IncidentOps MCP

Incident timelines, triage, and response coordination

IncidentOps MCP combines alerts, logs, deploys, owners, and response notes into timelines, response packets, rollback plans, and guarded provider updates.

Included with an active usage plan

Available through the hosted catalog. Calls count against the shared allowance on the account plan.

Compare usage plans

Why it exists

Combine alerts, deploys, logs, ownership, and response notes into a coherent incident picture.

Generic terminals, provider APIs, and custom prompts can cover parts of the work, but the caller must supply permission limits, output requirements, failure handling, and usage accounting.

Connection and contract

Connect from an MCP-aware client with an account-scoped Monarchic key. The hosted route checks access, runs the named product contract, and records the operation on the account receipt.

The product-specific schema defines the inputs and outputs used by clients and downstream automation.

Current limits

Live connector tools have separate request-scoped credential requirements. Guarded provider writes require an explicit execution flag and confirmation phrase.

This call analyzes request data only. It needs no provider token, filesystem access, ambient AWS access, or write permission.

What you get

Build incident timelines from alerts, logs, and deploy records
Create response packets and recovery checks
Keep external updates guarded and reviewable

Core use case

Combine alerts, deploys, logs, ownership, and response notes into a coherent incident picture.

Outcomes

Build an incident timeline from alerts, deploys, logs, and response notes
Prepare response, rollback, recovery, and communication plans
Keep provider updates explicit and reviewable

Primary workflows

Source ingestion Incident triage Response packet Guarded updates

Concrete workflow / priced call

Turn incident records into a responder handoff

The request, exact tool-call payload, returned output, and usage receipt are shown below.

Request

“Given this alert, log, deploy, and owner data, should we roll back and what should the responder do next?”

Execution

Tool call payload

{
  "tool": "build_incident_response_packet",
  "arguments": {
    "evidence": {
      "schema": "incidentops.evidence.v1",
      "incidentId": "inc-42",
      "title": "5xx spike after deploy",
      "status": "investigating",
      "severity": "sev2",
      "startedAt": "2026-08-01T12:00:00Z",
      "services": [
        "api"
      ],
      "environments": [
        "production"
      ],
      "alerts": [
        {
          "id": "alert-5xx",
          "provider": "custom",
          "service": "api",
          "environment": "production",
          "severity": "sev2",
          "title": "5xx rate above 5%",
          "startedAt": "2026-08-01T12:01:00Z",
          "evidence": [
            "5xx rate exceeded 5% for three data points"
          ]
        }
      ],
      "logs": [
        {
          "id": "log-1",
          "provider": "custom",
          "service": "api",
          "environment": "production",
          "timestamp": "2026-08-01T12:02:00Z",
          "level": "error",
          "message": "upstream timeout"
        }
      ],
      "deploys": [
        {
          "id": "deploy-42",
          "provider": "github",
          "service": "api",
          "environment": "production",
          "repository": "acme/api",
          "commitSha": "abc123",
          "startedAt": "2026-08-01T11:54:00Z",
          "status": "success",
          "rollbackCommand": "gh workflow run rollback-api.yml"
        }
      ],
      "ownership": [
        {
          "service": "api",
          "repository": "acme/api",
          "owner": "@platform",
          "team": "Platform",
          "rollbackHint": "Run the last-known-good deployment workflow."
        }
      ]
    }
  }
}

Reviews the supplied records, ranks the current hypothesis, and assembles rollback, recovery, communication, closure, and follow-up artifacts.

Output

Representative contract excerpt

{
  "schema": "incidentops.response-packet.v1",
  "incidentId": "inc-42",
  "generatedAt": "1970-01-01T00:00:00.000Z",
  "summary": {
    "primaryService": "api",
    "severity": "sev2",
    "owner": "@platform",
    "ownerTeam": "Platform",
    "evidenceCounts": {
      "alerts": 1,
      "logs": 1,
      "deploys": 1,
      "owners": 1
    },
    "currentHypothesis": {
      "category": "recent_deploy",
      "confidence": "high",
      "evidence": [
        "Deploy deploy-42 completed 6m before incident start."
      ]
    },
    "recommendedResponseMode": "rollback",
    "rollbackRecommended": true,
    "rollbackCommand": "gh workflow run rollback-api.yml",
    "readyToClose": false,
    "closureBlockers": [
      "Recovery verification complete",
      "Customer and internal communications are current"
    ],
    "topAction": {
      "rank": 1,
      "action": "rollback",
      "priority": "critical",
      "title": "Rollback api deploy abc123",
      "owner": "@platform",
      "command": "gh workflow run rollback-api.yml",
      "rationale": "A successful deploy completed shortly before incident onset and has an executable rollback command."
    }
  }
}

Usage rating

At runtime

Recorded on the operation receipt

The completed call receives a measured receipt. Allowance quantities remain unpublished until the fully allocated rate card is frozen.