Skip to main content
Glama

Build Incident Runbook

build_incident_runbook
Read-onlyIdempotent

Generate a structured incident-response runbook from a service symptom, severity, environment, and optional signals to guide triage, evidence collection, and response actions.

Instructions

Generate a practical incident-response runbook from a known service symptom, severity, environment and optional signals. Use this to structure response actions and evidence collection; do not use it to fetch or diagnose from live telemetry. It does not execute remediation or make changes to the service.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
serviceYesService or application name affected by the incident.
signalsNoOptional known alerts, metrics, logs or traces that should guide triage.
symptomYesObserved user-facing or operational symptom to build the runbook around.
severityYesIncident severity used to scale response urgency and communications.
environmentYesEnvironment where the symptom is occurring.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
titleYes
contextYes
mitigationYes
rcaEvidenceYes
triageStepsYes
communicationYes
firstFifteenMinutesYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed5 schema fields changedv0.14.0
    • addedInput schema / properties / environment / description
      Added value: +"Environment where the symptom is occurring."
    • addedInput schema / properties / service / description
      Added value: +"Service or application name affected by the incident."
    • addedInput schema / properties / severity / description
      Added value: +"Incident severity used to scale response urgency and communications."
    • addedInput schema / properties / signals / description
      Added value: +"Optional known alerts, metrics, logs or traces that should guide triage."
    • addedInput schema / properties / symptom / description
      Added value: +"Observed user-facing or operational symptom to build the runbook around."
  2. First observedv0.4.0

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, and the description usefully reinforces and extends this by stating it 'does not execute remediation or make changes to the service' and does not pull live telemetry. That clarifies the generation-only nature of the call beyond the raw safety flags, though it says nothing about cost, latency, or output shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, no filler, with the core action front-loaded and the exclusions following immediately. Every clause carries distinct information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a generation tool with a full output schema, 100% parameter coverage, and clear annotations, the description supplies everything needed: what it produces, which inputs matter, and what it explicitly will not do. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with per-field descriptions and two enums, so the schema already carries parameter meaning. The description only echoes the same inputs at a high level and adds no format, constraint, or interaction guidance (e.g. how 'signals' influences triage depth), so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and artifact ('Generate a practical incident-response runbook') and scopes the inputs (service symptom, severity, environment, optional signals). It also rules out adjacent behaviors ('fetch or diagnose from live telemetry', 'execute remediation'), so an agent can tell exactly what class of operation this is even though no sibling generates runbooks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('structure response actions and evidence collection') and when-not ('do not use it to fetch or diagnose from live telemetry'), which is more than most definitions. It does not name an alternative sibling tool, so it stops short of a full 5 under the when/when-not/alternatives rubric.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.