MCP Server

The Model Context Protocol (MCP) lets supported AI clients use Watchgoose tools through a project-scoped connection you approve.

Connect Claude

In Claude, open Settings > Connectors, add a custom connector, and enter:

https://mcp.watchgoose.com/mcp

Claude opens Watchgoose in your browser. Sign in, choose one project, review the requested access, and continue. Read-only access is selected by default.

Connect Claude Code

Add the hosted Streamable HTTP server for your user:

claude mcp add --transport http --scope user watchgoose https://mcp.watchgoose.com/mcp

Start Claude Code and complete the browser authorization when prompted. Run claude mcp get watchgoose to inspect the saved connection.

Other Remote Clients

Use https://mcp.watchgoose.com/mcp in clients that support remote Streamable HTTP MCP servers, OAuth 2.1, PKCE, and Dynamic Client Registration. The OAuth issuer is https://mcp.watchgoose.com. You do not paste a Watchgoose API key into a remote client.

Project Access

Each connection is limited to one project. The consent screen always starts with Read-only access. It offers Read and write only when the client requests the mcp:write scope and you have permission to modify the selected project.

Changing a read-only connection to read and write requires a new authorization. Revoke the existing connection under Account settings > MCP Connections, disconnect it in the client, and connect again. Review every requested write operation in the client before approving it.

Tools

Tool	What it does	Required OAuth scope
`list_checks`	Lists checks, with optional slug or tag filters.	`mcp:read`
`get_check`	Gets one check and its current state and schedule.	`mcp:read`
`list_flips`	Lists retained status changes. `up: 1` means the check became up; `up: 0` includes down, paused, and new after resume. A pause or resume that changes status records a flip.	`mcp:read`
`list_pings`	Lists recent signals without source or body data.	`mcp:read` + `mcp:write`
`list_channels`	Lists integration names and kinds for assignments.	`mcp:read` + `mcp:write`
`create_check`	Creates a simple, cron, or OnCalendar check.	`mcp:read` + `mcp:write`
`update_check`	Changes selected fields on a check.	`mcp:read` + `mcp:write`
`pause_check`	Pauses monitoring without deleting a check.	`mcp:read` + `mcp:write`
`resume_check`	Resumes a paused check.	`mcp:read` + `mcp:write`
`delete_check`	Permanently deletes a check and its retained history.	`mcp:read` + `mcp:write`

The offline_access scope lets a client reconnect without repeating consent for every session. It does not expose additional tools.

Identifiers and Private Fields

AI clients address checks by their stable unique_key. The MCP server uses internal identifiers only when calling the Management API and removes them from tool results.

The connected AI client never receives check UUIDs or ping URLs, integration channel UUIDs, source IP addresses, user agents, run IDs, body URLs, or ping body contents. Ping results include only signal type, date, sequence number, scheme, method, and duration. The server does not request ping bodies.

Credentials, Storage, and Revocation

Watchgoose exchanges a single-use, five-minute handoff for a delegated project credential. The hosted MCP service processes that credential in memory for API requests and stores it only in encrypted OAuth state. It never returns the credential, OAuth tokens, or API keys to the AI client as tool output.

OAuth client, authorization, session, grant, and delegated credential state is stored in service-owned SQLite on the single production host in one region. The state and its identifiers are encrypted or keyed at rest and follow the normal production backup rotation. The MCP application adds no telemetry. The production proxy keeps normal security and operational access logs, including source address, user agent, full request URI including its query string, method, status, and timestamp. It removes authorization and cookie headers from those logs and skips the OAuth callback entirely. It also removes the credential-bearing X-Api-Key header used for project API requests. Access-log fields are never returned as tool output.

Watchgoose keeps connection metadata and records each MCP API operation, route, method, outcome, HTTP status, and timestamp. Audit events are retained for 90 days. Revoke a connection under Account settings > MCP Connections to block future project API access. The client must complete authorization again to reconnect.

Read the Privacy Policy for the complete processing and retention boundary.