Signal Desk — API Incident Triage

Read-only incident triage for small API teams, built with JavaScript, Vue 3, MCP and a Rust/WASI component targeting Terminal 3.

Status: local prototype verified; T3N authenticated execution and contest submission are NOT completed. The screenshot and default UI use synthetic data. Do not describe this repository as a completed or prize-winning T3N submission.

What it does

• Classifies HTTP failures, timeouts, slow responses, rate limits and missing observations into actionable briefs.

• Exposes triage_demo and inspect_service through an MCP stdio server so an AI client can use the workflow.

• Probes only operator-configured service IDs over public HTTPS, with a 5-second timeout, DNS address pinning, no redirects and no response-body collection.

• Produces structured JSON and human-readable incident reports. Remediation is always human-controlled.

• Includes an original WASI Preview 2 classification component and an SDK adapter for encrypted T3N calls. No TEE network execution is claimed yet.

This is a narrow incident-triage companion, not a replacement for mature uptime platforms. The official Terminal 3 SDK and MCP SDK supply the integration infrastructure. Rules are deterministic; no LLM provider subscription is required. An external MCP-compatible AI client supplies conversational orchestration.

Related MCP server: incident-copilot

Run locally

Node.js 22 or newer:

npm ci --ignore-scripts
npm test
npm run demo
npm start

Open http://127.0.0.1:4317 on the same computer. The UI is intentionally a synthetic demo, not a live monitoring console. evidence/preview.html is an offline standalone rendering of that same component.

Use from an MCP client

Point a stdio MCP server entry at your Node executable and the absolute path to src/mcp.mjs. No credentials are required for these two local tools.

Example user requests:

• “Run the incident triage demo, identify the services needing attention, and give me the next steps.”

• “Inspect the configured service terminal3-docs once and summarize the observation. Do not change anything.”

An operator may edit services.json with authorized public health endpoints. Clients cannot supply arbitrary URLs. Requests to a service are limited to one per minute per MCP process. No persistent scheduler is installed.

T3N component

rustup target add wasm32-wasip2
cargo test --lib --manifest-path contract/Cargo.toml
cargo build --manifest-path contract/Cargo.toml --release --target wasm32-wasip2

Artifact: contract/target/wasm32-wasip2/release/signal_desk.wasm. A copy is included at dist/signal_desk.wasm. The component exports classify-observation using the documented generic-input envelope. It has no HTTP, storage or secret host imports. Only minimal observations enter the adapter; service response bodies do not.

The HTTP probe is outside the enclave. Enclave classification does not prove endpoint data was truthful, does not establish root cause and is not a remote attestation of the monitored service. This separation is intentional and must remain clear in demonstrations.

Human-controlled network setup

Use Terminal 3's official claim page to sign in and preserve the one-time test identity key in your own password manager. Never place it in chat, source code, shell commands, command arguments, environment assignments or a report.

From your own interactive terminal in this directory, run:

npm run live

The command accepts the identity key through hidden terminal input, stores no key, uses the SDK's pinned testnet trust manifest, authenticates the tenant, registers version 0.1.0 on first run, then compares five remote results with the local reference. It refuses noninteractive credential entry. It uses free test credits; it must not be pointed at production or a funded wallet.

The DID comes from the authenticated session. Successful network evidence is written to ignored local files live-state.json and evidence/live-verification.json. Inspect these yourself before sharing any non-secret identifiers. Failure logs deliberately name only the stage, not raw SDK messages.

This first network check is a tenant self-call, not a claim of separately provisioned agent delegation. Completing the contest-quality integration still requires checking the current full walkthrough, implementing and verifying the separate agent identity/permission path where required, and connecting the MCP workflow to the authenticated adapter. Do not submit the local demo in place of that work.

Verification performed

• Six Node unit tests passed: classification, missing data, malformed/injected fields, public-IP policy, endpoint policy and summaries.

• Three native Rust unit tests passed.

• MCP client/server integration passed: tool discovery, demo execution and unknown service rejection.

• SDK 5.10.0 exports checked and its WASM component loaded successfully.

• WASI component compiled; build digest is in evidence/wasm-build.json.

• One actual public HTTPS check returned HTTP 200; see evidence/public-probe.json. That is a local probe, not a T3N invocation.

• Offline Vue rendering was visually inspected. The managed browser refused navigation to the loopback URL, so no claim of an interactive browser end-to-end test is made.

• The host's default cargo test doc-test stage failed because a system LLVM library was missing; there are no doctest examples. Explicit cargo test --lib passed. This host issue was not counted as a platform bug.

Maintenance and handover

See HANDOVER.md, submission status and observed documentation friction. Dependencies are locked. No real client data, financial activity, private endpoints or credentials are needed for the synthetic demo.

Sources and acknowledgments

• Terminal 3 Quickstart

• Official TEE walkthrough

• Contract registration

• Contract invocation

• Official reference repository, inspected at commit 1226b396ac909379df0814308c5c9ea055e703f0. No flight-business logic or vendored source was incorporated.

• @terminal3/t3n-sdk, @modelcontextprotocol/sdk, Vue and Zod retain their respective upstream licenses. Project source is MIT licensed.