{"audit":{"version":"1.5","generated_at":"2026-10-15T22:42:06.350593+00:00","generated_by":"Agenstry","report_url":"https://agenstry.com/agents/watchfor.io","methodology_url":"https://agenstry.com/methodology","verifier_jwks_url":"https://agenstry.com/.well-known/jwks.json","subject":{"domain":"watchfor.io","name":"WatchFor","url":"https://watchfor.io/.well-known/agent-card.json"}},"identity":{"provider":{"organization":"WatchFor","url":"https://watchfor.io"},"registry_verification":null,"signature":{"signed":false,"signature_valid":null}},"protocol":{"version":"0.3.0","supports_streaming":false,"supports_push_notifications":false},"operational":{"live_state":"auth_required","live_responds":false,"last_status_code":200,"last_elapsed_ms":183,"last_error":null},"track_record":{"first_seen":"2026-10-15T20:25:59.067903+00:00","last_checked":"2026-10-15T20:25:59.067903+00:00","last_seen_ok":"2026-10-15T20:25:59.067903+00:00","checks_total":1,"checks_ok":1,"uptime_pct":100.0,"uptime_window_days":30,"uptime_probes":1,"archived":false,"archived_reason":null},"conformance":{"score":51,"grade":"D","summary":"D-grade: significant issues, auth-gated, partially broken, or stale.","criteria":[{"key":"valid_card","label":"Valid AgentCard","points":10,"max_points":10,"status":"pass","detail":"Parseable AgentCard returned by the well-known endpoint (Agenstry readiness signal; not an official TCK certification)."},{"key":"live_responds","label":"Live JSON-RPC","points":15,"max_points":25,"status":"partial","detail":"Endpoint requires auth, real agent but not anonymously callable."},{"key":"protocol_version","label":"Protocol version","points":5,"max_points":10,"status":"partial","detail":"Declares pre-1.0 A2A 0.3.0 (Google preview). Upgrade to v1.x for full points."},{"key":"signature","label":"JWS signature","points":0,"max_points":10,"status":"info","detail":"Card is unsigned (most published agents are)."},{"key":"uptime","label":"Uptime track record","points":0,"max_points":15,"status":"info","detail":"Only 1 probe so far, need ≥5 for an uptime grade."},{"key":"skills","label":"Skill declaration","points":10,"max_points":10,"status":"pass","detail":"Declares 18 skills with structured metadata."},{"key":"verified_identity","label":"Verified Identity","points":5,"max_points":10,"status":"partial","detail":"Provider declared: WatchFor (https://watchfor.io). Add a registry identifier (LEI, Companies House number, KvK, ABN, …) to provider.legalEntity for full verified-business credit."},{"key":"freshness","label":"Freshness + modern flags","points":4,"max_points":5,"status":"pass","detail":"seen in upstream source within 0d"},{"key":"security","label":"Security declaration","points":2,"max_points":5,"status":"partial","detail":"Declares 2 security scheme(s) but none use PKCE or mTLS."}]},"card_read":{"findings":[],"clean":true,"source_url":"https://watchfor.io/.well-known/agent-card.json"},"skills":[{"id":"check-status","name":"Check current status","description":"Answer 'is it up right now?' for a single monitor or the whole organization: current up/down/degraded status, and the health-score snapshot across everything being watched.","tags":["monitoring","status","health","uptime"],"examples":["Is watchfor.io up right now?","What's the overall status of my monitors?","Check the status of monitor <id>"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"list-monitors","name":"List monitors","description":"Enumerate what the organization is watching — id, name, type, target and current status — so an agent starting cold can discover monitors before checking or explaining one. Optionally filter by a search term, type or status.","tags":["monitoring","discovery","inventory","list"],"examples":["What are you monitoring?","List all down monitors","Show my SSL monitors"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"diagnose-incidents","name":"Diagnose what's wrong","description":"Explain what is currently broken and WHY. Returns every active incident with what failed (the exact alert rule and trigger value), a plain-language category (TLS certificate, HTTP 5xx, DNS, latency, reachability…), which monitor, how long it has been down, and whether it has been acknowledged — everything needed to describe the problem to a human.","tags":["monitoring","incidents","diagnosis","root-cause","troubleshooting"],"examples":["What's wrong with my infrastructure right now?","Why is my site down?","Diagnose active incidents for monitor <id>"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"explain-monitor","name":"Explain a monitor","description":"Describe one monitor end to end so an agent can explain it: what it watches (type + target), its current status, recent uptime, its alert rules, and its recent incident history.","tags":["monitoring","explain","configuration","uptime"],"examples":["What does monitor <id> check and how healthy is it?","Explain the monitoring set up for api.example.com"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"incident-report","name":"Report on an incident","description":"Reconstruct one incident after (or during) the fact: what fired, the trigger values, the full timeline (detected → acknowledged → resolved) with durations, and which monitor it affected. Use it to answer 'what happened?'.","tags":["monitoring","incidents","post-mortem","timeline"],"examples":["What happened in incident 4210?","Give me a timeline for incident <id>"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"reliability-report","name":"Reliability report","description":"Summarise how reliable things have been over a period: incident counts by severity and mean time to resolution, plus the current health snapshot. Optionally scope to one monitor.","tags":["monitoring","uptime","reliability","reporting","mttr"],"examples":["How reliable was my infrastructure this week?","Give me a 30-day reliability report"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"org-report","name":"Organization report","description":"The full organization report for a period, always compared with the previous equal-length period: uptime, incidents, MTTR/MTBF, downtime, response-time trend, per-monitor rows (worst first), type-aware sections (SSL/domain expiry, Core Web Vitals, heartbeat check-ins, DNS blocklists, MCP tool drift, hosts running the agent) and plain-language insights — the same document behind the dashboard Reports page and scheduled report emails. For a lighter incident-only summary use reliability-report.","tags":["monitoring","uptime","reporting","trends","insights"],"examples":["Give me the weekly report","How did last month compare to the one before?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"describe-monitor-types","name":"Describe monitor types","description":"Discover what WatchFor can monitor and how to configure it: every monitor type (http, ssl, dns, tcp, ping, api, playwright/browser checks, browser/Core Web Vitals, heartbeat, …) with its target format and example, its config fields, and the exact alert metrics you can build rules from. Call this BEFORE create-monitor to choose a type and build a valid config. Optionally pass one type to get just its details.","tags":["monitoring","discovery","catalog","configuration","capabilities"],"examples":["What can WatchFor monitor?","What monitor types are available?","What config fields does the ssl monitor take?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"list-locations","name":"List probe locations","description":"List the probe locations (cities/regions) a monitor can run from — their ids are what create-monitor's `locations` expects. Call this to pick where to check from.","tags":["monitoring","discovery","locations","regions"],"examples":["Where can WatchFor check from?","List the available monitoring locations"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"check-hosts","name":"Check servers","description":"Which servers running watchfor-agent are online, stale or offline right now, with their current CPU, memory and disk usage — the host-side counterpart of check-status. Pass status to narrow (e.g. offline). Each host's monitor_id links it to incidents and status pages.","tags":["hosts","servers","infrastructure","status","monitoring"],"examples":["Are all my servers online?","Which hosts are offline or stale?","Show CPU, memory and disk usage across my servers"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"who-is-on-call","name":"Who is on call","description":"Who is on call right now and until when, who takes over next, the schedule's layers and any active override — and whether the current person can actually be paged (reachable). Ask this before asserting that someone was notified.","tags":["on-call","escalation","incident-response","people"],"examples":["Who is on call right now?","Who takes over on-call tonight?","Can the person on call actually be reached?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"create-monitor","name":"Create a monitor","description":"Start watching something on the user's behalf. Provide the target and monitor type — call describe-monitor-types first for exact type ids, target formats and config fields, and list-locations for location ids. Credentials (config fields marked secret, e.g. a mailbox password) are write-only: stored encrypted, returned as \"[redacted]\". Requires the write scope.","tags":["monitoring","provisioning","setup"],"examples":["Monitor https://api.example.com every minute from Europe","Watch the SSL certificate on example.com"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"manage-incident","name":"Acknowledge or resolve an incident","description":"Take ownership of an active incident: acknowledge it (I'm on it — pauses repeat notifications) or resolve it. Requires the write scope. Resolve is accepted asynchronously; if the underlying problem persists the incident re-fires.","tags":["monitoring","incidents","on-call","operations"],"examples":["Acknowledge incident 4210","Resolve incident 4210 — the deploy fixed it"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"manage-maintenance","name":"Schedule or manage maintenance windows","description":"Suppress alerts and exclude downtime during planned work — useful for an agent doing a deploy that would otherwise trip monitoring. action: create (default), list or cancel. Requires the write scope for create/cancel. Times are ISO 8601; duration in minutes.","tags":["monitoring","maintenance","deployments","operations"],"examples":["Silence alerts on my API for the next 30 minutes while I deploy","List scheduled maintenance windows","Cancel maintenance window <id>"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"manage-report-emails","name":"Manage scheduled report emails","description":"Every organization has two report-email cadences — weekly (Mondays) and monthly (the 1st) — with up to 5 recipients each. action: list (default) shows both with recipients and enabled state; set toggles a cadence and/or replaces its recipients. Enabling needs at least one recipient; clearing the recipients disables the cadence. Requires the write scope for set.","tags":["monitoring","reporting","email","settings"],"examples":["Who gets our weekly report?","Turn on the monthly report and send it to ops@example.com","Remove john@example.com from the weekly report"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"list-incidents","name":"List incidents","description":"List incidents newest first with filters — status (firing/acknowledged/resolved), severity, a single monitor, and a started-at time range. Use this for history and reporting; use diagnose-incidents for what is broken right now.","tags":["monitoring","incidents","history","reporting"],"examples":["Show resolved incidents from the last week","List all critical incidents"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"manage-monitor","name":"Manage a monitor","description":"Operate on an existing monitor: pause, resume, run an immediate check, update its fields (name/target/interval/config/tags), delete it, or — page integrity monitors — accept the latest state of the watched pages as the new baseline after a deploy (optional pages[]; fresh: true checks the pages first and accepts that check — use it right after a release; an open integrity incident resolves at once when nothing else differs), or — browser checks — test-script: run the check's saved Playwright script (or a new `script` before saving it with update) once in a sandboxed browser and return the result. Requires the write scope. Delete is permanent — confirm with the user first unless they explicitly asked. Never accept a baseline over unreviewed security findings (new scripts, forms, headers) without the user. Stored passwords read back as \"[redacted]\" — omit them (or send the mask) to keep them; changing the server, port, TLS mode or login they are used with needs the password again in the same update.","tags":["monitoring","operations","lifecycle"],"examples":["Pause monitor <id>","Change monitor <id> to check every 60 seconds","Run a check on <id> now","Delete monitor <id>","We just deployed — accept the new baseline on page integrity monitor <id>","Test the new login script on browser check <id> before saving it"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]},{"id":"diagnose","name":"Diagnose a target","description":"Investigate any public host or URL LIVE from WatchFor's probe fleet — 20+ locations across 7 regions — whether or not it is monitored. By default it runs the whole bundle at once (DNS, DNS propagation everywhere, TLS grade, HTTP headers, and ping from up to 3 regions) and returns one verdict with a status per check, a machine-readable list of what looks wrong and the TLS and security headers grades. Pass `check` to run just one of: smart-audit (Everything at once for a site: domain expiry, HTTPS/TLS, DNS records and email anti-spoofing, as one scored report.); cwv-check (How fast does this page feel to a real browser — LCP, CLS, TBT and the Lighthouse performance score?); dns-lookup (What does DNS return for this name right now — A/AAAA/MX/TXT/NS/CNAME/SOA/CAA/SRV and more, optionally from a specific resolver?); dns-propagation (Has a DNS change propagated yet — what does every one of our probe locations see for this record?); dns-health (Is this domain's DNS set up well — at least two nameservers on separate networks, no lame delegation, parent and zone agreeing, SOA serials in sync, DNSSEC valid, CAA published — as an A+…F grade? Add propagation:true to also grade whether every probe location sees the same answer.); whois (Who owns this domain, when does it expire, which registrar and nameservers does the registry list (live RDAP, cache bypassed)?); ping (Is this host reachable by ICMP from a given location, and what is the round-trip time and packet loss?); traceroute (Which network path do packets take to this host from a given location, and where do latency or loss appear?); port-checker (Is this TCP port open from a given location, and what banner does the service send?); blacklist (Is this IP or host listed on the major DNS blocklists (RBLs) that mail servers consult?); ssl-check (What certificate does this host serve — issuer, subject/SAN names, validity dates and days until expiry?); tls-grade (How good is this host's TLS configuration — an A+…F grade with the protocol versions, cipher suites and weaknesses behind it?); mcp-check (Is this Model Context Protocol endpoint alive and spec-compliant — protocol version, capabilities and the tools it advertises?); http-headers (What does this URL actually return right now — status code, redirect chain, response headers and timing?); api-tester (What does this API endpoint answer to a full request (method, headers, body) — status, headers and the complete response body?); cdn-check (Which CDN serves this URL, which edge answers in each region, is it actually being cached, and where is delivery going wrong?); sitemap-check (Does this domain publish a valid sitemap, is it reachable from robots.txt, and do its URLs resolve?); brotli-check (Does this domain serve Brotli or gzip compression, and how much bandwidth is it saving?); redirect-chain (Where does this URL end up — every redirect hop with its status code and Location, the final URL, and whether the chain is longer, slower or less secure than it should be?); websocket-test (Can a WebSocket be opened to this URL — handshake time, the server's IP, a ping/pong round-trip, and does it answer a message with the expected reply?); smtp-test (Does this mail server accept connections — its banner, whether STARTTLS is offered, whether reverse DNS matches, and whether it relays mail for strangers?); mail-server-check (How secure are this domain's mail servers — an A+…F grade per service (inbound MX, SMTP submission, IMAP, POP3) for TLS, certificates, STARTTLS, plain-text login, open relay, MTA-STS, TLS-RPT and DANE, checked from three regions?); ntp-test (Does this NTP server answer, and what stratum, clock offset, round-trip delay and leap indicator does it report per sample?); email-health (Is this domain protected against email spoofing — are SPF, DKIM and DMARC present and correctly configured?). Graded checks return a `grade`: the same A+ to F letter the WatchFor dashboard shows, its rubric id and the findings that cap it, each with its fix. This measures right now; use check-status or diagnose-incidents for what WatchFor already recorded. Each check spends the organization's per-plan allowance and the response says how much is left.","tags":["diagnostics","network","dns","tls","troubleshooting"],"examples":["Why can't I reach example.com?","Has the DNS change for app.example.com propagated yet?","Is port 443 open on db.example.com?","What TLS grade does example.com get?"],"inputModes":["application/json","text/plain"],"outputModes":["application/json","text/plain"]}],"provenance":[{"source":"smithery","first_seen":"2026-10-15T20:25:59.067903+00:00"}],"recent_probes":[{"fetched_at":"2026-10-15T20:25:59.067903+00:00","ok":true,"status_code":200,"error":null,"elapsed_ms":183,"live_responds":false}],"catalog_attestation":null,"operator_revenue_evidence":{"evidence_class":"operator_submitted","authenticity":{"rung":"no_operator_evidence","rank":0,"why":"No verifiable operator evidence has been submitted for this agent.","thresholds":{"min_independent_payers":3,"min_verified_usd":25.0},"engine_table":"agent_authenticity","merge_rule":"max(existing_rank, rank)"},"metric_metadata":{"provenance":"operator_submitted_evidence","confidence":"attested","coverage":{"numerator":0},"as_of":"2026-10-15T22:42:06.364788+00:00","definition":"Revenue proofs submitted by the verified owner and re-checked by Agenstry against the settlement chain or the operator's own Stripe account. Only independently confirmed proofs are counted."},"counts":{"retained":0,"verified":0,"unverifiable":0},"verified":{"gross_usd":0.0,"transactions":0,"independent_payers":0},"detail_url":"https://agenstry.com/api/agents/watchfor.io/evidence","dispute_url":"https://agenstry.com/agents/watchfor.io/dispute"},"verification_history":[],"signatures":[{"protected":"eyJhbGciOiJFUzI1NiIsImprdSI6Imh0dHBzOi8vYWdlbnN0cnkuY29tLy53ZWxsLWtub3duL2p3a3MuanNvbiIsImtpZCI6ImFnZW50ZmluZGVyLWVzMjU2LTEiLCJ0eXAiOiJKT1NFIn0","signature":"vlPNyv4SNGBTQ-xVbkOo1ijxLdQli_6UL5kpfscioky2pTQ5Mthc4WBncRgtr99MVa7t1KwTcciEiEx4bUDKWA"}]}