# Alerts (https://www.lurq.run/docs/alerts)



lurq watches your repositories and MCP servers and tells you when something
changes. Every alert is also on the dashboard; these channels decide what reaches
you there without looking.

## Email [#email]

* **Urgent alerts** are on by default and fire only for changes that need you
  today: an MCP server rewrote a tool description so it now instructs your agent,
  a tool stopped being read-only, or a breaking release that your repository's
  version range will install on its own. One email per check, at most three a day.
* **The weekly summary** is off until you turn it on. It arrives on Mondays and
  covers everything that changed that week.

Both are set on **Dashboard → Notifications**, and every email has a one-click
unsubscribe link.

## Slack, Discord and Teams [#slack-discord-and-teams]

Paste an incoming webhook URL on **Dashboard → Notifications → Channels** and
choose the lowest severity to send. lurq posts a test message before saving the
channel. Each channel then receives one batched message per check with every
change at or above that severity.

* **Slack:** create an incoming webhook (`https://hooks.slack.com/services/…`).
* **Discord:** Server settings → Integrations → Webhooks (`https://discord.com/api/webhooks/…`).
* **Teams:** use the **Workflows** app's "Send webhook alerts to a channel" template.
  Office 365 connector URLs were retired by Microsoft in May 2026 and are refused.

Channels are part of the Team plan. A channel whose URL stops working (deleted,
revoked) is switched off with the reason shown, and can be resumed.

Webhook URLs are credentials, so lurq stores them encrypted and never shows them
again after you add them.

## Webhooks [#webhooks]

A generic webhook receives a JSON `POST`:

```json
{
  "type": "lurq.alerts",
  "delivery": "channel:12:4f1c…",
  "sentAt": "2026-09-14T13:02:11.000Z",
  "dashboardUrl": "https://lurq.run/dashboard/notifications",
  "more": 0,
  "items": [
    {
      "key": "mcp:381",
      "severity": "critical",
      "source": "mcp",
      "title": "notes: add_note now instructs your agent",
      "detail": "1 tool(s) rewrote their description and now instruct the model: add_note",
      "url": "https://lurq.run/dashboard/mcp/41"
    }
  ]
}
```

`X-Lurq-Delivery` identifies the delivery; a retry repeats it, so use it to
dedupe. `X-Lurq-Signature` is `t=<unix seconds>,v1=<hex>`, an HMAC-SHA256 of
`<t>.<raw body>` with the signing secret shown once when you add the webhook.
Verify it against the raw body and reject old timestamps:

```ts
import { createHmac, timingSafeEqual } from 'node:crypto';

export function verify(secret: string, header: string, rawBody: string): boolean {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=', 2)));
  const t = Number(parts.t);
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = createHmac('sha256', secret).update(`${t}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1 ?? '', 'hex');
  return given.length === expected.length && timingSafeEqual(given, expected);
}
```

## GitHub issue [#github-issue]

`lurq mcp-ci` writes a workflow that, besides scanning daily, keeps one pinned
**lurq dashboard** issue in the repository current: your MCP servers, what needs
attention, what changed, and the dependency upgrades waiting. The body is edited
in place, which notifies nobody; lurq comments, which does notify watchers, only
when a scan finds something urgent, and never twice for the same thing.

Close the issue to stop lurq updating it, or generate the workflow with
`lurq mcp-ci --no-issue` to leave it out. Text from MCP servers is escaped in the
issue, so a tool description cannot mention anyone or link anywhere.

## Remote MCP servers you run or pinned [#remote-mcp-servers-you-run-or-pinned]

lurq re-reads every remote MCP server in the official registry on a schedule,
without credentials, the same way a client first meets it. When one of those
servers changes, the accounts that depend on it are told — through the channels
above and through the agent itself, on its next tool call.

You depend on a server, in lurq's terms, when either is true:

* **You run it.** A `lurq mcp-scan` you uploaded included it. Nothing else to do:
  the scan you already ran is the subscription, and you are not asked to rescan.
* **You pinned it.** `lurq mcp-pin <url-or-registry-name>` records its tools and
  its sign-in path as approved. Re-pinning approves a change you have reviewed.

Three kinds of change are urgent, and they are the ones nobody would otherwise
notice until an agent failed:

* **its tools changed** — a tool removed, a parameter that became required, a
  description rewritten into an instruction to the model
* **its sign-in path changed** — a new authorization server, or a registration
  method (Client ID Metadata Documents, Dynamic Client Registration) or PKCE
  support that your client relies on is gone
* **it stopped answering** — calls to it will fail until it is back

Everything else reaches Slack, Discord, Teams and webhooks at its own severity,
and the weekly summary. Acknowledging is per account: one change on a shared
server, and every account that depends on it keeps its own unread state. Each
alert links to `/dashboard/mcp/public/<id>`, which shows the change, which
clients the server now works in, and a button to approve it.