> For the complete documentation index, see [llms.txt](https://docs.flowcp.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flowcp.ai/guides/configure-alerts.md).

# Configure alerts

Alerts notify you when one of your app's published MCP servers starts misbehaving — for example, a spike in failed calls or unauthorized (401/403) requests. You choose the condition, the threshold, the time window, and where the notification is delivered: email, Slack, or both.

## Creating an alert

1. Open your app and click **Alerts** in the sidebar.
2. Click **Create alert** and fill in:
   * **Name** — a label so you can tell your rules apart (e.g. "High error rate").
   * **Condition** — what to watch for:
     * **All failures (4xx + 5xx)** — any call that returned an HTTP error.
     * **Unauthorized (401 / 403)** — calls rejected for authentication or permission reasons.
   * **Threshold** — how many matching calls must occur before the alert fires.
   * **Time window** — the rolling window matching calls are counted over (5 minutes up to 24 hours).
   * **Cooldown** — after an alert fires, how long to wait before notifying again, so a single sustained spike doesn't flood your channels.
   * **Recipients** — zero or more comma-separated email addresses to notify.
   * **Slack webhook URL** — optionally post the alert to a Slack channel.
3. Leave **Enabled** on, then click **Create alert**.

You must provide at least one delivery channel — email recipients, a Slack webhook, or both.

## Sending alerts to Slack

To post alerts into a Slack channel, create a Slack [Incoming Webhook](https://api.slack.com/messaging/webhooks) for the channel you want notified, then paste its URL (it starts with `https://hooks.slack.com/services/…`) into the **Slack webhook URL** field. When the alert fires, FlowCP posts a message naming the rule, the app, and the count that crossed the threshold, with a button linking back to this Alerts page.

For your security, the webhook URL is encrypted at rest and never shown again once saved. When editing a rule, the field shows **Connected** — paste a new URL to replace it, or click **Remove** to stop sending to Slack.

## How alerts are evaluated

FlowCP checks your alert rules continuously in the background. For each enabled rule it counts the matching calls across the app's **published** servers within the time window. When the count reaches the threshold, every email recipient is notified, a Slack message is posted (if a webhook is configured), and the rule enters its cooldown. While a rule is in cooldown it will not send another notification, even if the condition is still met.

Only **published** servers are evaluated — draft and disabled servers do not generate alerts.

## Editing and disabling

Click **Edit** on a rule to change its condition, threshold, window, cooldown, recipients, or Slack webhook. Turn off the **Enabled** switch to pause a rule without deleting it. Click the trash icon to remove a rule entirely.

## Tips

* Start with a generous threshold and tighten it once you know your app's normal traffic. The [Execution logs](/reference/execution-logs.md) and [Usage stats](/reference/usage-stats.md) pages help you pick a sensible number.
* Use a short cooldown for noisy, fast-moving incidents and a longer one for conditions you only need to hear about occasionally.