Probe types

`source_type`	Value reported	Status
`prometheus`	scalar from PromQL query	shipped
`http`	response_time_ms	shipped
`tcp`	connect_time_ms	shipped
`dns`	resolve_time_ms	shipped
`tls_cert`	days_until_expiry	shipped
`icmp`	latency ms / packet loss % / reachability (0\|1)	shipped
`grpc`	health state (1\|0) / Check latency ms	shipped
`websocket`	handshake ms / round-trip ms / connection (0\|1)	shipped
`database`	numeric scalar from a read-only query	shipped
`otlp`	aggregated OTLP data point value	shipped
`cloudwatch`	latest metric value	shipped
`loki`	numeric scalar from a LogQL aggregation	shipped
`elasticsearch`	numeric scalar from an aggregation	shipped
`custom`	numeric scalar from a registered probe function	shipped
`host`	CPU / memory / filesystem / network / load-average percentage	shipped
`mtls_http`	(delegates to `http`)	deprecated

Per-type guides

Each runtime has a dedicated guide:

Notes on specific types

icmp shells out to the system ping. It needs the CAP_NET_RAW capability on the agent host. When the capability or the ping binary is unavailable, the probe reports a privilege/availability reason rather than falling back to TCP.
grpc runs the standard gRPC Health Checking Protocol only. It does not invoke arbitrary methods.
websocket measures the handshake, and optionally an application-level round-trip when configured with a send/expect message pair.
database runs a single read-only query per tick and reports the scalar result. PostgreSQL and MySQL accept SELECT-only statements; Redis accepts a small read-only command allowlist; MongoDB accepts document-count operations. The connection string is read from an environment variable on the agent host and is never sent to the cloud.
mtls_http is deprecated. Use the http source with its mTLS fields instead.

Common contract

Every source's runtime exports the same interface:

interface ProbeSource<TConfig> {
  validateConfig(config: unknown): null | string;
  execute(config: TConfig, env?: AgentEnv): Promise<ProbeResult>;
}

interface ProbeResult {
  value: number | null;
  timestamp: string;
  status_hint?: "no_data";
  reason?: string;
  metadata?: Record<string, unknown>;
}

Sources never throw. Network errors, malformed config, missing fields all resolve to { value: null, status_hint: "no_data", reason: "<code>" }. The dispatcher applies the threshold rule only when status_hint is absent.