Docs

1. Connect your agent

Grab your MCP link from Connect your AI, add it to Claude Code / Cursor, and say "set up security monitoring."

2. Or send events yourself

POST https://usealertrelay.com/api/ingest
Authorization: Bearer <ingest_token>
{ "type": "failed_login", "level": "warn", "metadata": { "email": "x@y.com" } }

Always returns 202 unless the token is bad. Never blocks or errors into your app.

3. Security event types

- Failed login [instant] — A login attempt failed. First sign of credential stuffing. Send a `failed_login` event on every bad password.
- Password reset requested [instant] — Someone requested a password reset. Send `password_reset` when a reset email goes out — account-takeover attempts start here.
- Login from a new device [instant] — A user signed in from an unrecognized device or location. Send `new_device_login`.
- New admin / privilege granted [instant] — A user was made an admin or given elevated permissions. Send `admin_created` — privilege escalation you want to hear about immediately.
- Any critical event [instant] — Fires on any event you send at level `critical`. Your app-is-on-fire catch-all.
- Failed-login spike (credential stuffing) [threshold] — More than 10 failed logins in 10 minutes = someone is running a password list against you.
- Signup spike (bot registration) [threshold] — More than 10 signups in 10 minutes = bot registration. Send a `signup` event on each new account.
- Error spike (app falling over) [threshold] — More than 10 error/critical events in 5 minutes = something is broken. Send `error`-level events on 5xx / unhandled exceptions.
- Probing / scanning (blocked requests) [threshold] — More than 15 blocked/unauthorized requests in 10 minutes = someone is scanning your app. Send `blocked` (or `unauthorized`) on 401/403 responses.

4. Heartbeat

Turn on the dead-man switch per project; ping the URL from a cron. If pings stop, we alert.