issue the key.
- Secrets
- No ability grants reading them.
What it looks like
Prose in, structure out
You describe the arrangement you want in your own words. What comes back is not a summary — it is configuration that pages people.
You say
«Add Marta and Piotr, put them in a Payments group, and page whoever is on call by phone first, Telegram second.»
What now exists
- Two recipients with their contacts
- A Payments group
- An escalation policy: call, then message
- The group wired to that policy
You say
«Weekday primary rotation across the three of them, handover Mondays at 09:00 Warsaw time.»
What now exists
- A schedule in Europe/Warsaw
- A weekly rotation with a Monday 09:00 handover
- Escalation steps that target whoever holds the shift
You say
«Grafana alerts labelled severity=critical should skip the wait and ring straight away.»
What now exists
- A Grafana integration with a signed endpoint
- A routing rule matching severity=critical
- Critical priority with no delay on the first step
Every one of those is an ordinary, documented API call you could have made by hand. The agent is a faster way to make them — not a different way.
Setup
Three steps, four lines
There is nothing to install and nothing to run. Your MCP client starts the server itself, on demand.
- 1
Issue a key
In your dashboard, open API keys and create one. Tick the abilities the agent should have — read-only is a perfectly good place to start. The token is shown once.
- 2
Paste the config
Drop the block on the right into your MCP client's configuration and put the token in it. The client fetches and starts the server for you.
- 3
Ask for something
Start with a question rather than a change: ask who is on call right now. The answer comes from the same resolver that decides who your alerts wake at three in the morning.
Works with any MCP client — Claude Code, Claude Desktop, Cursor, Windsurf. The token stays in your own configuration file; it never travels anywhere else.
Reach
What the agent can work with
Every tool it has is generated from our OpenAPI description, which is generated from the code that serves the requests. There is no hand-kept list to fall out of date — describe a new endpoint and the tool appears; forget to describe it and the agent cannot see it.
Recipients and contacts
Create people, add their phone, Telegram, email or Slack, mark the primary one, retire someone who left.
Groups
Collect people into the teams your alerts actually address, and decide who the first page goes to.
Per-priority routing
Say what a low alert does and what a critical one does — per person, per group, per priority.
Escalation policies
Ladders of steps with delays, acknowledgement rules, and fallbacks when nobody answers.
On-call schedules
Rotations, handover times in the right timezone, overrides for the week somebody is away.
Alert sources
Grafana, Prometheus, Zabbix, Sentry, GitHub and plain webhooks, with signed endpoints and the rules that route what arrives.
Telephony
Extensions and phone numbers, assigned to the people who take calls.
What it cannot do to your account
Not policy, and not a switch on a settings screen: the API has no such operation.
Read a secret
Not with any ability, because there is no ability for it. The API answers whether a credential is set, never what it is.
Write a secret
It can ask us to issue a one-time link. You open that link in the dashboard, behind your own login, and type the value in yourself.
Exceed its key
A key limited to reading gets a 403 that names the ability it was missing — no silent partial success.
Four abilities, ticked when you issue the key. Give the agent reading only until you trust what it proposes, then give it writing. Revoke the key at any time and every tool it had stops working on the next call.
Questions people ask first
- Can the agent see my Telegram or Asterisk credentials?
- No. The ability vocabulary has no secret-reading case at all, so one cannot be granted by mistake. The API tells you whether a credential is present and whether it verified — never its value. To add one, the agent asks for a one-time link; you open it in the dashboard behind your login and type the value yourself. That is the whole mechanism, and it is why an agent can finish a setup it is not trusted with.
- What if I don't want it changing anything?
- Issue the key with reading only. The agent can then walk your entire configuration and explain it — which is genuinely useful on an account somebody else built — and every attempt to write comes back 403 naming the ability it would have needed.
- How do I know the tools match what WardenPoint actually does?
- Because nobody wrote them. Each tool — its name, its arguments, their bounds, the responses it can return — is read from our OpenAPI description at startup, and that description is generated from the code serving the requests. A hand-kept tool list is exactly the kind of second source of truth that drifts quietly for months; there isn't one here.
- Does this replace the dashboard?
- No, and it is not meant to. The dashboard is where you look at what is set up, where you type secrets, and where you go when something is wrong at three in the morning. The agent is for the part nobody enjoys — the twenty screens of initial setup, and the bulk edit six months later when the team changes.
- Which clients work?
- Anything that speaks MCP: Claude Code, Claude Desktop, Cursor, Windsurf and others. The server talks over stdio and your client starts it on demand, so there is nothing running on your machine between sessions.
Try it on your own account
Create an account, issue a read-only key and ask an agent to explain what it finds. Nothing to install, no card.
- Secrets stay out of the agent
- Abilities you choose
- Revoke the key at any time