PagerDuty MCP server: 101 tools, read-only at 63 by default

PagerDuty starts safer than most connectors. One transport setting removes that protection.

Last verified 1 September 2026 · from PagerDuty's repository, its documentation and the server's own tools/list response

This page is one of 90 in a directory of monitoring and developer tools. Each page checks what an AI coding agent can get out of the tool through its MCP server, the connector that lets the agent query the tool directly.

What is the PagerDuty MCP server?

It is PagerDuty's server for the Model Context Protocol. The agent gains tools for reading incidents, schedules, escalation policies and services.

It runs on your machine. There is no authenticated hosted endpoint, so the server holds a PagerDuty user API key and acts with that user's permissions.

Read-only is the default state rather than a flag you remember to set. Write tools are absent from the tool list entirely until the server is started with --enable-write-tools, so an agent cannot call one by accident.

PagerDuty covers production observability partially through incident response, and reaches nothing in code review, release, agent observability or cost.

For an agent, PagerDuty answers questions about who was paged and what happened next, and nothing about why the system broke. An agent connected here can tell you which service alerted, who was on call and how long acknowledgement took. It cannot show you the failing query behind it, so this connector sits beside a telemetry one.

What can an AI agent do with PagerDuty?

The write row behaves differently from the read rows. Its tools are not disabled but absent: on a default connection they are not in tools/list at all, so an agent cannot see them, describe them or call them.

What connecting costs before the first question

A context window is the amount of text a model can hold at once, and connecting uses some of it before the agent asks anything. Every tool the server registers sends its name, description and input schema to the model when the session starts. The tool list is charged whether or not a single tool is called.

Enabling writes here is expensive twice over. It adds 38 tools that can change your on-call configuration, and it takes the connector from roughly 6% of a 200,000-token window to roughly 16%.

Encodings: GPT-5.6, GPT-5.5 o200k_base; GPT-4, GPT-3.5 cl100k_base; Claude Haiku 4.5 to Opus 5 count_tokens. Counted 19 August 2026 from tools/list on pagerduty-mcp 1.1.0, run locally with a placeholder key. It ran once with defaults and once with --enable-write-tools.

Registration is static, so no PagerDuty account was involved. Figures cover name, description and input schema. The two models in column one share the o200k_base encoding, so they get one count. The spread is formatting, about 52%. Reasoning tokens are output, spent per request. The tool list is input, charged once at connection.

The Claude figures are measured rather than encoded. Anthropic publishes no local tokenizer, so the definitions were sent to the API's count_tokens endpoint and a no-tools baseline subtracted. The range covers two tokenizer generations rather than two serializations. Haiku 4.5 and Opus 4.6 sit at the low end, Opus 5 and Sonnet 5 at the high end. The gap between them is about a third.

PagerDuty MCP server limits: where answers come back incomplete

PagerDuty documents every limit below. The first is the sharpest, and it appears as a warning in the repository's own README.

How to configure PagerDuty MCP for agents

1. 1

   Keep the read-only default

   Write tools are omitted from the tool list rather than disabled, which is a stronger guarantee than a flag an agent is asked to respect. Start a separate server with --enable-write-tools only for a session where changing PagerDuty is the point.

2. 2

   Use stdio unless you have a reason not to

   On streamable-http or sse the endpoint has no authentication at all, and every request uses the single API key the server started with.

3. 3

   Scope the key to a user

   PAGERDUTY_USER_API_KEY is a user token, so the agent inherits that user's permissions across every team and service they can reach.

4. 4

   Budget the context

   Read-only costs about 12,695 tokens, roughly 6% of a 200,000-token window. Enabling writes takes it to about 31,904, roughly 16%.

Paste this into your agent’s instructions

PagerDuty's silent failure is absence rather than truncation: change events that were never sent, and write tools that are not there. The block makes the agent distinguish an empty result from an unconfigured integration.

When you answer using PagerDuty MCP tools, state:
- Whether write tools are available in this session. They are
  absent unless the server was started with --enable-write-tools.
- The time window you searched, and the service or team scope.
- Whether change events exist for the period. They appear only
  if a pipeline sends them, so an empty result is not evidence
  that nothing shipped.
Never state that data does not exist. State that none was
returned under the constraints above.
Write your answer in ASD-STE100 Simplified Technical
English. Use short sentences with one idea in each.

Do you need the MCP server at all?

Sometimes. PagerDuty's REST API is well documented and a coding agent can call it with the same user API key, which is what the server does underneath.

The server earns its place through the read-only default and the tool descriptions. Raw API calls give you the same safety only if you build the allowlist yourself. An agent choosing endpoints without descriptions chooses less well.

The trade is context. 63 tool definitions cost roughly 6% of a window before the agent asks anything, where a curated set of three or four API calls costs nothing.

Connect the server for open-ended incident investigation. Call the API directly when the question is fixed and you want the context back.

PagerDuty MCP server setup

The server runs locally from PyPI or Docker. It needs a PagerDuty user API key in PAGERDUTY_USER_API_KEY, and PAGERDUTY_API_HOST if your account is not on the default host.

There is no hosted endpoint, so every user runs a process holding that key.

claude mcp add-json "pagerduty" '{"command":"uvx",
  "args":["pagerduty-mcp"],
  "env":{"PAGERDUTY_USER_API_KEY":"<your-key>"}}'

{"mcpServers":{"pagerduty":{"command":"uvx",
  "args":["pagerduty-mcp"],
  "env":{"PAGERDUTY_USER_API_KEY":"<your-key>"}}}}

[mcp_servers.pagerduty]
command = "uvx"
args = ["pagerduty-mcp"]
env = { PAGERDUTY_USER_API_KEY = "<your-key>" }

Every other client

Each block below is the configuration for one client, with the file path and the key that client expects.

{"mcpServers":{"pagerduty":{"command":"uvx",
  "args":["pagerduty-mcp"],
  "env":{"PAGERDUTY_USER_API_KEY":"<your-key>"}}}}

{"mcpServers":{"pagerduty":{"command":"uvx",
  "args":["pagerduty-mcp"],
  "env":{"PAGERDUTY_USER_API_KEY":"<your-key>"}}}}

{"servers":{"pagerduty":{"command":"uvx",
  "args":["pagerduty-mcp"],
  "env":{"PAGERDUTY_USER_API_KEY":"<your-key>"}}}}

{"mcpServers":{"pagerduty":{"command":"uvx",
  "args":["pagerduty-mcp"],
  "env":{"PAGERDUTY_USER_API_KEY":"<your-key>"}}}}

uvx pagerduty-mcp --enable-write-tools
# env: PAGERDUTY_USER_API_KEY=<your-key>

docker run -i --rm -e PAGERDUTY_USER_API_KEY \
  pagerduty-mcp:latest

Read-only access, permissions and security

• Read-only by construction

  Write tools are absent from tools/list without --enable-write-tools, so an agent cannot see, describe or call them. That is stronger than a flag it is asked to honor.

• HTTP transports have no authentication

  PagerDuty documents that streamable-http and sse, which is server-sent events, expose the endpoint with no authentication, and that every request uses the single API key the server holds. Any client that can reach the port acts with that key's full privileges.

• The key is a user key

  The agent inherits one person's permissions across every team and service they can reach, so scope it to a user with the access you would give an agent.

• The server declares its own read-only tools

  63 of the 101 carry a readOnlyHint of true. That is the MCP field a server sets to mark a tool as one that does not change anything, and it matches the default set exactly.

Troubleshooting

The agent has no tool for acknowledging an incident

That is the default. Write tools appear only when the server is started with --enable-write-tools, and until then they are not in the tool list at all.

401 on connect

PAGERDUTY_USER_API_KEY is missing or not a user key. If your account is on a non-default host, set PAGERDUTY_API_HOST as well.

No change events for the period

Change events exist only if your deployment pipeline sends them. An unintegrated pipeline produces the same empty result as a quiet period.

Another machine is using your server

The HTTP transports have no authentication. Bind to localhost, or put an authenticating proxy in front of the endpoint.

PagerDuty MCP server: Reference

What engineers report

The server is at PyPI 1.1.0 of 7 July 2026, Apache 2.0, with 76 stars. Public discussion is small, so the two issues below are the whole record rather than a sample.

“The PagerDuty MCP server is great! But it exposes a bit too many tools, especially given LLMs today will have degraded performance with the increase number of MCP tools available to them.”

“The MCP implementation does not support OAuth2 Tokens. The underlying api expects the Authorization header to be slightly different between API keys and OAuth2 Tokens.”

Repository facts from the GitHub API and package facts from PyPI, both retrieved 19 August 2026. Tool counts come from the server's own tools/list response, captured twice: once with defaults and once with --enable-write-tools.

Should you connect an agent to PagerDuty?

Yes. Best for PagerDuty teams connecting over stdio, keeping the read-only default for investigation work.

Strongest fit

Teams who want an agent reading incident history, on-call schedules and escalation policies during or after an outage.

Main advantage

Read-only by default, implemented by leaving write tools out of the tool list rather than by asking the agent not to use them.

Main weakness

No hosted endpoint, so every user runs a local process holding a PagerDuty user API key.

Operational risk

The HTTP transports ship with no authentication and share one API key across every caller.

Frequently asked questions