incident.io MCP server: 91 tools, three are agents

An incident connector that answers with statistics rather than records. Three of its tools are incident.io's own AI agents. One downloads a whole investigation as an archive.

Checked 6 October 2026 · from incident.io's own remote MCP documentation and the archived repository's GitHub record

One of 91 guides to monitoring and developer tools. Each covers what an AI coding agent can get out of the tool through MCP, the protocol that lets the agent query the tool directly.

What is the incident.io MCP server?

It is incident.io's server for the Model Context Protocol. Incident.io runs incident response, so a connected agent reaches incidents, the alerts behind them and the people who were paged.

The documentation leads with statistics rather than with records. incident_stats aggregates by more than ten dimensions. It also reports workload, meaning how much responder time fell in working hours, in the late evening or overnight.

investigation_sync goes the other way and downloads a complete investigation as an archive: every finding, check, conversation and piece of evidence, meant for the agent to read in full.

incident.io has two live MCP servers and one archived one:

The macOS application needs no separate configuration; the remote endpoint exists for clients that cannot run the macOS application, such as a browser or an automated pipeline.

It sits in production observability, reaches telemetry only through an agent that queries other systems, and reaches nothing in code review, CI or cost.

For an agent, incident.io answers who was paged, how often and at what hour. It answers patterns across many incidents better than the detail of one incident. It cannot show the telemetry itself except through ask_telemetry, which queries systems you have connected to incident.io.

What can an AI agent do with incident.io?

The documentation's own advice is to read the configuration first with resource_show, then start with statistics and drill in, rather than listing records and counting them in the model.

What the tool definitions cost in context

A client that loads every tool definition at the start of a session spends this much context before the first question. Claude Code defers definitions by default through tool search, and loads a tool's definition when the agent needs it. The method below gives the version and date measured.

A context window is the amount of text a model can hold at once. On 24 August 2026 the documentation listed 32 tools, and they cost 1,875 to 2,122 tokens on Claude when a client loads them. The table now lists 91, so the current cost is higher. Three tools are AI agents rather than data reads, and they carry their own descriptions like any other tool.

Statistics tools come before record tools in the documented list, which is the order incident.io recommends working in.

Encodings: GPT-5.6, GPT-5.5 o200k_base; GPT-4, GPT-3.5 cl100k_base; Claude Haiku 4.5 to Opus 5 count_tokens. Counted from the 32 tool entries in the vendor's own documentation on 24 August 2026. That documentation is the only public inventory.

The server could not be run for a live tools/list. No input schemas are available, so these figures cover each tool's name and description only. They are a floor, not the figure.

The Claude columns are measured through the API's count_tokens endpoint with an empty schema per tool. So they cover the same content as the GPT columns. The range there is two tokenizer generations. Haiku 4.5 and Opus 4.6 are at the low end. Opus 5 and Sonnet 5 are at the high end. The gap between them is about a tenth.

incident.io MCP server limits: where answers come back incomplete

incident.io mixes tools that return records with tools that generate answers; the limits below follow from that split.

How to configure incident.io MCP for agents

1. 1

   Check whether you already have it

   The macOS application ships a local server carrying the same tools, so a team using it needs no extra setup.

2. 2

   Enable it in Settings first

   The remote server is switched on from the MCP page in incident.io settings before any client can connect.

3. 3

   Choose OAuth or an API key deliberately

   OAuth suits interactive clients; API keys are documented for automated systems.

4. 4

   Decide about the agent tools

   ask, ask_incident and ask_telemetry generate answers, which is a different kind of result from incident_list.

Paste this into your agent’s instructions

Three tools are agents and one downloads an archive, so a claim can come from generation, from a record or from a file. The block makes the agent say which.

When you answer using incident.io MCP tools, state:
- The tool you called. ask, ask_incident and ask_telemetry are
  agents, so their answers are generated.
- The period and grouping behind any statistic.
- Whether you called a tool that changes state, such as
  incident_create, alert_resolve, escalation_create or
  escalation_respond. More than 30 tools change state.
When a search returns nothing, state that no incidents
matched the filters above.
Write your answer in ASD-STE100 Simplified Technical
English. Use short sentences with one idea in each.

Do you need the MCP server at all?

Not for reporting on a schedule. incident.io has a public API, and for that it is the cheaper route.

The connector earns its place on the statistics tools and the playbooks. incident_stats with workload breakdowns is analysis the raw API does not do, and analysis_start supplies a method rather than data.

If the macOS application is already installed, its local server is the same surface without a remote connection to configure.

Connect it for operational review and triage. Use the API for scheduled reporting.

incident.io MCP server setup

The remote server is enabled from Settings, then MCP, inside incident.io. Nothing is installed.

If the macOS application is already in use, it carries a local server with the same tools and needs no configuration at all.

claude mcp add --transport http incidentio \
  https://mcp.incident.io/mcp

{"mcpServers":{"incidentio":{
  "url":"https://mcp.incident.io/mcp"}}}

[mcp_servers.incidentio]
url = "https://mcp.incident.io/mcp"

Every other client

Each block below is the configuration for one client, with the file path and the key that client expects.

{"mcpServers":{"incidentio":{"url":"https://mcp.incident.io/mcp"}}}

{"mcpServers":{"incidentio":{"url":"https://mcp.incident.io/mcp"}}}

{"servers":{"incidentio":{"url":"https://mcp.incident.io/mcp"}}}

{"mcpServers":{"incidentio":{"url":"https://mcp.incident.io/mcp"}}}

{"mcpServers":{"incidentio":{"command":"npx",
  "args":["-y","mcp-remote","https://mcp.incident.io/mcp",
    "--header","Authorization: Bearer $INCIDENT_IO_API_KEY"],
  "env":{"INCIDENT_IO_API_KEY":"<your-key>"}}}}

Read-only access, permissions and security

• More than 30 tools change live state

  They create and merge incidents, resolve alerts, page people, override schedules, pause notifications and schedule maintenance windows. incident.io's tools table names each one.

• escalation_create and escalation_respond act on pages

  The first pages a user or an escalation path. The second acknowledges or declines a page. People are on the other side of both.

• investigation_sync downloads everything

  It returns the full investigation filesystem as an archive, including conversation history and evidence.

• Three tools are agents

  ask, ask_incident and ask_telemetry produce generated answers, and ask_telemetry reaches the logging and metrics systems connected to incident.io.

Troubleshooting

The client cannot connect

The remote server is enabled from Settings, then MCP, in incident.io. Until it is switched on there is nothing to authenticate against.

An OAuth client cannot complete the flow

API keys are documented for automated systems that cannot open a browser. The key travels in an Authorization header.

An answer cannot be traced to a record

Check whether the agent used ask, ask_incident or ask_telemetry. All three are agents, so the answer was generated rather than looked up.

The analysis stops halfway

analysis_start downloads a workspace and expects the agent to work through stages: collecting statistics, drilling in, identifying themes and synthesizing. A session that ends before the last stage leaves the analysis unfinished.

incident.io MCP server: Reference

What engineers report

The documentation is specific about tool behavior, so the counts below come from it directly.

Tool inventory and behavior read from incident.io's own remote MCP documentation on 6 October 2026. Its tools table gives the grouping-dimension count on incident_stats as 10+, so the counts table repeats that wording rather than a number. An unauthenticated tools/list against mcp.incident.io/mcp returned 401 on 24 August 2026, so the figures come from documentation rather than from the server itself. Repository facts from the GitHub API.

Should you connect an agent to incident.io?

Yes. Best for teams that already run the macOS application, since it carries the same tools with no remote setup.

Strongest fit

incident.io teams who want an agent to run operational reviews rather than to look up single incidents.

Main advantage

Statistics with workload breakdowns and downloadable playbooks, which go beyond returning records.

Main weakness

Three tools generate answers, and nothing in a transcript separates them from tools that return records.

Operational risk

More than 30 tools change state, including escalation_create, which pages people, and escalation_respond, which answers pages.

Frequently asked questions