incident.io MCP server icon

incident.io

by incident.io

Developer Tools35 tools

Query incidents, alerts, on-call schedules and telemetry from your AI assistant, and declare or update incidents. 35 tools, OAuth or API key, works with any MCP client.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect incident.io via MCP

https://mcp.incident.io/mcp

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

incident.io Tools & Capabilities (35)

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • This connector acts on live production incidents. incident_create, incident_update and escalation_respond are documented as creating an incident, changing its status and severity, and acknowledging or declining a page. An assistant that misreads a request here pages a human or declares an incident that did not happen. Approve tool calls deliberately on this server.
  • ask_incident is not a read despite the name. incident.io documents it as an AI agent for incident investigation and management actions, so grouping it with the other two ask tools as a query interface would be wrong.
  • No safety annotations were readable. Our handshake returned 401, so we could not check readOnlyHint or destructiveHint on any tool. Every read/write label on this page is incident.io's prose, not the protocol's machine-readable annotation — a client that surfaces annotations to decide when to ask permission has nothing from us to go on.
  • The connector inherits one person's permissions. incident.io states an OAuth connection acts as the approving user and sees only what they can. That cuts both ways: approving as an admin gives the assistant admin reach, which is why incident.io suggests a dedicated service account.
  • Permissions are incident.io's, not the connector's. Its API-key documentation describes account-level and team-scoped permissions bundling underlying scopes, and states a key can never do more than a user with the equivalent role, and that you can only grant permissions you already hold. Which tool calls succeed is decided there, not by MCP.
  • OAuth sessions expire after 28 days. incident.io documents re-approval in the browser at that point, so a long-running unattended agent should use an API key instead.
  • Third-party clients need an admin to allow their redirect domain first, capped at five domains per incident.io's documentation. Claude, ChatGPT and Cursor are exempt.
  • Telemetry depends on Investigations being connected. ask_telemetry queries the observability platforms wired into incident.io Investigations; with none connected, there is nothing for it to read.
  • The server published no OAuth scopes. Its protected-resource descriptor, which we read on 2026-08-18, carries authorization_servers and resource and no scopes_supported field — matching incident.io's own instruction to leave the scopes box empty. So the consent screen, not a scope string, is where you see what you are granting. Usefully for client authors, incident.io serves that descriptor at every path a client might try: the nested form under /mcp its own challenge header names, the RFC 9728 form with the well-known segment inserted before the resource path, and the bare host root all returned HTTP 200 with identical bodies on 2026-08-18.
  • incident.io's own tool table omits three names the directory lists. Treat follow_up_update, follow_up_stats and resource_list as unconfirmed until you list tools against a live session.
  • We did not read the tools or call any of them. Our check was an anonymous handshake that returned 401. Everything above about tool behaviour comes from incident.io's documentation or Anthropic's directory listing, each dated below.

Frequently asked questions

Can the incident.io MCP server declare and change real incidents?

Yes. incident.io's documentation lists tools that create an incident, update its status and severity, acknowledge or decline a page, and create follow-ups. Its own example prompts include creating a P2 incident and moving one to resolved. This is a connector that acts on live production incident data, not a read-only reporting view.

How do you authenticate the incident.io MCP server?

Two ways, depending on who is connecting. incident.io documents OAuth for people using an AI assistant, where the client discovers the configuration from the server URL, and API keys for automated pipelines. We confirmed the requirement on 2026-08-18: an anonymous request returned HTTP 401 with a bearer authentication challenge.

What can the incident.io connector see in your account?

Exactly what the authorising user can see. incident.io states an OAuth connection acts as the person who approves it, so it sees and acts on only what that user can. The company recommends approving with a dedicated service account. API keys instead carry the permissions you grant them at creation.

How long does an incident.io MCP connection last?

Twenty-eight days for OAuth. incident.io documents that the connection lasts 28 days, after which you re-approve it in the browser. API keys behave differently: incident.io states they authenticate as a service actor rather than a specific user and do not expire until you delete them, which suits unattended automation.

Why does authorisation fail when connecting a client other than Claude or ChatGPT?

Because its redirect domain is not allowed yet. incident.io documents that built-in clients such as Claude, ChatGPT and Cursor are trusted automatically, while any other client's redirect host must first be added by an admin under Settings, up to five domains. The error names the exact domain to add.

Can the incident.io MCP server query Datadog, Grafana or Splunk?

Yes, through the observability platforms you have already connected to incident.io Investigations. incident.io names Datadog, Grafana, Splunk, Honeycomb, Elasticsearch and GCP Cloud Logging among them, and documents querying logs, metrics, traces and dashboards for ordinary debugging, not only during an active incident.

Do you need the incident.io macOS app to use MCP?

No, and installing it changes which server you use. incident.io states the macOS app ships a local MCP server providing all the same tools plus richer investigation support, with no extra setup. The remote server documented here exists for people connecting from a browser, ChatGPT, or automated agent pipelines instead.

Use in Agentman

Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio

Server Info

Category
Developer Tools
Developer
incident.io
Tools
35
Domain
mcp.incident.io

Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.