Notifications

Spanly's live scans continuously watch your MCP traffic and open an Issue when a check fires: a poisoned tool description, a schema violation, a tool that has never succeeded, an oversized result, and so on. Notification channels push those new Issues to your team the moment they open.

Notification channels

• Email: one or more addresses per channel.
• Slack: paste a Slack incoming-webhook URL.
• Webhook: POST a signed JSON payload to any HTTPS endpoint for routing into PagerDuty, Opsgenie, or your own incident system. The signing secret is generated when you create the channel.
• In-app: surface the Issue in the Spanly dashboard.

Notification channels require the Pro plan or above.

Notifying on new Issues

Each channel opts in to new-Issue notifications independently:

• Notify on new Issues: turn delivery on for the channel.
• Minimum severity: only Issues at or above this severity notify the channel. Severities are info, low, medium, high, and critical.

When a scan sweep opens new Issues in an environment, every channel in that environment's organization with notifications enabled receives a single digest of the Issues that meet its severity threshold. Each Issue notifies once, when it first opens.

Webhook payload

{
  "kind": "issues_opened",
  "environment": { "id": "...", "name": "Production" },
  "issueCount": 2,
  "highestSeverity": "high",
  "issues": [
    {
      "checkKey": "unhelpful_errors",
      "title": "Unhelpful errors",
      "subject": "search_docs",
      "severity": "high"
    }
  ],
  "appUrl": "https://app.spanly.com/environments/.../issues"
}

If the channel has a signing secret, requests carry an X-Spanly-Signature: sha256=<hmac> header over the raw body.

Managing channels

Manage channels from your organization settings, or programmatically through the Spanly MCP server. If you need a channel type that isn't there yet, email support@spanly.com.