Which integrations are available for this server?

Provides integration with Datadog to fetch alerts, metrics, logs, and traces as evidence for incident triage. Provides integration with Jira (Cloud) to create tickets as part of incident triage workflow, with safety gates. Provides integration with Opsgenie to retrieve alerts as evidence for incident triage. Provides integration with PagerDuty to retrieve alerts as evidence for incident triage. Provides integration with Prometheus to retrieve alerts and metrics as evidence for incident triage. Provides integration with Slack to send notifications during incident triage.

How do I use Incident Triage MCP?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Incident Triage MCP triage incident INC-123" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Incident Triage MCP

by felixkwasisarpong

Overview Schema Source Related Servers Discussions Admin

Python

Hybrid

Incident Triage MCP

Incident Triage MCP is a Model Context Protocol (MCP) server for incident triage. It provides safe, auditable tools for evidence retrieval, deterministic summaries, ticket workflows, and notifications.

What This Project Is

MCP control plane for incident triage tools.
Compatible with local (stdio) and networked (streamable-http) MCP clients.
Designed for standalone mode, Docker Compose, and Kubernetes.

Related MCP server: mcp-incident-responder

What This Project Is Not

Not a standalone LLM agent platform.
Not a provider credentials vault.
Not a replacement for your evidence pipeline; it consumes normalized evidence bundles.

Architecture Snapshot

MCP server stays thin and policy-focused.
Evidence collection runs in Airflow (optional) and writes EvidenceBundle artifacts.
Agents call MCP tools only.
Contract stability is defined under spec/.

For full details, see docs/ARCHITECTURE.md.

Core Tools

Tool	Purpose	Mutating
`evidence_get_bundle`	Fetch normalized EvidenceBundle for an incident	No
`evidence_wait_for_bundle`	Poll until bundle is available	No
`incident_triage_summary`	Build deterministic triage summary from bundle	No
`jira_draft_ticket`	Build non-mutating ticket draft	No
`jira_create_ticket`	Create ticket with safety gates	Yes

Mutating actions are guarded by RBAC, dry_run, confirm_token, audit logging, and idempotency.

Provider Matrix

Area	Supported providers
Alerts	`mock`, `datadog`, `cloudwatch`, `prometheus`, `pagerduty`, `opsgenie`
Metrics	`mock`, `datadog`, `cloudwatch`, `prometheus`
Logs	`mock`, `datadog`, `cloudwatch`, `elk`, `none`
Traces	`mock`, `datadog`, `cloudwatch`, `xray`, `otel`, `none`
Ticketing (`JIRA_PROVIDER`)	`mock`, `cloud`, `servicenow`
Notify (`NOTIFY_PROVIDER`)	`slack`, `teams`

Quick Start

Local (stdio)

python -m venv .venv
source .venv/bin/activate
pip install -e .

MCP_TRANSPORT=stdio \
WORKFLOW_BACKEND=none \
EVIDENCE_BACKEND=fs \
EVIDENCE_DIR=./evidence \
incident-triage-mcp

Local agent run (single incident)

incident-triage-agent \
  --incident-id INC-123 \
  --service payments-api \
  --artifact-store fs \
  --artifact-dir ./evidence \
  --compact

Docker (streamable-http)

docker run --rm -p 3333:3333 \
  -e MCP_TRANSPORT=streamable-http \
  -e WORKFLOW_BACKEND=none \
  -e EVIDENCE_BACKEND=fs \
  ghcr.io/felixkwasisarpong/incident-triage-mcp:latest

Optional local stack (Airflow + Postgres + MinIO + MCP):

docker compose up --build

Kubernetes: One Agent Job Per Trigger

This is the recommended runtime pattern:

Incoming trigger (webhook/manual) arrives.
Dispatcher (or operator) creates one Kubernetes Job per incident.
Job runs incident-triage-agent once and exits.
Agent calls MCP tools over HTTP.
MCP optionally triggers Airflow DAG (incident_evidence_v1) and consumes bundle from fs/s3.

Deploy MCP server (Helm)

helm upgrade --install incident-triage-mcp ./charts/incident-triage-mcp \
  --namespace incident-triage --create-namespace \
  --set image.repository=ghcr.io/felixkwasisarpong/incident-triage-mcp \
  --set image.tag=0.2.8 \
  --set env.MCP_TRANSPORT=streamable-http \
  --set env.MCP_HTTP_AUTH_MODE=api_key \
  --set secretEnv.MCP_HTTP_API_KEY=change-me

Trigger one incident with a single-run agent Job

kubectl -n incident-triage create job triage-inc-123 \
  --image=ghcr.io/felixkwasisarpong/incident-triage-mcp:0.2.8 \
  -- incident-triage-agent \
  --incident-id INC-123 \
  --service payments-api \
  --mcp-url http://incident-triage-mcp/mcp \
  --mcp-api-key change-me \
  --compact

Ensure single-run behavior

Use deterministic job names per incident (triage-inc-<incident_id>).
Reject duplicates at dispatcher level if job already exists.
Keep ticket creates idempotent with idempotency_key.
Configure Job lifecycle controls (backoffLimit, activeDeadlineSeconds, ttlSecondsAfterFinished).

Configuration Essentials

Variable	Meaning
`MCP_TRANSPORT`	`stdio` or `streamable-http`
`WORKFLOW_BACKEND`	`none` or `airflow`
`EVIDENCE_BACKEND`	`none`, `fs`, `s3`, `airflow`
`EVIDENCE_DIR`	Local bundle directory when using `fs`
`AIRFLOW_BASE_URL`	Required for Airflow trigger/read tools
`MCP_HTTP_AUTH_MODE`	`none`, `api_key`, `jwt_hs256`
`AUDIT_MODE`	`stdout` (recommended in k8s) or `file`
`DEPLOYMENT_PROFILE`	`local`, `staging`, `prod`

Profile templates live in deploy/profiles/:

local.env.example
staging.env.example
prod.env.example

Testing

Run full tests:

pytest -q

Run contract checks only:

pytest -q tests/test_contract_evidence_bundle.py tests/test_contract_mcp_tools.py
python scripts/validate_contrib.py

Releases

Install from PyPI

pip install incident-triage-mcp==X.Y.Z

Pull container image

docker pull ghcr.io/felixkwasisarpong/incident-triage-mcp:X.Y.Z

Supported image tags:

X.Y.Z (exact)
X.Y (minor stream)
latest

For release workflow details, see docs/RELEASING.md.

Project Layout

incident-triage-mcp/
  src/incident_triage_mcp/      # MCP server + tools + adapters
  spec/                         # versioned contracts
  airflow/dags/                 # evidence pipeline
  charts/incident-triage-mcp/   # Helm chart
  k8s/                          # Kubernetes manifests
  contrib/                      # polyglot contribution area
  docs/                         # architecture, release, governance docs

Support And Triage

Discussions: https://github.com/felixkwasisarpong/incident-triage-mcp/discussions
Issues: https://github.com/felixkwasisarpong/incident-triage-mcp/issues
Security reports: SECURITY.md

Documentation Index

Contributing

Read CONTRIBUTING.md before opening a PR.

License

MIT

Available Tools

28 tools

alerts_fetch_activeD

Inputs: services, since_minutes, max_alerts.

evidence_get_bundleD

Inputs: incident_id (required).

evidence_seed_sampleC

Offline helper: writes a deterministic Evidence Bundle v1 JSON to EVIDENCE_DIR.

Inputs: incident_id (required), service (required), window_minutes.

evidence_wait_for_bundleD

Inputs: incident_id (required), timeout_seconds, poll_seconds.

incident_triage_runC

One-call triage orchestration. Airflow trigger is optional and backend-dependent.

Inputs: incident_id (required), service (required), include_ticket, project_key, +4 more.

incident_triage_summaryB

Deterministic (non-LLM) summary of an incident from the Evidence Bundle.

Inputs: incident_id (required).

jira_add_commentA

Add a comment to an existing Jira/ServiceNow ticket. Safe-by-default: dry_run=True returns the comment body without posting.

Inputs: issue_key (required), body_md (required), dry_run, reason, +1 more.

jira_create_ticketB

Safe action:

dry_run=True by default (no mutation)
dry_run=False requires reason + confirm_token + idempotency_key + RBAC allow

Inputs: incident_id (required), project_key, dry_run, reason, +2 more.

jira_draft_ticketD

Inputs: incident_id (required), project_key.

jira_list_issue_typesD

Inputs: project_key.

jira_list_projectsD

Inputs: no named parameters.

jira_transition_issueA

Transition an existing Jira/ServiceNow ticket to a new workflow state. Safe-by-default: dry_run=True returns the intended transition without applying it. Common transition_name values: 'In Progress', 'Resolved', 'Done', 'Closed'.

Inputs: issue_key (required), transition_name (required), dry_run, reason, +1 more.

jira_validate_credentialsD

Inputs: no named parameters.

logs_fetch_recentD

Inputs: service (required), start_iso (required), end_iso (required), limit.

mcp_healthD

Inputs: no named parameters.

mcp_metricsD

Inputs: no named parameters.

mcp_traces_recentD

Inputs: limit.

notify_post_updateC

Provider-agnostic notification entrypoint. Routes to Slack or Teams based on provider/env defaults.

Inputs: incident_id (required), service, summary, ticket, +4 more.

opsgenie_acknowledge_alertA

Acknowledge an OpsGenie alert via the OpsGenie REST API. Safe-by-default: dry_run=True returns the intended action without sending. Requires OPSGENIE_API_KEY env var.

Inputs: alert_id (required), dry_run, reason, confirm_token.

opsgenie_close_alertA

Close an OpsGenie alert via the OpsGenie REST API. Safe-by-default: dry_run=True returns the intended action without sending. Requires OPSGENIE_API_KEY env var.

Inputs: alert_id (required), note, dry_run, reason, +1 more.

pd_acknowledge_alertA

Acknowledge a PagerDuty incident via the PagerDuty REST API. Safe-by-default: dry_run=True returns the intended action without sending. Requires PAGERDUTY_API_TOKEN and PAGERDUTY_FROM_EMAIL env vars.

Inputs: incident_id (required), dry_run, reason, confirm_token.

pd_resolve_alertB

Resolve a PagerDuty incident via the PagerDuty REST API. Safe-by-default: dry_run=True returns the intended action without sending. Requires PAGERDUTY_API_TOKEN and PAGERDUTY_FROM_EMAIL env vars.

Inputs: incident_id (required), dry_run, reason, confirm_token.

pingD

Inputs: message.

runbooks_searchD

Inputs: query (required), limit.

service_health_snapshotD

Inputs: service (required), start_iso (required), end_iso (required).

slack_post_updateB

Post an incident update to Slack via Incoming Webhook. Safe-by-default: dry_run=True returns payload without sending.

Inputs: incident_id (required), service, summary, ticket, +4 more.

teams_post_updateC

Post an incident update to Microsoft Teams via Incoming Webhook. Safe-by-default: dry_run=True returns payload without sending.

Inputs: incident_id (required), service, summary, ticket, +3 more.

traces_fetch_recentD

Inputs: service (required), start_iso (required), end_iso (required), limit.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

C2.2/5.0

Scored 2026-06-12 13:15 across 28 tools

Disambiguation4/5

Most tools target distinct services (Jira, PagerDuty, OpsGenie, Slack, Teams, etc.) and actions. However, notify_post_update abstracts Slack/Teams and may overlap with the specific slack_post_update and teams_post_update, causing potential confusion.

Naming Consistency3/5

Naming is generally noun_verb-based but inconsistent: 'alerts_fetch_active' (noun_verb_adj), 'incident_triage_run' (noun_noun_verb), 'mcp_health' (noun_noun), and 'ping' (single word) break the pattern. Variations in verb placement and mix of nouns reduce consistency.

Tool Count4/5

28 tools is high but reasonable for an incident triage system covering alerts, evidence, Jira, notifications, monitoring integrations, and health checks. Each tool serves a distinct function, though a few could be consolidated (e.g., notify_post_update vs. slack/teams).

Completeness3/5

The tool set covers core incident triage workflows: alert fetching, evidence management, triage orchestration, Jira integration, notifications, and alert acknowledgment. Missing are incident listing/updating and more advanced alert lifecycle operations (e.g., list alerts, create/acknowledge beyond existing).

Maintenance

ActivityInactive

ResponsivenessOutdated data

Resources

Related MCP Connectors

CertScore.ai
ai.certscore
MCP server for CertScore.ai public website risk-signal workflows.
Security Web Scraping Monitoring
1
https://mcp.certscore.ai/mcp
mttrly
com.mttrly
AI-powered incident management and server monitoring via MCP.
Monitoring Observability
3
https://api.mttrly.com/mcp
MANDATE Credential BrokerB
io.github.projetnanocorp
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Security
111
https://mandate.nanocorp.app/mcp
context7docs-mcp
com.clauxel.context7docs
A paid remote MCP for Context7 MCP docs, built to return verdicts, receipts, usage logs, and audit-r
Documentation Access Monitoring
2
https://context7docs.clauxel.com/mcp

Related MCP Servers

lograft
Monitoring Observability
nano-step
A
license
A
quality
C
maintenance
MCP server that transforms raw log query results into structured incident reports (Markdown, JSON, HTML) with correlation to git commits and tickets.
Updated 2 months ago (2026-09-07 06:14 UTC)
5
9 npm
1
MIT
mcp-incident-responder
Monitoring Observability Autonomous Agents
KarthikatLilly
F
license
Not graded
quality
C
maintenance
An AI-native incident response server that exposes diagnostic tools (system status, error logs, ticket creation) via MCP, enabling LLM agents to autonomously assess and respond to incidents.
Updated 5 months ago (2026-06-14 17:34 UTC)
-
incident-copilot
Varshini1612
A
license
Not graded
quality
D
maintenance
MCP server for investigating cloud incidents and managing approvals. Provides read-only tools to list incidents, investigate incidents, and list approvals, keeping remediation behind human approval.
Updated 4 months ago (2026-07-26 23:54 UTC)
MIT
seosiri-ops-comm-mcpofficial
Monitoring Communication Project Management
SEOSiri-Official
A
license
Not graded
quality
C
maintenance
MCP server for enterprise operations, enabling Sentry error triage, Linear issue sync, and Slack incident response with tools for parsing stacktraces, dispatching alerts, and generating postmortems.
Updated a month ago (2026-10-02 03:44 UTC)
MIT

Appeared in Searches

A search for information about crime

Incident Triage MCP

What This Project Is

What This Project Is Not

Architecture Snapshot

Core Tools

Provider Matrix

Quick Start

Local (stdio)

Local agent run (single incident)

Docker (streamable-http)

Kubernetes: One Agent Job Per Trigger

Deploy MCP server (Helm)

Trigger one incident with a single-run agent Job

Ensure single-run behavior

Configuration Essentials

Testing

Releases

Install from PyPI

Pull container image

Project Layout

Support And Triage

Documentation Index

Contributing

License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

lograft

mcp-incident-responder

incident-copilot

seosiri-ops-comm-mcpofficial

Appeared in Searches