incident-mcp
Provides tools for querying and analyzing metrics from VictoriaMetrics, enabling anomaly detection and incident analysis.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@incident-mcpanalyze anomalies in checkout-service error rate for the last 15 minutes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
incident-mcp
A Python MCP (Model Context Protocol) server that helps with incident detection → analysis. It detects anomalies in metric time series, groups correlations, and presents root cause candidates and recommended actions.
Two backends share a single tool contract:
Server | Backend | Purpose |
| Built-in synthetic data (deterministic) | Development, demo, and regression testing without VM |
| Real VictoriaMetrics HTTP API | Production/real-measurement incident analysis |
Since the two servers' tool signatures are 100% identical, you can develop a workflow with the mock and then switch to the real VM without interruption.
Architecture
incident_mcp/
├── core/ # 백엔드 무관 공통 로직 (순수 함수 → 테스트 용이)
│ ├── models.py # Pydantic: Anomaly, IncidentAnalysis, Series ...
│ ├── datasource.py # Protocol(인터페이스) — VM/Mock이 구현
│ ├── detection.py # 이상탐지: zscore · spike · trend · threshold
│ └── analysis.py # 상관분석 + 근본원인 휴리스틱
├── datasources/
│ ├── mock_ds.py # 재현 가능한 합성 메트릭 + 주입된 인시던트 시나리오
│ └── vm_ds.py # VictoriaMetrics(Prometheus 호환) HTTP 클라이언트
├── servers/
│ ├── mock_server.py # B: mock 데이터소스 주입
│ └── vm_server.py # A: VictoriaMetrics 데이터소스 주입
└── tools.py # 공통 MCP 도구 4종 (두 서버가 공유)4 MCP tools
Tool | Description |
| Available metric catalog |
| Raw time series query (verification/debugging) |
| Run anomaly detection (zscore/spike/trend) |
| One-step detection→analysis (root cause candidates + recommended actions) |
Related MCP server: MCP Server for vmanomaly
Quick Start
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
# 단위 테스트
pytest -q
# mock 서버로 종단(E2E) 데모 — mock 2개 시나리오 + 실제 VM
python examples/e2e_client.pyDocumentation (step-by-step)
Anomaly detection methods (summary)
Method | Pattern caught | Example incident |
| Instantaneous value far from the mean | Momentary spike |
| Rapid rate of change compared to the previous interval | Error rate surge |
| Gradual monotonic increase/decrease | Memory leak (not caught by zscore/spike) |
| Absolute threshold violation | SLA limit exceeded |
💡 Patterns that "leak slowly," like memory leaks, are not detected by instantaneous-value-based (zscore/spike) methods, so we added a separate regression-slope-based
trenddetector. — See step2
License
MIT
This server cannot be deployed
Maintenance
Related MCP Connectors
- mttrlyOAuthcom.mttrly
AI-powered incident management and server monitoring via MCP.
MCP-native AI SRE: ask what's broken in production, get a reviewed GitHub fix PR.
Read-only MCP server for AIStatusDashboard status, incidents, metrics, and fallback recommendations.
Monitor MCP servers, API contracts and AI outputs for schema drift. Alerts on breaking changes.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceA comprehensive, AI-powered performance analysis and monitoring platform for OpenShift/Kubernetes clusters. This project provides Model Context Protocol (MCP) servers for analyzing etcd, network, and OVN-Kubernetes components with deep performance insights, automated root cause analysis, and actionable recommendations.1Apache 2.0
- AlicenseNot gradedqualityAmaintenanceMCP server that integrates with VictoriaMetrics vmanomaly API to enable AI-assisted anomaly detection, model management, and configuration generation.9Apache 2.0
- AlicenseAqualityCmaintenanceExposes an observability REST API as MCP tools, enabling incident investigation through automated correlation of deploys with errors, log and metrics queries.6MIT
- FlicenseAqualityCmaintenanceAI-powered incident management MCP server that enables investigation, root cause analysis, and response actions for production incidents using mocked data for demo purposes.8-