Skip to main content
Glama

WebUpCheck — DNS, Website & Provider Diagnostics

Investigate a website failure with provider incident context

investigate_incident
Read-onlyIdempotent

Use when a public endpoint fails and you need evidence-based next steps. Combines one protected HTTP/DNS check, existing homepage history where supported, and optional official provider incidents. Provider is inferred only for known provider-owned hostnames; pass provider for a known dependency of another site. A reported incident is not proof of cause or a cyberattack. Returns partial evidence if a source is unavailable/rate limited. No changes, scans, login or recovery actions. No API key; underlying probe budgets apply. Honor checkedAt, cached, freshness and source-text trust warnings.

Input Schema

NameRequiredDescriptionDefault
urlYesPublic HTTP(S) hostname or endpoint. No credentials, private addresses or nonstandard ports. Avoid secret-bearing query strings.
providerNoOptional known dependency; supplying this does not establish cause or affected component.

Output Schema

NameRequiredDescriptionDefault
issuesYes
targetYes
partialYes
securityYes
assessmentYes
hypothesesYes
generatedAtYes
limitationsYes
observationYes
sourceErrorsYes
providerReportYes
historyCoverageYes
homepageHistoryYes
investigationIdYes
providerAssociationYes
recommendedNextStepsYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond the readOnly/openWorld/idempotent annotations: degraded behavior ('Returns partial evidence if a source is unavailable/rate limited'), cost/auth constraints ('No API key; underlying probe budgets apply'), and a semantic caveat that a reported incident is not proof of cause or attack. It also tells the agent to honor checkedAt/cached/freshness/trust warnings, which shapes how results must be interpreted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the trigger condition, then dense supporting constraints; nearly every clause carries operative information. The closing trust-warning sentence is slightly compressed/telegraphic but still earns its place by governing result interpretation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return structure need not be explained, and the description still covers degraded responses and trust signals. For a read-only composite diagnostic with 2 fully documented params, an agent has everything needed to call it and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds genuine meaning the schema lacks: provider is 'inferred only for known provider-owned hostnames' and should be passed manually for a known dependency hosted elsewhere. That explains the tool's defaulting logic rather than restating the enum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb+resource: an evidence-gathering investigation that 'combines one protected HTTP/DNS check, existing homepage history, and optional official provider incidents.' This delineates it as a composite of the granular sibling checks, though it never names those siblings (check_website, check_dns, get_provider_incidents) to make the split explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete trigger ('Use when a public endpoint fails and you need evidence-based next steps') plus a conditional routing rule for the provider parameter ('pass provider for a known dependency of another site'). Also states exclusions ('No changes, scans, login or recovery actions'). It stops short of naming the alternative single-purpose tools, so the agent must infer when to use those instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources