incident.io MCP server: 32 tools, three are agents

An incident connector that answers with statistics rather than records. Three of its tools are incident.io's own AI agents. One downloads a whole investigation as an archive.

Last verified 27 August 2026 · from incident.io's own remote MCP documentation and the archived repository's GitHub record

This page is one of 90 in a directory of monitoring and developer tools. Each page checks what an AI coding agent can get out of the tool through its MCP server, the connector that lets the agent query the tool directly.

What is the incident.io MCP server?

It is incident.io's server for the Model Context Protocol. Incident.io runs incident response, so a connected agent reaches incidents, the alerts behind them and the people who were paged.

The documentation leads with statistics rather than with records. incident_stats aggregates by more than ten dimensions. It also reports workload, meaning how much responder time fell in working hours, in the late evening or overnight.

investigation_sync goes the other way and downloads a complete investigation as an archive: every finding, check, conversation and piece of evidence, meant for the agent to read in full.

incident.io has two live MCP servers and one archived one:

The macOS application needs no separate configuration; the remote endpoint exists for clients that cannot run the macOS application, such as a browser or an automated pipeline.

It sits in production observability, reaches telemetry only through an agent that queries other systems, and reaches nothing in code review, CI or cost.

For an agent, incident.io answers who was paged, how often and at what hour. It answers patterns across many incidents better than the detail of one incident. It cannot show the telemetry itself except through ask_telemetry, which queries systems you have connected to incident.io.

What can an AI agent do with incident.io?

The documentation's own advice is to read the configuration first with resource_show, then start with statistics and drill in, rather than listing records and counting them in the model.

What connecting costs before the first question

A context window is the amount of text a model can hold at once. Thirty-two tools cost 1,875 to 2,122 tokens on Claude at connection. Three of them are AI agents rather than data reads, and they carry their own descriptions like any other tool.

Statistics tools come before record tools in the documented list, which is the order incident.io recommends working in.

Encodings: GPT-5.6, GPT-5.5 o200k_base; GPT-4, GPT-3.5 cl100k_base; Claude Haiku 4.5 to Opus 5 count_tokens. Counted from the 32 tool entries in the vendor's own documentation. That documentation is the only public inventory.

The server could not be run for a live tools/list. No input schemas are available, so these figures cover each tool's name and description only. They are a floor, not the figure.

The Claude columns are measured through the API's count_tokens endpoint with an empty schema per tool. So they cover the same content as the GPT columns. The range there is two tokenizer generations. Haiku 4.5 and Opus 4.6 are at the low end. Opus 5 and Sonnet 5 are at the high end. The gap between them is about a tenth.

incident.io MCP server limits: where answers come back incomplete

incident.io mixes tools that return records with tools that generate answers; the limits below follow from that split.

How to configure incident.io MCP for agents

1. 1

   Check whether you already have it

   The macOS application ships a local server carrying the same tools, so a team using it needs no extra setup.

2. 2

   Enable it in Settings first

   The remote server is switched on from the MCP page in incident.io settings before any client can connect.

3. 3

   Choose OAuth or an API key deliberately

   OAuth suits interactive clients; API keys are documented for automated systems.

4. 4

   Decide about the agent tools

   ask, ask_incident and ask_telemetry generate answers, which is a different kind of result from incident_list.

Paste this into your agent’s instructions

Three tools are agents and one downloads an archive, so a claim can come from generation, from a record or from a file. The block makes the agent say which.

When you answer using incident.io MCP tools, state:
- The tool you called. ask, ask_incident and ask_telemetry are
  agents, so their answers are generated, not returned.
- The period and grouping behind any statistic.
- Whether you called incident_create, incident_update,
  follow_up_create or escalation_respond. All four change state.
Never state that data does not exist. State that no incidents
matched the filters above.
Write your answer in ASD-STE100 Simplified Technical
English. Use short sentences with one idea in each.

Do you need the MCP server at all?

Not for reporting on a schedule. incident.io has a public API, and for that it is the cheaper route.

The connector earns its place on the statistics tools and the playbooks. incident_stats with workload breakdowns is analysis the raw API does not do, and analysis_start supplies a method rather than data.

If the macOS application is already installed, its local server is the same surface without a remote connection to configure.

Connect it for operational review and triage. Use the API for scheduled reporting.

incident.io MCP server setup

The remote server is enabled from Settings, then MCP, inside incident.io. Nothing is installed.

If the macOS application is already in use, it carries a local server with the same tools and needs no configuration at all.

claude mcp add --transport http incidentio \
  https://mcp.incident.io/mcp

{"mcpServers":{"incidentio":{
  "url":"https://mcp.incident.io/mcp"}}}

[mcp_servers.incidentio]
url = "https://mcp.incident.io/mcp"

Every other client

Each block below is the configuration for one client, with the file path and the key that client expects.

{"mcpServers":{"incidentio":{"url":"https://mcp.incident.io/mcp"}}}

{"mcpServers":{"incidentio":{"url":"https://mcp.incident.io/mcp"}}}

{"servers":{"incidentio":{"url":"https://mcp.incident.io/mcp"}}}

{"mcpServers":{"incidentio":{"url":"https://mcp.incident.io/mcp"}}}

{"mcpServers":{"incidentio":{"command":"npx",
  "args":["-y","mcp-remote","https://mcp.incident.io/mcp",
    "--header","Authorization: Bearer $INCIDENT_IO_API_KEY"],
  "env":{"INCIDENT_IO_API_KEY":"<your-key>"}}}}

Read-only access, permissions and security

• Four tools change live incident state

  incident_create, incident_update, follow_up_create and escalation_respond all act on real records and real pages.

• escalation_respond answers a page

  Acknowledging or declining an escalation is an operational action with people on the other side of it.

• investigation_sync downloads everything

  It returns the full investigation filesystem as an archive, including conversation history and evidence.

• Three tools are agents

  ask, ask_incident and ask_telemetry produce generated answers, and ask_telemetry reaches the logging and metrics systems connected to incident.io.

Troubleshooting

The client cannot connect

The remote server is enabled from Settings, then MCP, in incident.io. Until it is switched on there is nothing to authenticate against.

An OAuth client cannot complete the flow

API keys are documented for automated systems that cannot open a browser. The key travels in an Authorization header.

An answer cannot be traced to a record

Check whether the agent used ask, ask_incident or ask_telemetry. All three are agents, so the answer was generated rather than looked up.

The analysis stops halfway

analysis_start downloads a workspace and expects the agent to work through stages: collecting statistics, drilling in, identifying themes and synthesizing. A session that ends before the last stage leaves the analysis unfinished.

incident.io MCP server: Reference

What engineers report

The documentation is specific about tool behavior, so the counts below come from it directly.

Tool inventory and behavior read from incident.io's own remote MCP documentation on 24 August 2026. The documentation gives the grouping-dimension count on incident_stats only as more than ten, so the counts table repeats that wording rather than a number. An unauthenticated tools/list against mcp.incident.io/mcp returned 401 on the same date, which is why this page is sourced from documentation rather than from the wire. Repository facts from the GitHub API.

Should you connect an agent to incident.io?

Yes. Best for teams that already run the macOS application, since it carries the same tools with no remote setup.

Strongest fit

incident.io teams who want an agent to run operational reviews rather than to look up single incidents.

Main advantage

Statistics with workload breakdowns and downloadable playbooks, which go beyond returning records.

Main weakness

Three tools generate answers, and nothing in a transcript separates them from tools that return records.

Operational risk

escalation_respond answers real pages, and three other tools create or change incident records.

Frequently asked questions