# AlertRelay, Instant monitoring & security alerts for vibe-coded apps.

AlertRelay stores discrete EVENTS and fires ALERTS. No log ingestion, no search, you send events, we watch for the ones that matter (failed logins, error spikes, bot signups, probing, silence) and alert you by email, Slack, or webhook. Set it all up by talking to your agent over MCP.

## Connect your agent (MCP)
1. Sign up free at https://usealertrelay.com/signup
2. Copy your personal MCP link from https://usealertrelay.com/connect, it looks like https://usealertrelay.com/mcp/<token>
3. Add it as an MCP server in Claude Code / Cursor.
Then say "set up security monitoring for my app", the agent will create_project → enable_security_pack → add a channel → log a test event → test_alert.

## Ingest API
POST https://usealertrelay.com/api/ingest
Header: Authorization: Bearer <ingest_token>
Body (JSON): { "type": "failed_login", "level": "warn", "message": "...", "metadata": { ... } }
- level: info | warn | error | critical (default info)
- Always returns 202 (accepted) unless the token is invalid (401). It never blocks or errors into your app.

## Standard security event types (what the security pack listens for)
- Failed login [instant] — A login attempt failed. First sign of credential stuffing. Send a `failed_login` event on every bad password.
- Password reset requested [instant] — Someone requested a password reset. Send `password_reset` when a reset email goes out — account-takeover attempts start here.
- Login from a new device [instant] — A user signed in from an unrecognized device or location. Send `new_device_login`.
- New admin / privilege granted [instant] — A user was made an admin or given elevated permissions. Send `admin_created` — privilege escalation you want to hear about immediately.
- Any critical event [instant] — Fires on any event you send at level `critical`. Your app-is-on-fire catch-all.
- Failed-login spike (credential stuffing) [threshold] — More than 10 failed logins in 10 minutes = someone is running a password list against you.
- Signup spike (bot registration) [threshold] — More than 10 signups in 10 minutes = bot registration. Send a `signup` event on each new account.
- Error spike (app falling over) [threshold] — More than 10 error/critical events in 5 minutes = something is broken. Send `error`-level events on 5xx / unhandled exceptions.
- Probing / scanning (blocked requests) [threshold] — More than 15 blocked/unauthorized requests in 10 minutes = someone is scanning your app. Send `blocked` (or `unauthorized`) on 401/403 responses.

## Copy-paste: fetch one-liner
await fetch("https://usealertrelay.com/api/ingest", { method: "POST",
  headers: { "Content-Type": "application/json", "Authorization": "Bearer <ingest_token>" },
  body: JSON.stringify({ type: "failed_login", level: "warn", metadata: { email } }) });

## Copy-paste: Next.js route (app router), call from your login handler
// app/api/_log.ts
export const logEvent = (type: string, extra: object = {}) =>
  fetch("https://usealertrelay.com/api/ingest", { method: "POST",
    headers: { "Content-Type": "application/json", "Authorization": "Bearer " + process.env.ALERTRELAY_TOKEN },
    body: JSON.stringify({ type, ...extra }) }).catch(() => {}); // fire-and-forget, never throws

## Copy-paste: database webhook (Supabase, Neon, any Postgres)
Add a Postgres webhook (or edge function) on your auth / failed_login table that POSTs
{ type, level, metadata } to the ingest URL with the Bearer token. Works the same on Supabase,
Neon, or your own Postgres, anything that can fire an HTTP request. No stack is special.

## Heartbeat (dead-man switch)
Turn it on with set_heartbeat (via MCP) or in the dashboard. We give you a URL; ping it from a cron at least every N minutes. If pings stop, we alert, the one failure an event tool can't otherwise see: total silence.

## Not sure this is for you?
If your site is static or just a contact form, there's nothing to monitor, you want FormRelay (https://useformrelay.com) instead. AlertRelay is for apps with logins, signups, or a backend.