docs(monitors): heartbeat monitors and metric alerts guides; mask ping tokens in bundled nginx log

docs/vantage/mcp.md

@@ -100,7 +100,7 @@ surface is a presentation layer over existing authority, not a new one.
 | `get_server` | Get one server's OS, online state and tags. | `mcp:read`, `servers:read` |
 | `list_monitors` | List monitors and their current state. | `mcp:read`, `monitors:read` |
 | `get_monitor_status` | Get one monitor's up/down/pending state, last check and last error. | `mcp:read`, `monitors:read` |
-| `list_incidents` | List monitor incidents (outages), most recent first. | `mcp:read`, `monitors:read` |
+| `list_incidents` | List monitor incidents (outages), most recent first. A tag-restricted token only sees metric alert incidents for servers inside its tags. | `mcp:read`, `monitors:read` |
 | `get_monitor_samples` | Get one monitor's recent raw check results. | `mcp:read`, `monitors:read` |
 | `list_workflows` | List workflows with step count, target count and whether each is scheduled. | `mcp:read`, `workflows:read` |
 | `get_workflow` | Get one workflow's ordered steps, targets and schedule. | `mcp:read`, `workflows:read` |
@@ -119,7 +119,7 @@ surface is a presentation layer over existing authority, not a new one.
 | `assign_key` | Assign an SSH key to real servers. | `mcp:write`, `keys:write` |
 | `create_step` | Create a reusable workflow step. | `mcp:write`, `workflows:write` |
 | `create_workflow` | Create a workflow from existing step IDs. | `mcp:write`, `workflows:write` |
-| `create_monitor` | Create a monitor, saved disabled. | `mcp:write`, `monitors:write` |
+| `create_monitor` | Create a monitor, saved disabled. Supports every type, including `heartbeat` (the ping token is returned once) and `metric`. | `mcp:write`, `monitors:write` |
 
 A known limitation worth calling out on `search_fleet`: its `version_below`
 argument is not implemented. Passing it gets you an error explaining that