24observe
checking… Sign in Start free
Features

Six primitives. Every real thing your stack breaks at.

Each check is a real file in apps/worker/src/checks.ts. Nothing below is a roadmap item.

HTTP / HTTPS
GET

HTTP / HTTPS

Verifies status codes, measures response time, flags degradation before full outage. Send custom headers (encrypted at rest), compare against expected status, track p95 over 24h.

CAPABILITIES
  • Status-code-exact assertions (expect 200, fail on 418)
  • Response-time thresholds — "degraded" tier fires before "down"
  • Custom headers, stored AES-256-GCM at rest
  • Follows redirects · validates cert chain · strict TLS
200 · 418 · 503
TCP & port
TCP

TCP & port

Reachable-or-not checks for databases, message queues, anything that speaks TCP. Uses pre-validated IPs so SSRF can't redirect the connect.

CAPABILITIES
  • Raw TCP connect with configurable timeout (1–30s)
  • Connects to the resolved IP, not the hostname — TOCTOU-safe
  • Use for Postgres, Redis, MongoDB, Kafka, anything on a port
:5432 :6379 :27017
SSL / TLS certificates
SSL

SSL / TLS certificates

Warns you 7 days before expiry. Validates cert chain, not just "200 OK". SNI-correct even when connecting by IP.

CAPABILITIES
  • Degraded at 7 days to expiry, down after
  • Reads the full peer certificate chain
  • Sets servername (SNI) to the hostname while connecting to the resolved IP
expires in 87d
ICMP ping
PNG

ICMP ping

Classic reachability. Uses execFile (not shell) with a pre-validated IP — no shell-injection surface, no DNS re-lookup by the ping binary itself.

CAPABILITIES
  • execFile, not exec — arguments passed as argv, never through /bin/sh
  • Target is a pre-resolved IP so the validation you saw is the IP we pinged
  • Works cross-platform (Linux, macOS, Windows ping syntaxes)
24ms · 18ms · 22ms
Keyword match
KWD

Keyword match

Does the page still say "Order placed" — or is the 200 just a generic landing page? Catches silent content regressions that status codes miss.

CAPABILITIES
  • Contains / not-contains modes
  • 1MB body cap to avoid OOM on misbehaving endpoints
  • Custom headers supported
match=true
Port probe
PRT

Port probe

Like TCP but when the URL format doesn't include the port. Same SSRF protections, same timeouts.

CAPABILITIES
  • Explicit port override on the monitor
  • SSRF defense identical to TCP check
:22 :3306 :11211
Beyond checks

What you get around the checks.

Status pages

Public, slugged, optionally domain-mapped (`status.yourco.com`). Group monitors into components. Read-only by default — embed the incident feed on your own site if you want.

Incidents

Auto-opened when a monitor crosses its consecutive-failure threshold. Manually resolve, add updates, link to runbooks. Audit-logged end to end.

Maintenance windows

Schedule downtime by monitor or across the whole org. Checks still run; they just don't page. Uptime math respects the window.

Alert routing

Email + webhook today. Deterministic jobId per (incident, channel) — retries can never double-page. Failed jobs sit in a 7-day DLQ for forensics.

Audit log

Every mutation — create/update/delete on any entity — writes an immutable row with actor, org, action, and metadata. Query it via SQL directly, no UI gating.

Multi-tenant isolation

Every row filtered by `organizationId`. Cross-org access is a 404, covered by automated integration tests. Your data is structurally siloed.

All six checks, every plan.

No "pro tier" gating what should be default.