RELATED 01
PostHog MCP Server
OFFICIAL SERVERPostHog's hosted MCP endpoint for analytics queries, feature flags, experiments, errors and more
41kGitHub stars
40popularity score
incident.io Remote MCP Server
incident.io's hosted MCP endpoint for incidents, alerts, on-call schedules and incident analytics
Official · incident.io Remote (hosted) · Streamable HTTP DevOps and monitoring
Connect your client
Remote (hosted)
Add in one click
Opens the app, which asks before it adds the server.
Or add it by command or config
Claude Codeterminal
claude mcp add incident-io --transport http https://mcp.incident.io/mcpCodex~/.codex/config.toml
[mcp_servers.incident_io]
type = "url"
url = "https://mcp.incident.io/mcp"CursorCursor settings → MCP Servers → Add Server (Type: HTTP)
{
"mcpServers": {
"incident-io-remote": {
"url": "https://mcp.incident.io/mcp"
}
}
}Claude (desktop and web)Connectors → Add custom connector
https://mcp.incident.io/mcpChatGPTSettings → Integrations
https://mcp.incident.io/mcpWhat it does
This is incident.io's own hosted MCP server at https://mcp.incident.io/mcp. It connects an assistant to an incident.io workspace so it can query and manage incidents, alerts, pages, on-call schedules, follow-ups and actions, and pull aggregate statistics such as incident counts, responder workload, time to acknowledge and time to resolve. Nothing runs on your machine; you point a client at the URL.
The tool set is large: the docs' tool table lists 91 tools. Beyond reading data, many change it: creating, updating and merging incidents, paging people, acknowledging pages, overriding schedules, scheduling maintenance windows, pausing notifications and posting into incident channels. Some tools hand a question to incident.io's own agents (ask, ask_incident, ask_telemetry), and with the Investigations product it can query connected observability tools such as Datadog or Grafana, search synced runbooks, and start or steer automated investigations. Status page updates are drafts only; a person publishes them.
Two sign-in routes exist. Interactive clients use OAuth and act as the approving user, seeing what that user sees; an OAuth connection lasts 28 days before it must be approved again. Automation can pass an incident.io API key as a Bearer token, which acts as a service actor and does not expire until deleted. The endpoint's protected-resource metadata names https://mcp.incident.io/mcp itself as the authorization server for the resource https://mcp.incident.io. incident.io also offers a plugin bundling this server with its skills, and its macOS app ships a local MCP server with the same tools.
What it needs
An incident.io account on the Team, Pro or Enterprise plan (not the free Basic plan), and the remote MCP server enabled under Settings → MCP. An MCP client that supports remote HTTP servers with OAuth, or an API key from Settings → API keys with the scopes you need. Clients other than the built-in trusted ones (Claude, ChatGPT, Cursor) need an admin to add their redirect domain under Settings → MCP server → Allowed redirect domains, and must have PKCE enabled.
Limits
Hosted only; there is no package to run yourself. Tools tied to a product (Response, On-call, Investigations) still appear in the list but return an error when the account lacks that product. status_page_update only drafts; publishing stays in the dashboard. OAuth connections expire after 28 days. At most five extra redirect domains can be allowed for custom OAuth clients. alert_tag_apply works on up to 50 alerts per call. The docs advise against calling tools by hand with curl beyond the initialize check.
Who it suits
Suits teams already paying for incident.io who want an assistant to answer questions about incident history, alert noise and on-call load, or to act during an incident (page, acknowledge, update, override a schedule). Because it writes and can page people, use a dedicated service account or a scoped API key for automation. On a Mac with the incident.io app installed, its local MCP server already gives the same tools. Not for free-plan workspaces or other incident tools.
Tools 60 of 91
incident_create- Open a new incident
incident_list- Search incidents with filters; can sort by responder workload
incident_show- Get one incident in full, optionally with investigation, post-mortem and update history
incident_update- Change an incident's status, severity, roles or custom fields
incident_merge- Combine incidents that are the same problem
incident_unmerge- Undo a merge so an incident stands alone again
incident_message- Post a finding into the incident's channel
incident_stats- Counts and workload grouped by severity, status, type, team and other dimensions
incident_update_list- Full history of status updates on an incident
status_page_update- Draft a status page update; a person must publish it
action_create- Add an action to an incident
action_list- List the actions on incidents
action_update- Edit an existing incident action
action_delete- Remove an incident action
follow_up_create- Add a follow-up to an incident
follow_up_list- List post-incident follow-ups
follow_up_update- Edit an existing follow-up
follow_up_stats- Follow-up counts by owner, status and more
alert_list- Search and browse alerts
alert_show- One alert in detail, with the incidents linked to it
alert_stats- Alert counts with workload taken from linked incidents
alert_create_incident- Declare an incident from one or more alerts
alert_attach- Link an existing alert to an incident
alert_detach- Unlink an alert from an incident
alert_resolve- Resolve firing alerts
alert_tag_apply- Add, remove or replace tags on up to 50 alerts at once
alert_source_list- List the configured alert sources
escalation_create- Page a user or an escalation path
escalation_respond- Acknowledge or decline a page
escalation_list- Search pages
escalation_show- One page in detail with its transition history
escalation_stats- Paging counts by path, priority and time of day
escalation_path_list- List escalation paths
escalation_path_show- Show who would be paged at each level of a path
schedule_list- List on-call schedules
schedule_show- A schedule with its current and coming shifts
schedule_override_create- Put someone on call, or clear the schedule, for a time span
schedule_override_delete- Remove an override and restore the normal rotation
cover_request_create- Ask colleagues to volunteer to cover a shift
maintenance_window_create- Schedule a window in which matching alerts do not page
maintenance_window_delete- Cancel a maintenance window that has not begun
notification_pause_create- Pause a person's notifications so escalations skip them
duration_metrics_stats- Time to acknowledge, time to resolve and similar metrics with percentiles
time_spent_stats- Responder hours by person, period or custom field
investigation_start- Begin an automated investigation for an incident
investigation_steer- Give a running investigation new information to re-check its hypothesis
investigation_sync- Download a whole investigation as an archive
ask_telemetry- Hand a logs, metrics, traces or dashboard question to incident.io's agent
ask_incident- Hand an incident investigation or management request to incident.io's agent
ask- Hand an on-call, schedule or general question to incident.io's agent
document_search- Search runbooks, guides and post-mortems synced into Investigations
document_show- Read a synced document in full
analysis_start- Download a workspace of analysis playbooks, org config and a report template
catalog_entry_list- Browse the entries of a catalog type
team_show- A team with the escalation paths, alert sources and schedules it owns
user_list- Find users by name or email
custom_field_values- Look up which values a custom field accepts
resource_show- Read the organisation config, playbooks or telemetry datasources
external_service_status- Current status and recent changes for a monitored vendor
help_query- Ask how incident.io works, answered from its product docs