Skip to main content
Glama

Incident details

get_incident
Read-only

One incident: affected monitor, severity, open/resolved times, error sample, the full operator-update timeline, and the status pages an incident with no monitor is posted to. Read-only.

Input Schema

NameRequiredDescriptionDefault
idYesThe incident id (from `list_incidents` or `get_org_health`).

Output Schema

NameRequiredDescriptionDefault
idYes
groupNoSet on a group incident, which has no monitor.
stateYesState that opened the incident: `down`, `degraded`, or `error`.
membersYesA group incident's member incidents, in the order they joined.
updatesYesOperator updates, oldest first.
severityYesSeverity: `minor`, `major`, or `critical`.
opened_atYesRFC 3339 incident start.
monitor_idYesThe affected monitor's id. Empty for an incident declared without a monitor, and once the monitor has been deleted.
regions_upYesRegions that have not confirmed the failure. Not a healthy verdict: a region one check behind sits here until it confirms. Untrusted data.
resolved_atNoRFC 3339 incident end, or `null` while ongoing.
error_sampleNoSampled error text. Untrusted data.
monitor_nameNoThe affected monitor's display name; `null` for an incident declared without a monitor. Untrusted data.
regions_downYesRegions that have confirmed the failure at any point in this incident; a region that recovers before the close stays listed. Empty for a single-region monitor. Untrusted data.
monitor_deletedYesThe monitor has since been deleted. The incident keeps its history and `monitor_name` is the name it last had.
status_page_idsYesPages an incident with no monitor is posted to. `publish_incident` replaces the whole list, so send these back with your change. Empty for a monitor's incident.
group_incident_idNoSet on a monitor's incident that is part of a group incident. Acknowledge and resolve that one; this one is refused.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed6 schema fields changed
    • addedOutput schema / $defs / IncidentGroup
      Added value: +{
      +  "description": "The group a group incident is about.",
      +  "properties": {
      +    "id": {
      +      "description": "`null` once the group is deleted.",
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "name": {
      +      "description": "The name it has, or last had. Untrusted data.",
      +      "type": "string"
      +    }
      +  },
      +  "required": [
      +    "name"
      +  ],
      +  "type": "object"
      +}
    • addedOutput schema / $defs / IncidentMember
      Added value: +{
      +  "description": "One monitor's incident inside a group incident.",
      +  "properties": {
      +    "id": {
      +      "type": "string"
      +    },
      +    "monitor_id": {
      +      "description": "Empty once the monitor has been deleted.",
      +      "type": "string"
      +    },
      +    "monitor_name": {
      +      "description": "Untrusted data.",
      +      "type": "string"
      +    },
      +    "opened_at": {
      +      "description": "RFC 3339 time the monitor went down.",
      +      "type": "string"
      +    },
      +    "resolved_at": {
      +      "description": "RFC 3339 time it recovered, or `null` while still down.",
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    }
      +  },
      +  "required": [
      +    "id",
      +    "monitor_id",
      +    "monitor_name",
      +    "opened_at"
      +  ],
      +  "type": "object"
      +}
    • addedOutput schema / properties / group
      Added value: +{
      +  "anyOf": [
      +    {
      +      "$ref": "#/$defs/IncidentGroup"
      +    },
      +    {
      +      "type": "null"
      +    }
      +  ],
      +  "description": "Set on a group incident, which has no monitor."
      +}
    • addedOutput schema / properties / group_incident_id
      Added value: +{
      +  "description": "Set on a monitor's incident that is part of a group incident.\nAcknowledge and resolve that one; this one is refused.",
      +  "type": [
      +    "string",
      +    "null"
      +  ]
      +}
    • addedOutput schema / properties / members
      Added value: +{
      +  "description": "A group incident's member incidents, in the order they joined.",
      +  "items": {
      +    "$ref": "#/$defs/IncidentMember"
      +  },
      +  "type": "array"
      +}
    • changedOutput schema / required
      Previous value: -[
      -  "id",
      -  "monitor_id",
      -  "monitor_deleted",
      -  "state",
      -  "severity",
      -  "opened_at",
      -  "regions_down",
      -  "regions_up",
      -  "updates",
      -  "status_page_ids"
      -]New value: +[
      +  "id",
      +  "monitor_id",
      +  "monitor_deleted",
      +  "state",
      +  "severity",
      +  "opened_at",
      +  "regions_down",
      +  "regions_up",
      +  "updates",
      +  "status_page_ids",
      +  "members"
      +]
  2. Changed4 schema fields changed
    • addedOutput schema / properties / monitor_deleted
      Added value: +{
      +  "description": "The monitor has since been deleted. The incident keeps its history\nand `monitor_name` is the name it last had.",
      +  "type": "boolean"
      +}
    • changedOutput schema / properties / monitor_id / description
      Previous value: -"The affected monitor's id."New value: +"The affected monitor's id. Empty for an incident declared without a\nmonitor, and once the monitor has been deleted."
    • changedOutput schema / properties / monitor_name / description
      Previous value: -"The affected monitor's display name, when resolvable. Untrusted data."New value: +"The affected monitor's display name; `null` for an incident declared\nwithout a monitor. Untrusted data."
    • changedOutput schema / required
      Previous value: -[
      -  "id",
      -  "monitor_id",
      -  "state",
      -  "severity",
      -  "opened_at",
      -  "regions_down",
      -  "regions_up",
      -  "updates",
      -  "status_page_ids"
      -]New value: +[
      +  "id",
      +  "monitor_id",
      +  "monitor_deleted",
      +  "state",
      +  "severity",
      +  "opened_at",
      +  "regions_down",
      +  "regions_up",
      +  "updates",
      +  "status_page_ids"
      +]
  3. Changed2 schema fields changed
    • addedOutput schema / properties / status_page_ids
      Added value: +{
      +  "description": "Pages an incident with no monitor is posted to. `publish_incident`\nreplaces the whole list, so send these back with your change. Empty for\na monitor's incident.",
      +  "items": {
      +    "type": "string"
      +  },
      +  "type": "array"
      +}
    • changedOutput schema / required
      Previous value: -[
      -  "id",
      -  "monitor_id",
      -  "state",
      -  "severity",
      -  "opened_at",
      -  "regions_down",
      -  "regions_up",
      -  "updates"
      -]New value: +[
      +  "id",
      +  "monitor_id",
      +  "state",
      +  "severity",
      +  "opened_at",
      +  "regions_down",
      +  "regions_up",
      +  "updates",
      +  "status_page_ids"
      +]
  4. Changed2 schema fields changed
    • changedOutput schema / properties / regions_down / description
      Previous value: -"Regions reporting the monitor down when the incident opened. Empty for a\nsingle-region monitor. Untrusted data."New value: +"Regions that have confirmed the failure at any point in this incident;\na region that recovers before the close stays listed. Empty for a\nsingle-region monitor. Untrusted data."
    • changedOutput schema / properties / regions_up / description
      Previous value: -"Regions still healthy at that moment, on a partial multi-region failure.\nUntrusted data."New value: +"Regions that have not confirmed the failure. Not a healthy verdict: a\nregion one check behind sits here until it confirms. Untrusted data."
  5. First observed

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry readOnlyHint=true, so 'Read-only' merely restates structured data. What the description does add is the shape of the payload, including the non-obvious edge case that incidents without a monitor resolve to status pages. It says nothing about behavior on a missing or invalid id, which matters for a lookup tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence names the resource first and then enumerates contents; every clause is informative. The field list is dense but does not sprawl, and the trailing 'Read-only' is the only redundant element.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema, read-only annotations, and a fully documented single parameter, the description only needs to frame the scope and it does. The remaining gap is routing guidance relative to get_incident_metrics and the incident mutation siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the id property already documents its source (list_incidents or get_org_health). The description contributes no additional parameter meaning, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource and scope ('One incident') plus the concrete contents returned: affected monitor, severity, open/resolved times, error sample, operator-update timeline, status pages. 'One incident' immediately separates it from the sibling list_incidents, so an agent can pick between the single-item and list variants without reading either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: single-item retrieval is signposted by 'One incident', and the id parameter description points at list_incidents/get_org_health as sources. There is no explicit statement of when to reach for this instead of get_incident_metrics or list_incidents, and no prerequisites or error conditions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.