Guides

A shortlist of official and vendor-maintained MCP servers for code, browsers, docs, project tracking and infrastructure, grouped by job with transport and auth details.

The claude mcp add command for remote and local servers, the three scopes, how OAuth sign-in works from /mcp, and how to confirm the server is connected.

Remote servers as custom connectors, local servers in claude_desktop_config.json, one-click extensions, where the logs are, and how the Code tab shares them.

The .mcp.json file format, environment-variable expansion for secrets, approval and precedence rules, and the fixes for the usual connection failures.

Choose a website monitoring service by how it confirms failures from several locations, how often it checks, how it alerts you and what history it keeps.

API monitoring calls your API on a schedule, checks each response for availability, speed and correct data, and alerts you when a check fails.

SNMP monitoring reads values such as uptime, interface traffic, CPU load and UPS battery state from network devices by OID, on a schedule or via traps.

DKIM signs outgoing mail with a private key; the public key sits in DNS at a selector, so verification survives forwarding.

DMARC is a DNS record that aligns SPF and DKIM results and tells receivers whether to quarantine or reject failing mail.

A DNS cache is a saved copy of a DNS answer kept by your browser, OS, router or resolver, and the TTL sets how long each copy lasts before the next lookup goes out fresh.

A DNS lookup passes through a stub resolver, a recursive resolver and an authoritative server, each playing a different role in finding the answer.

An MX record names a domain's mail servers; its priority number picks which one a sender tries first, lowest number wins.

SPF is a DNS TXT record listing which servers may send mail for a domain, with a 10-lookup limit and a catch-all rule.

A TLS handshake negotiates the version and cipher, verifies the server's certificate and derives a shared key, in one round trip since TLS 1.3.

Mutual TLS adds a client certificate to the handshake, so the server verifies the client too, not just the other way around.

DNS runs on UDP port 53 for ordinary lookups and TCP port 53 for zone transfers and large answers, plus 853 and 443 for the newer encrypted variants.

llms.txt is a proposed file for AI models, not a web standard. Google says it does not use it for Search. Here is what it does and how to check it.

Noindex keeps a page out of search results while still allowing crawling. What the meta tag and X-Robots-Tag header do, when to use them, and how they leak.

A canonical URL names the one real version of a page so duplicates consolidate into it. Self-referencing, cross-domain, and the staging canonical failure.

Synthetic checks run on a schedule from locations you choose; RUM records timings from real visitors. What each catches, what it misses, and when to run both.

A status page shows whether each part of your service works right now, plus the incident record. What to publish, public vs private, and how to write updates.

Without a monitor you hear about an outage from a customer. What takes sites down, what the gap costs, and what to watch beyond a simple up or down check.

Latency, time to first byte and total response time measure nested spans of one request. How each is measured, what is good, and what the gaps tell you.

Uptime is the share of a measured period during which a site answered as expected. What the percentage means, what the nines allow, and how it is measured.

Why a monitoring system reconfirms a failed check from other locations, the three recheck strategies HostTracker supports, and how to choose between them.

Server monitoring checks availability, performance and resource use continuously. What it covers, agent-based versus agentless, and what to alert on.

A DNS blacklist flags IP addresses associated with spam. How a listing happens, often through no fault of yours, and how to check and monitor your status.

The uptime formula in one line, what 99.9% vs 99.99% vs 99.999% costs you in real downtime per year, and how to measure downtime accurately.

Version mismatch, no shared cipher, a bad certificate or an interception proxy can each break a handshake. Here is how to tell which one it is.

A DNS cache holds old answers after a change. Flush it with ipconfig /flushdns on Windows, dscacheutil on macOS, or resolvectl flush-caches on Linux.

"DNS error" covers several unrelated failures. Answer three quick questions to find which one you have and the guide that fixes it.

Chrome's generic headline covers many different errors. Find the real cause from the code underneath it and the matching fix for each one.

Chrome's headline over the whole NET::ERR_CERT_* family. What each specific certificate error code means and how to fix it.

The handshake found no shared TLS version or cipher. Usually a server still offering only TLS 1.0/1.1 or weak ciphers.

The browser followed a redirect chain that never reached a final page. Usually an HTTP-to-HTTPS loop between a proxy and the origin.

The host rejected the TCP connection outright, usually because nothing listens on that port. How to tell why, on your side or the server's, and fix it.

An open connection was cut off by a TCP reset, usually from a firewall or filter, antivirus, or a crashed server process. How to tell which and fix it.

The connection attempt got no answer at all, usually because a firewall drops it, the server is down, or DNS points elsewhere. How to find which.

The connection was accepted but the server sent back zero bytes. Learn the common causes, from crashed workers to protocol mismatches, and how to fix it.

TLS worked, but a frame or stream broke HTTP/2's rules. Causes range from oversized headers to a proxy's HTTP/2 bug.

The browser could not turn the hostname into an IP address. Chrome uses this code for every failed DNS lookup, from a missing record to a dead resolver.

Your device or a router reported no path to the site's IP address. Usually a VPN, private IP, macOS permission or IPv6 fault; sometimes a server firewall.

The origin answered but the response was empty or unreadable, so Cloudflare could not relay it. How to read origin logs and bypass Cloudflare to test directly.

The origin refused Cloudflare's connection outright. Wrong port, blocked firewall ranges, or a TLS mode mismatch - plus how 521 differs from 523.

The TCP handshake to the origin never completed within about 15 seconds. Causes, fixes, and how 522 differs from a slow-response 524.

The certificate is expired or not yet valid, or the visitor's clock is wrong. How to read the dates with openssl and fix both causes.

The TLS handshake failed before any certificate was judged. Causes range from a non-TLS port to QUIC, antivirus scanning and Cloudflare SSL mode.

A staging canonical on live pages is a base URL config that traveled with a release or a database copy. The causes, how to verify the fix, how to prevent it.

The ordered checklist: manual action, noindex, robots.txt, canonical, hacked or blacklisted, server errors, expired domain. Six are visible from outside.

Measure the lookup before you change anything, then fix the resolver, the TTLs or the CNAME chain that is costing you the delay.

What each of the five cron fields means, a table of the schedules people actually use, and the nine mistakes that run a job at the wrong time.

The lookup timed out with no answer at all. Work out whether the resolver, the router or the network is at fault, then fix it per platform.

Chrome got no IP address and its DNS probe concluded the name does not exist. Fixes for Windows, Android, ChromeOS, the router and the domain.

The server got your request and refused it, almost always with a 403. Separate fixes for the blocked visitor and for the site owner.

SLA monitoring means measuring uptime independently so you can prove whether a service met or missed its availability commitment.

Every setting in HostTracker's TCP port check explained: TLS handshake validation, the response pattern field, expected IPs, and the common failures.

A walkthrough of HostTracker's transaction check: building a multi-step browser flow, its timeouts and validation options, and a worked checkout example.

Set up Web Risk monitoring to hear the moment Google flags your URL for malware or phishing, and what to do about a flag once it happens.

Set up HostTracker alerts in Slack via an Incoming Webhook: step-by-step setup, sample alert messages, subscribable events and troubleshooting.

Read a live value straight off a router, switch, UPS or other SNMP device by OID, and see exactly what alerting on it can and cannot do today.

Page Speed monitoring loads your page in a real browser and watches the load: failed resources, CPU and memory use, and whether it beats your timeout.

Every setting in HostTracker's ping check explained: interval, DNS resolution, expected IPs, alert subscriptions, and the ICMP quirks that trip people up.

Set up the Russian BL check to know when a site starts showing the Russian regulator's block-page banner, and how it differs from a spam DNSBL check.

An HTTP check requests a URL from your monitoring locations the way a browser does, then judges the response: status, speed and content.

Content Check loads your page in a real browser and looks for text in the rendered page, catching a 200 response that shows an error or an empty shelf.

Monitor a server's CPU, RAM, disk or connect time using a small endpoint you host yourself, with a threshold and debounce that catches real problems.

Set up a database check that tests connection health or validates a live query result, covering providers, credentials, and the firewall access it needs.

Set up DNSBL monitoring to catch a DNS blacklist listing before it breaks your email deliverability, with every setting explained.

A lapsed domain and an expired SSL certificate look alike but are not. Learn the different causes, symptoms and fixes, and how to monitor both.

Set up Domain expiration monitoring to catch a lapsing registration before it takes your site and email offline, and how it differs from an SSL check.

Set up a Certificate expiration monitor in HostTracker: the fields to fill, alert and report subscriptions, a worked example and common fixes.

See all ten HostTracker alert channels, which events trigger a message, how reports differ from alerts, and how to build a simple escalation chain.

An API check requests an endpoint and parses the response as JSON, XML or plain text so you can assert on a value inside it, not only the status code.

Assertion mode replaces fixed status and keyword checks with rules you write: the complete reference to every subject, operator and shortcut.

Query each record with dig or nslookup, then read the Authentication-Results header of a real message to see what passed.

Search the exact URL, then use the site: operator and Search Console URL Inspection. What discovered and crawled but not indexed actually mean.

Where robots.txt has to live, the syntax in five lines, the mistakes that block a whole site, and how to confirm the file is reachable from every region.

DNS changes are live at once. What you wait for is cached copies of the old record to expire, which the old TTL controls, not the new one.

Query your sending IP and domain against DNS blocklists, find what triggered the listing, fix it, then request delisting from each operator.

Server response time is time to first byte, not page load. Measure it with curl from a known location and compare against the same location later.

Test the port from another network with nc, nmap or a port check tool. Open, closed and filtered mean three different things.

Read the padlock or run openssl s_client against the host. Check the whole chain: an expired intermediate breaks the site like an expired leaf.

Load the site from a network that is not yours. If it works there, the fault is local: DNS cache, ISP, VPN, hosts file or your browser.

Test the page in a real browser from a known location and read three numbers: time to first byte, largest contentful paint and total load time.

Resolve the domain to an IP address, then look up who owns that address. The domain WHOIS gives the registrar and nameservers, not the host.

A WHOIS record gives the registrar, creation and expiry dates, status codes and nameservers. Contact details are redacted on most domains today.

A 401 means the request has no valid credentials. Covers the WWW-Authenticate header, expired tokens, clock skew, wrong header, and 401 versus 403.

A 405 means the resource exists but rejects the HTTP method used. Covers the Allow header, static files, CORS preflight, nginx and framework routes.

A 406 means the server cannot match what the client will accept. Covers content negotiation, the common ModSecurity/WAF cause, and how to fix it.

A 413 means the request body is bigger than a set limit. Covers nginx, Apache, PHP, IIS, Cloudflare and API gateway upload limits.

A 422 means the request parsed fine but a value fails validation. Covers Rails, Laravel and FastAPI, 422 versus 400, and reading the error body.

A 499 means the client disconnected before nginx finished responding. Covers the nginx access log, slow upstreams, and timeout alignment.

A 400 means the server could not parse the request at all. Oversized cookies, bad URLs, header limits, WAF rules and how to tell them apart.

A 403 means the server refuses the request and credentials will not help. Covers permissions, WAF and geo blocks, and allowlisting a monitoring service.

A 404 says the URL has no current content, nothing more. Learn to tell broken links from deliberate removals, and to catch soft 404s that return 200.

A 4xx means the server refused the request as sent. On your own site it is usually a broken route, a stale link or a firewall rule, not the visitor.

A 500 means your application broke and will not say how. Where to find the real error, and how 500 differs from 502, 503 and 504.

A 502 means the proxy in front of your site got an invalid response, or none, from the backend. Read the nginx or Apache log line to find the cause.

A 503 means the server is alive and refusing work on purpose. Learn the overload, maintenance and deploy patterns, and why Retry-After matters.

A 504 means the proxy waited too long for your backend. Covers slow queries, cold starts, timeout tuning and a clear 502 vs 503 vs 504 comparison.

A 5xx means the server accepted the request and then failed. Each code names a different hop: what broke, and how to trace it.

A 429 is a rate limit, not an outage. Learn to read Retry-After, tell throttling from downtime, and stop your own monitoring from tripping the limit.

A 1xx response is interim: the server received the request and a real final response is still coming. It is not a success and not an error.

200 OK means the request succeeded, not that the page is correct. Error pages, maintenance notices and empty shells are all served with a 200.

2xx means the server accepted and completed the request. What 200, 201, 202, 204 and 206 each mean, and why a 200 is not proof of health.

300 offers the client a list of representations to choose from. It is valid HTTP but virtually unused, and most people who search it have a 301 or 302.

301 moves a URL permanently and passes its ranking signals on; 302 is a temporary detour that keeps the original. How to pick, and how to check.

303 tells the client to fetch the result at another URL with GET. It is the code behind Post/Redirect/Get, which stops reloads from resubmitting a form.

304 means your cached copy is still current, so the server sends no body. It only answers conditional requests using ETag or Last-Modified.

A 3xx tells the client the resource lives elsewhere. What 300 to 308 mean, which one to use, and how to find broken redirect chains.