List Alerts
list_alertsList alerts that have fired, newest first.
This is the "what is broken" tool. An alert is opened by a detector and stays
open, accumulating occurrences, until the detector resolves it — so an open
alert with a recent last_seen is still happening.
workspace: optional workspace id, name, or org-name/workspace-name when the
same name occurs in two of your orgs (defaults to your default).
status: open or resolved; omit for both.
kind: narrow to one detector — consistent_error_pattern, silent_failure,
tool_loop, or custom. Every custom rule shares the kind "custom", so use
rule_id to isolate one custom rule.
rule_id: narrow to the firings of one specific rule (from list_alert_rules).
service: exact service name.
step: exact step (span) name.
search: case-insensitive match on the alert title.
acknowledged: true or false; omit for both.
hours: how far back to look, on last_seen. Defaults to 24. The server itself is
unbounded if no window is given, which would scan all history.
limit: rows to return, at most 200.
Example:
What alerts are open right now?
{ "name": "list_alerts", "arguments": { "status": "open" } }Example:
Show me the errors alert for the checkout service this week.
{ "name": "list_alerts", "arguments": { "service": "checkout", "hours": 168 } }Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | ||
| step | No | ||
| hours | No | ||
| limit | No | ||
| search | No | ||
| status | No | ||
| rule_id | No | ||
| service | No | ||
| workspace | No | ||
| acknowledged | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |