incident.io
by incident.io
Query incidents, alerts, on-call schedules and telemetry from your AI assistant, and declare or update incidents. 35 tools, OAuth or API key, works with any MCP client.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect incident.io via MCP
https://mcp.incident.io/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
incident.io Tools & Capabilities (35)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- This connector acts on live production incidents.
incident_create,incident_updateandescalation_respondare documented as creating an incident, changing its status and severity, and acknowledging or declining a page. An assistant that misreads a request here pages a human or declares an incident that did not happen. Approve tool calls deliberately on this server. ask_incidentis not a read despite the name. incident.io documents it as an AI agent for incident investigation and management actions, so grouping it with the other twoasktools as a query interface would be wrong.- No safety annotations were readable. Our handshake returned 401, so we could not check
readOnlyHintordestructiveHinton any tool. Every read/write label on this page is incident.io's prose, not the protocol's machine-readable annotation — a client that surfaces annotations to decide when to ask permission has nothing from us to go on. - The connector inherits one person's permissions. incident.io states an OAuth connection acts as the approving user and sees only what they can. That cuts both ways: approving as an admin gives the assistant admin reach, which is why incident.io suggests a dedicated service account.
- Permissions are incident.io's, not the connector's. Its API-key documentation describes account-level and team-scoped permissions bundling underlying scopes, and states a key can never do more than a user with the equivalent role, and that you can only grant permissions you already hold. Which tool calls succeed is decided there, not by MCP.
- OAuth sessions expire after 28 days. incident.io documents re-approval in the browser at that point, so a long-running unattended agent should use an API key instead.
- Third-party clients need an admin to allow their redirect domain first, capped at five domains per incident.io's documentation. Claude, ChatGPT and Cursor are exempt.
- Telemetry depends on Investigations being connected.
ask_telemetryqueries the observability platforms wired into incident.io Investigations; with none connected, there is nothing for it to read. - The server published no OAuth scopes. Its protected-resource descriptor, which we read on 2026-08-18, carries
authorization_serversandresourceand noscopes_supportedfield — matching incident.io's own instruction to leave the scopes box empty. So the consent screen, not a scope string, is where you see what you are granting. Usefully for client authors, incident.io serves that descriptor at every path a client might try: the nested form under/mcpits own challenge header names, the RFC 9728 form with the well-known segment inserted before the resource path, and the bare host root all returned HTTP 200 with identical bodies on 2026-08-18. - incident.io's own tool table omits three names the directory lists. Treat
follow_up_update,follow_up_statsandresource_listas unconfirmed until you list tools against a live session. - We did not read the tools or call any of them. Our check was an anonymous handshake that returned 401. Everything above about tool behaviour comes from incident.io's documentation or Anthropic's directory listing, each dated below.
Frequently asked questions
Can the incident.io MCP server declare and change real incidents?
Yes. incident.io's documentation lists tools that create an incident, update its status and severity, acknowledge or decline a page, and create follow-ups. Its own example prompts include creating a P2 incident and moving one to resolved. This is a connector that acts on live production incident data, not a read-only reporting view.
How do you authenticate the incident.io MCP server?
Two ways, depending on who is connecting. incident.io documents OAuth for people using an AI assistant, where the client discovers the configuration from the server URL, and API keys for automated pipelines. We confirmed the requirement on 2026-08-18: an anonymous request returned HTTP 401 with a bearer authentication challenge.
What can the incident.io connector see in your account?
Exactly what the authorising user can see. incident.io states an OAuth connection acts as the person who approves it, so it sees and acts on only what that user can. The company recommends approving with a dedicated service account. API keys instead carry the permissions you grant them at creation.
How long does an incident.io MCP connection last?
Twenty-eight days for OAuth. incident.io documents that the connection lasts 28 days, after which you re-approve it in the browser. API keys behave differently: incident.io states they authenticate as a service actor rather than a specific user and do not expire until you delete them, which suits unattended automation.
Why does authorisation fail when connecting a client other than Claude or ChatGPT?
Because its redirect domain is not allowed yet. incident.io documents that built-in clients such as Claude, ChatGPT and Cursor are trusted automatically, while any other client's redirect host must first be added by an admin under Settings, up to five domains. The error names the exact domain to add.
Can the incident.io MCP server query Datadog, Grafana or Splunk?
Yes, through the observability platforms you have already connected to incident.io Investigations. incident.io names Datadog, Grafana, Splunk, Honeycomb, Elasticsearch and GCP Cloud Logging among them, and documents querying logs, metrics, traces and dashboards for ordinary debugging, not only during an active incident.
Do you need the incident.io macOS app to use MCP?
No, and installing it changes which server you use. incident.io states the macOS app ships a local MCP server providing all the same tools plus richer investigation support, with no extra setup. The remote server documented here exists for people connecting from a browser, ChatGPT, or automated agent pipelines instead.
Sources
- incident.io remote MCP server documentation (retrieved 2026-08-18 via the
.mdvariant incident.io publishes for AI clients). Itsrobots.txtcarriesContent-Signal: ai-train=yes, search=yes, ai-input=yes— the publisher expressly permits AI synthesis of this content · retrieved 2026-08-18 - incident.io API keys and permissions reference (retrieved 2026-08-18) · retrieved 2026-08-18
- incident.io Investigations overview (retrieved 2026-08-18) · retrieved 2026-08-18
- Anonymous MCP
initializeagainsthttps://mcp.incident.io/mcp— HTTP 401, response bodyno bearer token, withWWW-Authenticate: Bearer resource_metadata=...naming the server's own protected-resource descriptor (2026-08-18) · retrieved 2026-08-18 - incident.io OAuth protected-resource descriptor — — HTTP 200, no
scopes_supportedfield (retrieved 2026-08-18) · retrieved 2026-08-18 - incident.io OAuth authorization-server metadata — — HTTP 200,
S256code challenges, dynamic client registration, token endpoint auth methodnone(retrieved 2026-08-18) · retrieved 2026-08-18 - Anthropic Connectors Directory entry — — the 35 tool names,
partnertier, endpoint and categories above are read from our committed directory snapshot dated 2026-08-16; the directory page itself blocks automated fetches, so we did not retrieve it directly · retrieved 2026-08-16 - incident.io support — · Privacy (the directory's
https://incident.io/privacy307-redirects here; both checked 2026-08-18) · retrieved 2026-08-18
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Developer Tools
- Developer
- incident.io
- Tools
- 35
- Domain
- mcp.incident.io
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.