kOlapsis/maintenant v1.9.0

AI agents on alerts & updates per host

on GitHub

maintenant now hands fired alerts to an AI agent. An alert carries the host it belongs to and a link back to the interface, the webhook pushes it, and the agent investigates through the built-in MCP server. Image updates are also tracked per host, and four fixes cover endpoint checks after a restart, certificate detection behind an SSO redirect, Docker events missed during startup, and the demo mode.

AI agents

• Every alert now records the host it belongs to. The generic webhook payload carries alert.agent_id and alert.url, a link to the alert in the interface. The link is built from MAINTENANT_BASE_URL and left out when that address has no reachable host, so set it to your public URL.
• /alerts/history?alert=<id> opens the history on that alert, highlighted, even when it sits outside the loaded page. Acknowledgements and live updates apply to it like any other row.
• examples/agent-webhook/ is a dependency-free Python receiver that starts one headless Claude Code session per fired alert, limited to read-only MCP tools over docker exec … --mcp-stdio, with no built-in tools and no user settings.
• The webhook payload is documented field by field, with fired and resolved examples, and a new AI Agents guide walks through the setup.

Updates per host

• Image updates used to be keyed by container name, image and tag: the same container on several hosts shared one entry, attached to whichever host was scanned last. Each host now has its own entry, and the Updates page and the detail panel show the host when at least one remote agent is active.
• Update alerts name the host for remote agents: "Update available for valkey on : 8.1.3". Single-host installs see no change.
• GET /api/v1/updates, the container detail, the dry-run, /api/v1/risk and the MCP tools get_updates and list_risk_scores carry the agent fields.
• End-of-scan cleanup only touches the hosts covered by the scan: a host that did not report keeps its entries and alerts without holding back the others.

Fixes

• Endpoints created from the interface or the API are checked again after a server restart. They were only handed to the check engine when created or updated, so after an image update, a host reboot or an HA failover their last status froze on screen and no alert could fire.
• A server-probed endpoint that has not been checked for more than three intervals shows "Not checked recently" instead of its last status. Display only, no alert.
• An HTTPS endpoint behind an SSO proxy (Authentik, Authelia…) answers with a redirect to the login host. Certificate auto-detection now keeps the certificate of the monitored host, not the login host's. False hostname_mismatch alerts clear on the next check.
• Docker events fired between the startup snapshot and the event subscription are replayed. A container that Docker started while the server was connecting no longer stays created and reported down.
• The dashboard incident summary says "certificate issues" instead of "certificates expired" for hostname mismatches and other non-expiry alerts.
• In demo mode the Outbound heartbeats page is shown read-only, like every other feature, instead of being hidden. No ping is sent.

Upgrading

Migrations 40 and 41 run at startup on SQLite and PostgreSQL. Existing update entries are attached to the host that reported their container; the first scan after the upgrade fills in the other hosts.

The Helm chart moves to 1.3.1 (application version 1.9.0).

The full documentation is at docs.maintenant.dev.