> Every Sentinel doc, as Markdown: https://runsentinel.app/llms.txt

# Monitor a Stacks contract and get alerts

Get an email, Slack message or signed webhook when someone calls a Clarity contract's function, moves value out of it, or changes who controls it. One line per watch, with a 90-day backtest before it's on.

Each watch is one line, the same in the CLI, the MCP server and the SDK. The examples use `example-vault`; swap in your own contract.

## See what you can watch

```sh
$ sentinel show SP….example-vault
```

`show` lists the contract's functions, tokens and printed events, and the `@admin`, `@value` and `@control` groups, all read from its code. It is free and turns nothing on. Over MCP, the `show` tool does the same.

## Alert when a function is called

```sh
$ sentinel when call example-vault set-paused --to email
$ sentinel when call example-vault set-paused --caller SP… --to email
$ sentinel when call example-vault set-paused --not-caller SP… --to email
$ sentinel when call example-vault transfer-funds --arg recipient=SP… --to email
```

`--caller`, `--not-caller` and `--arg` narrow which calls alert. A call watch sees direct calls, not a call nested inside another contract's call.

## Alert when value leaves

```sh
$ sentinel when transfer example-vault sBTC --out --over 20% --to slack:#oncall
$ sentinel when transfer example-vault sBTC --out --over 2 --within 1d --to slack:#oncall
```

The first alerts when one outflow of a token (or `stx`) is 20% or more of what the contract held before it. The second alerts when more than 2 sBTC leaves within a day. A transfer is seen at any call depth, so a move inside another contract's call still alerts. More in [Alert when funds leave a Stacks contract over a limit](/docs/alert-on-large-outflows).

## Alert when control changes

```sh
$ sentinel when call example-vault @admin --new-caller
$ sentinel when call example-vault @admin --role-change
```

`@admin` is every function the code marks as an admin operation. `--new-caller` alerts when an address calls one for the first time; `--role-change` alerts on every call that changes who holds a role. More in [Alert when a contract's admin or owner changes](/docs/alert-on-admin-changes).

## Say it in a sentence

```sh
$ sentinel describe "alert if more than 5 sBTC leaves example-vault"
```

`describe` shows the line it reads the sentence as, what that line would have done in the last 90 days, and its cost. It writes nothing.

## Where alerts go

| Destination | `--to` |
|---|---|
| Email | `email` |
| Slack | `slack:#oncall` |
| Signed webhook | `webhook:ops` |

A webhook body is one envelope, `{ id, type, version, createdAt, test, data }`. Check it with `verifyWebhook` from `@secondlayer/sentinel`. The API lists every alert too. See [Where alerts go](/docs/watches-and-alerts#where-alerts-go) for each, or [Send Stacks contract alerts to Slack or a signed webhook](/docs/stacks-alerts-to-slack-and-webhooks).

## What to expect

| | |
|---|---|
| When | An alert arrives after the block that holds the event, not from the mempool. The measured delay is public: `sentinel status`. |
| Calls | Direct calls only. Transfers are seen at any depth. |
| Cost | Free shows what would have fired (90-day backtest) and sends one real past match as a test. Live mainnet alerts start at Builder, $19 per contract a month ([Pricing](/pricing)). |
| Events | Never billed. |

## Already alerting on function calls?

Each setting maps to a flag on one `when call` line, and your webhook handler reads Sentinel's envelope.

| You have | Sentinel line |
|---|---|
| A function | `when call <contract> <fn>` |
| An argument value | `--arg name=value` |
| A caller | `--caller <addr>` (and `--not-caller <addr>`) |
| Email | `--to email` |
| Webhook | `--to webhook:<label>` |
| Alerts from the mempool, before a block | Not covered |

## Next

Send yourself one real past match: `sentinel test-alert example-vault --yes`. Then the [Quickstart](/docs/quickstart), the [MCP server](/docs/mcp) and [Watches & alerts](/docs/watches-and-alerts).