mcp-internet-outages

An MCP server for monitoring internet outages and government-directed shutdowns worldwide.

Data sources:

• Cloudflare Radar — confirmed outages, BGP routing events, internet quality metrics, and DDoS attack trends
• IODA (Georgia Tech) — independent signal triangulation via BGP, active probing, network telescope, Google traffic, and Mozilla telemetry

Tools

Outage detection

| Tool | Source | Description | | ---------------------- | -------------- | ------------------------------------------------------------ | | get_outages | Cloudflare | Confirmed outages with cause (shutdown, cable cut, etc.) and scope | | get_anomalies | Cloudflare | Traffic anomalies by country — earlier signal, less context | | get_active_shutdowns | Both | Quick global overview combining Cloudflare outages + IODA critical alerts | | get_country_outages | Both | Combined Cloudflare + IODA deep-dive for a specific country | | get_asn_outages | IODA | Outage signals for a specific network/ISP by ASN |

IODA intelligence

| Tool | Description | | ----------------------- | ---------------------------------------------------------------------- | | get_ioda_alerts | Raw alerts across BGP, active probing, and telescope signals | | get_ioda_events | Correlated outage events — higher confidence than alerts, with duration and severity score | | get_ioda_outage_summary | Severity-ranked entities — "who's worst right now" with per-signal breakdowns | | get_ioda_signals | Raw signal timeseries (BGP, probing, Google traffic, darknet, Mozilla) condensed into stats |

BGP routing

| Tool | Source | Description | | ------------------ | ----------- | ----------------------------------------------------------------- | | get_bgp_hijacks | Cloudflare | BGP hijack events with hijacker/victim ASNs, prefixes, confidence | | get_bgp_leaks | Cloudflare | Route leak events with leak path, prefix counts, ongoing status |

Internet health

| Tool | Source | Description | | ---------------------- | ----------- | -------------------------------------------------------------------- | | get_internet_quality | Cloudflare | Speed tests (bandwidth, latency, jitter, packet loss) + IQI per country | | get_attack_trends | Cloudflare | DDoS attack trends — top targets and protocol breakdown (L3/L4 or L7) |

Usage examples

Once installed, just ask questions in natural language. Here are some prompts to try:

Situational awareness

• "Are there any active internet shutdowns right now?"
• "Give me a global overview of internet disruptions in the last 24 hours"
• "Which countries are most affected by outages right now?"

Country deep-dives

• "Show me outages in Iran over the last 30 days"
• "What's happening with internet connectivity in Sudan?"
• "Compare internet quality in Myanmar vs global averages"

Network investigation

• "Is there anything affecting AS15169 (Google)?"
• "What IODA signals do we have for Sudatel (AS15706) today?"
• "Are there any BGP hijacks happening right now?"
• "Show me recent BGP route leaks"

Threat context

• "Which countries are being hit hardest by DDoS attacks this week?"
• "Is Sudan's outage correlated with attack activity?"
• "Show me L7 application-layer attack trends"

Signal analysis

• "Show me the raw IODA signal timeseries for Sudan today"
• "What does the BGP routing picture look like for Iran?"
• "Show me the IODA outage severity rankings for the last 24 hours"

Prerequisites

A Cloudflare API token is required for all Cloudflare Radar tools (outages, BGP, quality, attacks). IODA tools work without any authentication.

Get a free token at dash.cloudflare.com/profile/api-tokens — use the "Cloudflare Radar (read)" template.

Installation

npm (recommended)

npm install -g mcp-internet-outages

Or run directly with npx — no install needed:

CLOUDFLARE_API_TOKEN=your_token_here npx mcp-internet-outages

Note: IODA tools work without a token, but all Cloudflare Radar tools require CLOUDFLARE_API_TOKEN to be set. You can also put it in a .env file in your working directory.

From source

git clone https://github.com/andre347/mcp-internet-outages
cd mcp-internet-outages
npm install
npm run build

Claude Desktop

Add to your claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "internet-outages": {
      "command": "npx",
      "args": ["-y", "mcp-internet-outages"],
      "env": {
        "CLOUDFLARE_API_TOKEN": "your_token_here"
      }
    }
  }
}

Restart Claude Desktop. The 13 tools will appear in the tools menu (plug icon).

Claude Code

claude mcp add internet-outages -e CLOUDFLARE_API_TOKEN=your_token_here -- npx -y mcp-internet-outages

Other MCP clients

Any MCP-compatible client (Cursor, Zed, Continue, etc.) can use the same npx command. Refer to your client's documentation for where to configure MCP servers.

Testing with MCP Inspector

npm run inspect

This opens the MCP Inspector UI in your browser where you can call each tool interactively. Make sure you have a .env file with your token:

CLOUDFLARE_API_TOKEN=your_token_here

Data sources

Cloudflare Radar

Cloudflare observes a significant fraction of global internet traffic. This server uses four areas of their Radar API:

• Outage Centre — confirmed disruptions classified by cause (government shutdown, cable cut, power outage, etc.), type (nationwide, regional, network), and scope
• BGP Analysis — hijack detection (false origin announcements) and route leak detection (improper propagation), with confidence scoring and RPKI validation
• Internet Quality — speed test aggregates (bandwidth, latency, jitter, packet loss) and the Internet Quality Index (IQI) per country
• Attack Trends — DDoS attack activity at L3/4 (network) and L7 (application), with top targeted countries and protocol breakdowns

API docs: developers.cloudflare.com/radar

IODA

Run by the Internet Intelligence Lab at Georgia Tech. This server uses three API endpoints across eight signal sources:

• Outage alerts — raw signal-level alerts from BGP, active probing, and network telescope
• Outage events — correlated outage detections with start time, duration, and severity scoring
• Outage summary — entity rankings by overall outage severity
• Raw signals — timeseries data from BGP (visible /24 prefixes), active probing (reachability, packet loss, latency), Google Transparency Report (web traffic), Merit Network Telescope (darknet), and Mozilla Telemetry

Corroboration across multiple independent signals significantly reduces false positives.

API base: api.ioda.inetintel.cc.gatech.edu/v2

Useful country codes

| Country | Code | | ---------- | ---- | | Iran | IR | | Myanmar | MM | | Sudan | SD | | Ethiopia | ET | | Russia | RU | | Cuba | CU | | Belarus | BY | | Kazakhstan | KZ | | Pakistan | PK | | Nigeria | NG |

Contributing

Pull requests welcome. Areas for contribution:

• Additional data sources (OONI, NetBlocks, Internet Society Pulse)
• Alert/notification support
• Enrichment with news context via web search
• Historical comparison tools (e.g. before/after an event)

Licence

MIT