# Example policies, not default Flowlines alerts or official OTel metric names.
# Normalize classified attempts into this custom counter before using the rules.
# Required labels: service_name, environment, tool, outcome (success or error).
# Keep cancellations and unknowns separate. Count attempts before trace sampling.
# Duration uses a classic cumulative histogram in seconds with the same dimensions.
# Add your own owner, runbook and Alertmanager routing before production use.
groups:
  - name: mcp-production-examples
    rules:
      - alert: MCPToolErrorRateHigh
        expr: |
          (
            sum by (service_name, environment, tool) (rate(mcp_tool_calls_total{outcome="error"}[5m]))
            /
            sum by (service_name, environment, tool) (rate(mcp_tool_calls_total{outcome=~"success|error"}[5m]))
          ) > 0.05
          and
          sum by (service_name, environment, tool) (increase(mcp_tool_calls_total{outcome=~"success|error"}[5m])) >= 100
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Sustained MCP tool errors"
      - alert: MCPToolLatencyHigh
        expr: |
          histogram_quantile(
            0.95,
            sum by (service_name, environment, tool, le) (rate(mcp_tool_duration_seconds_bucket[5m]))
          ) > 2
          and
          sum by (service_name, environment, tool) (increase(mcp_tool_duration_seconds_count[5m])) >= 100
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Sustained MCP tool latency"