Remote MCP server - incident.io

The incident.io MCP server lets you connect any AI assistant that supports the Model Context Protocol directly to your incident data. Query incidents, analyze alerts, check who’s on call, manage escalations, and run deep operational analysis — all from your existing AI tools.

Already using the incident.io macOS app?If so, you already have full access to everything on this page (and more). The macOS app ships with a local MCP server that provides all the MCP tools described here, plus rich support for investigations and interaction with the native UI. No additional setup is needed. If you’ve installed the macOS app, you’re good to go!The remote MCP server described here is for people who want to connect without installing the macOS app. For example, using Claude.ai in a browser, ChatGPT, or plugging incident.io into automated agent pipelines.Learn more about the macOS app, or download it from Settings → Desktop app in your dashboard.

What you can do

Incident analysis and reporting

Ask questions across your entire incident history without manual data gathering:

“How many P1 incidents did we have this quarter, and which teams were most affected?”
“What’s the trend in overnight responder workload by alert source?”
“Show me the top 10 highest-workload incidents this month”

The incident_stats tool supports 10 grouping dimensions (severity, status, type, mode, alert source, custom fields, roles, time periods) with workload breakdowns showing where responder time is spent — during working hours, late evening, or overnight.

Alert and noise analysis

Understand where alert noise is coming from and which areas generate the most on-call work:

“Which alerts result in actual incidents vs noise?”
“Break down alert volume and workload by team and service”
“What proportion of our pages happen overnight, and what triggers them?”

You can analyze alerts by source, priority, time period, and whether they resulted in incidents. Combined with incident stats grouped by team, service, or any custom field, you can trace the full path from alert noise through to responder cost — and identify the highest-ROI improvements to make.

On-call and escalation management

Check schedules, respond to pages, and analyze paging patterns:

“Who’s on call for the platform team right now?”
“What’s our ack rate by escalation path this month?”
“Acknowledge the page for INC-456”

You can also change who’s on call and hold back paging during planned work:

“Put me on call for the platform schedule tomorrow afternoon”
“Ask if anyone can cover my shift on Friday night”
“Set up a maintenance window for the database migration on Saturday”

Incident management

Create and update incidents, track actions and follow-ups, and access investigation data:

“Create a P2 incident for the payments API degradation”
“Update INC-123 to resolved”
“What are the outstanding follow-ups from last week’s incidents?”
“Add an action on INC-456 to roll back the config change”
“INC-123 and INC-124 are the same problem, can you merge them”

Status page updates

Draft updates to your status pages:

“Draft a status page update for INC-123 saying we’ve identified the cause”
“Draft an update moving the payments incident to monitoring”

status_page_update only drafts. Publishing a status page update emails and texts everyone subscribed to the page, so a person always does that part. Your assistant hands you a draft to review, and you still need to publish it.

Structured operational analysis

Run guided analysis using built-in playbooks that provide step-by-step methodology, your organization’s configuration, and a branded HTML report template:

“Prepare an operational review for the last quarter”
“Analyze alert noise and recommend tuning improvements”
“Assess on-call burden across our teams”

The analysis_start tool downloads a workspace with everything needed: playbooks (operational review, alert noise, on-call burden, team health, response effectiveness), your org config for reference, and a report template. The AI follows the playbook stages: collecting stats, drilling into specifics, identifying themes, and synthesizing recommendations, producing much richer analysis than ad-hoc queries.

Deep investigation

For any specific incident, access AI investigation findings, post-mortem documents, and full status update history:

“Show me INC-123 with the investigation findings and post-mortem”
“What was the root cause of our most recent major incident?”
“Download the full investigation for INC-456 so I can analyze it”

Use incident_show with include: ["investigation", "postmortem"] for a summary of findings inline. For the complete investigation — all findings, checks, conversation history, and evidence — use investigation_sync, which downloads the full investigation filesystem as an archive. You can also drive an investigation, not just read one. investigation_start kicks one off for an incident that nothing is investigating yet, and investigation_steer feeds in what you know so the investigation re-assesses its hypothesis. This can be useful when a responder has found the real cause, or when it’s heading down the wrong path:

“Start an investigation for INC-789”
“Tell the investigation on INC-123 that Redis connections have been exhausted since 14:32, not Postgres”

Both are visible to responders: starting an investigation posts a message into the incident channel and invites you to it, and steering it shows up in the investigation’s history.

For hands-on investigation work on macOS, the macOS app is the best experience. It renders investigation data inline, lets you pin incidents, and post findings directly to incident channels. The investigation_sync tool is designed for automated agents and pipelines that need to pull down investigation data programmatically for LLM analysis — for example, a coding agent that cross-references investigation findings with code changes, or an automation that summarises investigations across multiple incidents.

Team visibility

See which teams own what, and scope analysis to specific teams:

“What escalation paths and alert sources does the platform team own?”
“List all teams and their on-call schedules”

Your own runbooks and documentation

Search the runbooks, guides, post-mortems, and architecture notes you’ve synced into Investigations from sources like GitHub, Notion, and Confluence:

“What’s our runbook for a failing checkout service?”
“What did we conclude in the post-mortem for the January database outage?”
“How do we recover from a failed deploy?”

document_search finds documents by meaning or by specific terms and returns summaries. document_show reads one in full, so your assistant can follow a runbook’s steps rather than paraphrasing a summary of it. For questions about how incident.io itself behaves, such as how escalation paths choose who to page, what a stream is, how to set up an alert route, use help_query, which answers from our product documentation:

“How do escalation paths decide who gets paged?”
“What’s the difference between streams and incidents?”

Telemetry and observability

Query logs, metrics, traces, and dashboards across all the observability platforms you’ve connected to Investigations — including Datadog, Grafana, Splunk, Honeycomb, Elasticsearch, GCP Cloud Logging, and more. This works for any debugging scenario, not just active incidents. Use it to investigate production issues, check service health, run ad-hoc queries, or pull data for reports:

“What are the error rates for the payments service over the last hour?”
“Show me the logs around the time of INC-123”
“Query the CPU and memory dashboards for the worker pods”
“Are there any anomalies in the checkout service latency this week?”
“Pull the Datadog traces for requests over 5 seconds”

The AI agent plans queries across your datasources, handles pagination and time ranges, and synthesizes the results. It can search dashboards by name, query metrics with the right labels, and correlate signals across multiple platforms — saving you from switching between tabs and writing queries manually.

Third-party service status

An upstream outage is often the cheapest explanation to rule in or out, so you can check the vendors we monitor centrally:

“Is AWS having problems in eu-west-1 right now?”
“Did anything change on Datadog’s status page around 14:00 yesterday?”

external_service_list gives you the services we monitor and the exact names to ask for, and external_service_status returns their current state plus any changes in a window, telling you whether the vendor published it themselves or we inferred it from our own monitoring.

Setup

The remote MCP server is available at https://mcp.incident.io/mcp. Install the incident.io plugin to get it configured for you along with our skills, or connect it directly if your setup doesn’t support plugins.

You can enable the remote MCP server from Settings → MCP.

Install the plugin

Claude Code
Cursor
Codex
VS Code
Other agents

Install the plugin by running the following in a session:

/plugin marketplace add incident-io/skills
/plugin install incident-io@incident-io-skills

Third-party marketplaces don’t auto-update by default, so turn auto-update on once you’ve installed. For a team, an administrator can register the marketplace with auto-update already on, in managed settings:

{
  "extraKnownMarketplaces": {
    "incident-io-skills": {
      "source": { "source": "github", "repo": "incident-io/skills" },
      "autoUpdate": true
    }
  }
}

Our plugin is listed in the Cursor marketplace. Install it by running:

/add-plugin incident-io

You can also install it from the Cursor IDE. Use this deeplink, or open Customize in the sidebar, find the incident.io plugin, and select Install, choosing whether to install it for the project or for your user account.

On Business and Enterprise plans, ask an admin to import our marketplace for everyone, from Admin → Plugins → Marketplaces. Nobody has to install anything by hand, and the workspace syncs daily, so prefer this where you have it.To install it yourself instead:

codex plugin marketplace add incident-io/skills
codex plugin add incident-io@incident-io-skills

Run codex plugin list to check it’s installed, and start a new session before the skills load. Plugins work in the Codex CLI and the ChatGPT desktop app. The IDE extension doesn’t support them.

Open the command palette

Run Chat: Install Plugin From Source.

Point it at our repository

Give it https://github.com/incident-io/skills.

Install the plugin

Choose the incident.io plugin from the marketplace.

To roll it out across a team, set the marketplace in the chat.plugins.marketplaces setting instead.

Most agents that support plugins can install ours straight from the repository. Add incident-io/skills as a marketplace, or https://github.com/incident-io/skills where the shorthand isn’t accepted, then install the incident-io plugin from it. In Copilot CLI, for example:

copilot plugin marketplace add incident-io/skills

If your agent doesn’t support plugins, take the skills and the MCP server separately. Zed, Cline, Roo Code, and Amp all read skills:

npx skills add incident-io/skills -a zed -a cline -a roo -a amp -g

For anything else, every skill is plain markdown. Point your tool at a skill’s SKILL.md with whatever mechanism it offers, such as an AGENTS.md pointer, then connect the MCP server on its own as below.

Keeping the plugin up to date

We ship new skills and improve existing ones regularly. How that reaches you depends on your agent.

Claude Code disables auto-update for third-party marketplaces like ours by default, so turn it on: run /plugin, select Marketplaces, choose the incident.io marketplace, and select Enable auto-update. See Claude Code’s configure auto-updates for what that changes. To pull an update by hand instead, run /plugin marketplace update incident-io-skills.
Cursor syncs daily when installed from the official marketplace.
Codex syncs daily when a workspace admin imports our marketplace, and an admin can select Sync now under Admin → Plugins → Marketplaces to expedite it. If you added the marketplace yourself, run codex plugin marketplace upgrade to pull a new version.

Connect the MCP server on its own

If your agent doesn’t support plugins, or you only want the tools without our skills, connect the server directly. There are two ways to authenticate, depending on your use case.

For interactive use (OAuth)

If you’re a human connecting via an AI assistant like Claude, ChatGPT, or Cursor, you’ll authenticate with your incident.io account via OAuth. The MCP client handles the flow — you just approve access in your browser when prompted. Actions are attributed to your user account, and you see the same data you’d see in the dashboard.

Most clients discover the OAuth configuration automatically from the server URL, so you never see these details. Some — like Google’s Gemini Enterprise custom connector — ask you to enter them by hand. If yours does, see Connecting a client that needs OAuth details manually below.

Claude Code
Codex
Cursor
Claude Desktop
ChatGPT

Add the remote MCP server:

claude mcp add incident-io --transport http https://mcp.incident.io/mcp

Claude Code will prompt you to authorize via your browser on first use.

Add the server to your Codex MCP configuration at ~/.codex/config.toml:

[mcp_servers.incident_io]
type = "url"
url = "https://mcp.incident.io/mcp"

Codex will prompt you to authorize on first use.

Open Cursor settings and navigate to MCP Servers. Click Add Server and enter:

Name: incident.io
Type: HTTP
URL: https://mcp.incident.io/mcp

Cursor will prompt you to authorize via your browser.

Add incident.io from Claude’s connector directory.To add it by hand instead:

Open Claude Desktop.
Go to Connectors (or Customize → Connectors).
Click the + next to Connectors.
Choose Add custom connector.
Enter the MCP server URL: https://mcp.incident.io/mcp
Complete the authorization flow with incident.io.
The connector should then appear in Claude’s connected tools.

In ChatGPT, go to Settings → Integrations.
Search for “incident.io” or add a custom MCP server with URL https://mcp.incident.io/mcp.
Authorize access when redirected to incident.io.

Connecting a client that needs OAuth details manually

Our remote MCP server uses the standard MCP OAuth pattern: clients discover the configuration from the server URL and register themselves automatically. Assistants like Claude, ChatGPT, and Cursor use this, which is why you only ever paste the server URL. Some clients — such as Google’s Gemini Enterprise custom MCP connector — instead ask you to fill in the OAuth details yourself. Because our server is a PKCE public client, there’s no client secret to enter, so make sure you enable your client’s PKCE option. Use these values:

Field	Value
MCP server URL	`https://mcp.incident.io/mcp`
Authorization URL	`https://app.incident.io/auth/plugin/authorize`
Token URL	`https://app.incident.io/auth/plugin/token`
Client ID	`incident-mcp`
PKCE	Enable it (this is required)
Client secret	Leave blank
Scopes	Leave empty

You’ll need an admin to allow the client’s redirect domain first. Built-in clients like Claude, ChatGPT, and Cursor are trusted automatically, but any other client’s redirect host must be added under Settings → MCP server → Allowed redirect domains (up to five). For Gemini Enterprise this is vertexaisearch.cloud.google.com. If it’s missing, authorization fails — the exact domain to add is shown in the error, and you can add it from there in one click.

An OAuth connection acts as the person who approves it — so pick the right account, ideally a dedicated service account, since it’ll see and act on only what that user can. The connection lasts 28 days, after which you’ll need to re-approve it in the browser.

For automated systems (API keys)

If you’re connecting programmatic agents, custom workflows, or automation pipelines, use an API key. API keys authenticate as a service actor rather than a specific user, and don’t expire until deleted.

Go to Settings → API keys in your incident.io dashboard.
Create a new API key with the scopes you need.
Pass it as a Bearer token in the Authorization header when connecting your MCP client to https://mcp.incident.io/mcp.

For example, to test connectivity, send the MCP initialize request — every MCP client opens a session with this call, and a successful response confirms that the endpoint is reachable, your API key is valid, and the protocol version is compatible:

curl -X POST https://mcp.incident.io/mcp \
  -H "Authorization: Bearer your-api-key" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2025-11-25",
      "capabilities": {},
      "clientInfo": { "name": "curl", "version": "0.0.1" }
    }
  }'

To list or call tools beyond this connectivity check, use a real MCP client library — calling tools by hand requires completing the rest of the MCP handshake and parsing server-sent events. This is ideal for integrating incident.io into your own agents, n8n workflows, Dust, or custom automation pipelines.

Getting the most out of it

Read the configuration first

Before filtering or grouping, ask the tools for your organization’s configuration — it lists your severity levels, custom fields, roles, and other values you’ll need:

Use the resource_show tool with resource: "organisation", or
Read the config://organisation resource directly (if your client supports MCP resources)

resource_list shows everything else available to read, including the analysis playbooks and your telemetry datasources. Before setting a custom field on an incident, use custom_field_values to find the values that field actually accepts. It also tells you whether the field can be set or is derived automatically.

Use includes for deeper analysis

When investigating an incident, always request the investigation and post-mortem data:

incident_show(id: "INC-123", include: ["investigation", "postmortem"])

Without these, you only get the basic metadata. With them, you get the AI’s analysis of what happened, the team’s written post-mortem, and all the evidence gathered during investigation.

Start with stats, then drill in

For analytical questions, follow the stats → list → show pattern:

incident_stats to get the shape (counts, workload, trends)
incident_list to browse the interesting groups
incident_show to get full details on specific incidents

This is much more efficient than paginating through individual incidents.

Use playbooks for structured analysis

For periodic reviews or deep analysis, use analysis_start rather than querying tools ad-hoc. It downloads a workspace with playbooks that guide the AI through a multi-stage process — scoping, data collection, deep dives, theme identification, and synthesis — producing structured recommendations and an HTML report. This consistently produces better results than asking open-ended analytical questions.

Send feedback

If you hit friction or wish a tool worked differently, use the feedback tool to let us know. Your AI assistant will prompt you about this after completing tasks — approve the feedback to help us prioritise improvements.

Available tools

Some tools only function when you are using the associated product. Where the table names one, the tool still appears in your assistant’s list of tools, but calling it returns an error explaining what your account is missing.

Tool	Description	Requires
`action_create`	Create an action on an incident	Response
`action_delete`	Delete an incident action	Response
`action_list`	List incident actions	Response
`action_update`	Update an existing action	Response
`alert_attach`	Attach an existing alert to an incident	—
`alert_create_incident`	Declare an incident from one or more alerts	—
`alert_detach`	Detach an alert from an incident	—
`alert_list`	Search and browse alerts	—
`alert_resolve`	Resolve one or more firing alerts	—
`alert_show`	Full alert details with linked incidents	—
`alert_source_list`	List configured alert sources	—
`alert_stats`	Alert counts with workload from linked incidents	—
`alert_tag_apply`	Add, remove, or replace tags on up to 50 alerts	—
`alert_tag_list`	List the alert tags available to apply	—
`analysis_start`	Start a structured operational analysis with playbooks and report template	—
`ask`	AI agent for on-call queries, schedule management, and general questions	—
`ask_incident`	AI agent for incident investigation and management actions	—
`ask_telemetry`	AI agent for querying logs, metrics, traces, and dashboards	Investigations
`catalog_entry_list`	Browse entries in a catalog type	—
`catalog_entry_show`	Full catalog entry with all attributes	—
`catalog_type_list`	List catalog types (Service, Team, etc.)	—
`cover_request_create`	Ask for volunteers to cover a shift	On-call
`cover_request_list`	List cover requests and how candidates responded	On-call
`cover_request_manage`	Cancel a cover request, accept an offer, or remind candidates	On-call
`cover_request_respond`	Respond to a cover request you’re a candidate on	On-call
`custom_field_values`	Look up the values a custom field accepts	Response
`document_search`	Search your synced runbooks, guides, and post-mortems	Investigations
`document_show`	Read a synced document’s full content	Investigations
`duration_metrics_stats`	Time to acknowledge, time to resolve, and other duration metrics with percentiles	Response
`escalation_create`	Page a user or an escalation path	On-call
`escalation_list`	Search escalations (pages)	On-call
`escalation_path_list`	List escalation paths	On-call
`escalation_path_show`	Who would be paged at each level	On-call
`escalation_respond`	Acknowledge or decline a page	On-call
`escalation_show`	Full escalation details with transition history	On-call
`escalation_stats`	Paging counts by path, priority, time of day	On-call
`extension_connector_list`	List connectors with their capabilities and connection health	—
`extension_plugin_create`	Load a plugin from a source-control repository	—
`extension_plugin_list`	List plugins with their skills and sync state	—
`extension_plugin_sync`	Re-sync a plugin from its source repository	—
`extension_plugin_update`	Enable, disable, rename, or change which skills agents load	—
`extension_skill_feedback_list`	Current feedback on a plugin’s skills	—
`extension_skill_feedback_update`	Dismiss or reopen a skill feedback issue	—
`extension_skill_usage_list`	List assessed skill loads, with the run behind each one	—
`extension_upload_url`	Get a URL to upload content that isn’t in a readable repository	—
`extension_verify`	Test proposed extension content before landing it	—
`extension_verify_show`	Show a verification’s status and result	—
`external_service_list`	List the third-party services whose status pages we monitor	—
`external_service_status`	Check a monitored vendor’s current status and recent changes	—
`feedback`	Submit feedback about the tools	—
`follow_up_create`	Create a follow-up on an incident	Response
`follow_up_list`	List post-incident follow-ups	Response
`follow_up_stats`	Follow-up counts grouped by owner, status, and more	Response
`follow_up_update`	Update an existing follow-up	Response
`help_query`	Ask how incident.io works, answered from our documentation	—
`incident_create`	Create a new incident	—
`incident_list`	Search and browse incidents with filters, sortable by workload	—
`incident_merge`	Merge incidents that turn out to be the same problem	—
`incident_message`	Post a finding into an incident’s channel	—
`incident_show`	Full incident details with optional investigation, post-mortem, and update history	—
`incident_stats`	Aggregate counts and workload by 10+ dimensions	—
`incident_unmerge`	Reverse a merge, restoring an incident as standalone	—
`incident_update`	Update incident fields (status, severity, roles, custom fields)	—
`incident_update_list`	Full status update history for an incident	—
`investigation_feedback`	Record whether an investigation was helpful	Investigations
`investigation_start`	Start an AI investigation for an incident	Investigations
`investigation_steer`	Redirect a running investigation’s hypothesis	Investigations
`investigation_sync`	Download a full investigation as an archive for LLM analysis	Investigations
`maintenance_window_alerts`	Count the alerts a maintenance window held back	On-call
`maintenance_window_create`	Schedule a window where matching alerts don’t page	On-call
`maintenance_window_delete`	Cancel a maintenance window that hasn’t started	On-call
`maintenance_window_list`	List maintenance windows by status	On-call
`maintenance_window_update`	Change a window’s name, lead, or times, or end one now	On-call
`nexus_health_show`	Health of the AI data sources you’ve connected	—
`resource_list`	List the resources available to read	—
`resource_show`	Read organisation config, analysis playbooks, or telemetry datasources	—
`schedule_list`	List on-call schedules	On-call
`schedule_override_create`	Put someone on call, or clear the schedule, for a period	On-call
`schedule_override_delete`	Remove an override, restoring the underlying rotation	On-call
`schedule_show`	Schedule details with current and upcoming shifts	On-call
`status_page_update`	Draft a status page update for a human to publish	Response
`suggestion_list`	List AI suggestions waiting on a human	—
`team_list`	List teams	—
`team_show`	Team details with owned escalation paths, alert sources, and schedules	—
`telemetry_inspect`	Discover the real labels and metric names on a datasource	Investigations
`time_spent_stats`	Responder hours by person, period, or custom field	Response
`user_list`	Find users by name or email	—

​What you can do

​Incident analysis and reporting

​Alert and noise analysis

​On-call and escalation management

​Incident management

​Status page updates

​Structured operational analysis

​Deep investigation

​Team visibility

​Your own runbooks and documentation

​Telemetry and observability

​Third-party service status

​Setup

​Install the plugin

​Keeping the plugin up to date

​Connect the MCP server on its own

​For interactive use (OAuth)

​Connecting a client that needs OAuth details manually

​For automated systems (API keys)

​Getting the most out of it

​Read the configuration first

​Use includes for deeper analysis

​Start with stats, then drill in

​Use playbooks for structured analysis

​Send feedback

​Available tools

What you can do

Incident analysis and reporting

Alert and noise analysis

On-call and escalation management

Incident management

Status page updates

Structured operational analysis

Deep investigation

Team visibility

Your own runbooks and documentation

Telemetry and observability

Third-party service status

Setup

Install the plugin

Keeping the plugin up to date

Connect the MCP server on its own

For interactive use (OAuth)

Connecting a client that needs OAuth details manually

For automated systems (API keys)

Getting the most out of it

Read the configuration first

Use includes for deeper analysis

Start with stats, then drill in

Use playbooks for structured analysis

Send feedback

Available tools