# Metrics & RPC

echoIRCd exposes two machine interfaces for monitoring and control. Both bind privately by default —
keep them on loopback or behind a trusted proxy.

## Prometheus metrics

Enable an OpenMetrics/Prometheus scrape endpoint with a single config key:

```ini
metrics_bind "127.0.0.1:9109";
```

It answers any HTTP `GET` with the text-exposition format — no authentication, so bind it somewhere
private. Counters are bumped inline (lock-free atomics); the gauges are republished by the core each
tick.

| Metric | Type | Meaning |
| --- | --- | --- |
| `echoircd_commands_total` | counter | Commands dispatched |
| `echoircd_messages_total` | counter | PRIVMSG/NOTICE handled |
| `echoircd_connects_total` | counter | Client registrations completed |
| `echoircd_users` | gauge | Users online |
| `echoircd_channels` | gauge | Channels in existence |
| `echoircd_servers` | gauge | Servers known on the network |
| `echoircd_links` | gauge | Direct server links |

## JSON-RPC 2.0

A JSON-RPC 2.0 control interface lets admin tools introspect and drive the daemon. It is **off**
unless both `rpc = yes` and an `rpc_token` are set; it binds `rpc_bind` (default `127.0.0.1:8080`) and
every request must carry the token as HTTP Basic or Bearer auth (checked in constant time).

```ini
rpc = yes;
rpc_token "a-long-random-secret";
rpc_bind "127.0.0.1:8080";
```

Method families:

| Family | Methods |
| --- | --- |
| core | `rpc.methods`, `rpc.info`, `server.info`, `stats.get` |
| user | `user.list` / `get`, `user.kill` / `set_mode` / `set_vhost` / `set_nick` / `set_oper` |
| channel | `channel.list` / `get`, `channel.kick` / `set_topic` / `set_mode` |
| server | `server.list` / `rehash` / `connect` / `disconnect` |
| ban | `xline.list` / `add` / `del` (K/G/Z/E/SHUN/Q/CBAN) |
| message | `message.send_notice` (channel / user / all) |
| spamfilter | `spamfilter.list` / `add` / `del` |
| stats | `module.list`, `oper.list`, `security_group.list` |
| whowas | `whowas.get` |
| log | `log.tail`, `log.events` |