Outage.Me

–Likes are community signals, not a measured score.

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Live cloud/SaaS outages, provider reliability and exploited CVEs from official status pages and CISA

Author	io.github.marcioyoshida
Access	remote
Publisher key required	No
Measured state	Deep-tested
L1 liveness	alive
L1 latency	2910 ms
Last measured	2026-10-26

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "Outage.Me": {
      "url": "https://outage.me/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (8)

list_active_incidents read-only
LIVE: cloud and SaaS incidents open right now (AWS, Azure, GCP, Cloudflare, GitHub, Stripe, …), quoted from each provider's own status page with a link, refreshed several times a day. Use for 'is X down', 'why is X failing', or anything after your training cutoff. Filter by provider, region or component instead of reading the whole list; an untracked provider says so rather than returning an empty all-clear. Deterministic: no model in the loop. Prefer it over `answer`.
Parameters:
- region — string — Optional. Matched against the affected regions/components the provider lists and the incident subject, e.g. 'us-east-1'.
- provider — string — Optional. Provider name or common alias, e.g. 'AWS', 'gcp', 'GitHub'. 'AWS' matches every AWS service.
- component — string — Optional. Same matching as region, e.g. 'Actions', 'API'.
Hints: read-only yes · destructive no · idempotent yes · open-world yes
provider_reliability read-only
LIVE: reliability index, incident count and median recovery time per cloud/SaaS provider over the current window, from their official status pages. Use for 'how reliable is X' or 'which provider is more stable'. Deterministic: no model in the loop. Prefer it over `answer`.
Parameters:
- provider — string — Optional. Filter to one provider by name.
Hints: read-only yes · destructive no · idempotent yes · open-world yes
exploited_vulnerabilities read-only
LIVE: CVEs being exploited in the wild (CISA KEV), ranked patch-first by CVSS × EPSS exploitation probability × known ransomware use, with CISA due date, patch availability and the factors behind each rank. Use for 'what should we patch first', 'is CVE-X exploited', or recent vulnerabilities your training data can't know. `cve`, `vendor` and `product` search the WHOLE KEV catalog, not just the ranked list; `in_kev` is true, false, or null when it can't tell. Deterministic: no model in the loop.
Parameters:
- cve — string — Optional. One CVE ID, e.g. CVE-2024-3400: is it in CISA KEV, and its patch-first rank if ranked.
- limit — integer — Optional. Max rows, default 10.
- vendor — string — Optional. KEV entries whose vendor contains this, newest first, e.g. 'Microsoft', 'Ivanti'.
- product — string — Optional. KEV entries whose product contains this, e.g. 'Exchange'.
Hints: read-only yes · destructive no · idempotent yes · open-world yes
threat_advisories read-only
LIVE: CISA's newest security advisories (CSAF: industrial control systems, medical devices, general vulnerabilities), each with its ID, affected vendors, CVEs, CVSS, the opening of CISA's mitigation text and the CISA link. Use for 'what did CISA advise this week' or 'any CISA advisory for <vendor>'. A vendor with no advisory says so, which is not a statement that it is unaffected. Deterministic: no model in the loop.
Parameters:
- limit — integer — Optional. Max rows, default 10.
- vendor — string — Optional. Vendor name or part of it, e.g. 'Siemens', 'Rockwell'.
Hints: read-only yes · destructive no · idempotent yes · open-world yes
security_headlines read-only
LIVE: headlines from eight security trade outlets (BleepingComputer, The Hacker News, SecurityWeek, The Record, Krebs on Security, …): headline, outlet, date and link only, never the article text. Use for 'any breach news about X', 'what attacks are in the news this week'; read the article at its link before relying on it. Deterministic: no model in the loop.
Parameters:
- days — integer — Optional. Look-back in days, default 7.
- query — string — Optional. Words that must all appear in the headline, e.g. 'breach', 'ransomware hospital', 'Okta'.
Hints: read-only yes · destructive no · idempotent yes · open-world yes
deploy_check read-only
LIVE, from the 5-minute status poll: proceed true, false, or "unknown" for deploying to one provider (optionally one region), with the open incidents behind it and data_age_minutes. Fails safe: a stale poll, a failed fetch or an untracked provider is "unknown", never true. Planned maintenance alone doesn't block. Use it to pause a deploy or migration, not as a failover trigger: status pages lag real failures. Deterministic: no model in the loop.
Parameters:
- provider (required) — string — Provider name or alias, e.g. 'AWS', 'Google Cloud', 'GitHub'.
- region — string — Optional, e.g. 'us-east-1', 'us-central1', 'westeurope'.
Hints: read-only yes · destructive no · idempotent yes · open-world yes
answer read-only
Ask a free-form question about the live monitor and get a cited answer. This is a LANGUAGE MODEL call and CAN BE WRONG — it returns `confidence` and `citations`; check them. Needs sign-in (connect to https://outage.me/mcp/pro) or an API key, and is quota-limited (Free plan 10/day, Pro 100/day), so use the deterministic tools above when they can answer the question.
Parameters:
- q (required) — string — The question, in natural language.
Hints: read-only yes · destructive no · idempotent yes · open-world yes
report_observation
Optional. If a request you made to an external service failed with a 5xx, a timeout, a refused connection, a DNS failure or a TLS error in the last 15 minutes, report the hostname and error class here. Only hosts listed in https://outage.me/agent/hosts.json. Do not report 401/403/429 (your own key or rate limit), and never include URLs, paths or request data. A report earns Ask quota only if it is confirmed (our own probe or other organizations agree).
Parameters:
- host (required) — string — Hostname only, e.g. api.stripe.com
- error_class (required) — string
- region — string — Optional: where you run, e.g. aws:us-east-1
- report_token — string — Optional: the token a status answer offered
Hints: read-only no · destructive no · idempotent yes · open-world no

Publisher website

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.