incident.io MCP server for AI apps

What your AI apps can do with incident.io

Find and update incidents
Review schedules and alerts

incident.io MCP tools

92 tools, taken from the publisher's documentation on 29 October 2026. The server decides what it offers and can add or rename tools at any time; after you connect, Toolstile shows the current list.

Tool	What it does
`action_create`	Create an action on an incident
`action_delete`	Delete an incident action
`action_list`	List incident actions
`action_update`	Update an existing action
`alert_attach`	Attach an existing alert to an incident
`alert_create_incident`	Declare an incident from one or more alerts
`alert_detach`	Detach an alert from an incident
`alert_list`	Search and browse alerts
`alert_resolve`	Resolve one or more firing alerts
`alert_show`	Full alert details with linked incidents
`alert_source_list`	List configured alert sources
`alert_stats`	Alert counts with workload from linked incidents
`alert_tag_apply`	Add, remove, or replace tags on up to 50 alerts
`alert_tag_list`	List the alert tags available to apply
`analysis_start`	Start a structured operational analysis with playbooks and report template
`ask`	AI agent for on-call queries, schedule management, and general questions
`ask_incident`	AI agent for incident investigation and management actions
`ask_telemetry`	AI agent for querying logs, metrics, traces, and dashboards
`catalog_entry_list`	Browse entries in a catalog type
`catalog_entry_show`	Full catalog entry with all attributes
`catalog_type_list`	List catalog types (Service, Team, etc.)
`cover_request_create`	Ask for volunteers to cover a shift
`cover_request_list`	List cover requests and how candidates responded
`cover_request_manage`	Cancel a cover request, accept an offer, or remind candidates
`cover_request_respond`	Respond to a cover request you're a candidate on
`custom_field_values`	Look up the values a custom field accepts
`document_search`	Search your synced runbooks, guides, and post-mortems
`document_show`	Read a synced document's full content
`duration_metrics_stats`	Time to acknowledge, time to resolve, and other duration metrics with percentiles
`escalation_create`	Page a user or an escalation path
`escalation_list`	Search escalations (pages)
`escalation_path_list`	List escalation paths
`escalation_path_show`	Who would be paged at each level
`escalation_respond`	Acknowledge or decline a page
`escalation_show`	Full escalation details with transition history
`escalation_stats`	Paging counts by path, priority, time of day
`extension_connector_list`	List connectors with their capabilities and connection health
`extension_plugin_create`	Load a plugin from a source-control repository
`extension_plugin_list`	List plugins with their skills and sync state
`extension_plugin_sync`	Re-sync a plugin from its source repository
`extension_plugin_update`	Enable, disable, rename, or change which skills agents load
`extension_skill_feedback_list`	Current feedback on a plugin's skills
`extension_skill_feedback_update`	Dismiss or reopen a skill feedback issue
`extension_skill_usage_list`	List assessed skill loads, with the run behind each one
`extension_upload_url`	Get a URL to upload content that isn't in a readable repository
`extension_verify`	Test proposed extension content before landing it
`extension_verify_show`	Show a verification's status and result
`external_service_list`	List the third-party services whose status pages we monitor
`external_service_status`	Check a monitored vendor's current status and recent changes
`feedback`	Submit feedback about the tools
`follow_up_create`	Create a follow-up on an incident
`follow_up_list`	List post-incident follow-ups
`follow_up_stats`	Follow-up counts grouped by owner, status, and more
`follow_up_update`	Update an existing follow-up
`help_query`	Ask how incident.io works, answered from our documentation
`identity_show`	Who your connection acts as, and what it can do
`incident_create`	Create a new incident
`incident_list`	Search and browse incidents with filters, sortable by workload
`incident_merge`	Merge incidents that turn out to be the same problem
`incident_message`	Post a finding into an incident's channel
`incident_show`	Full incident details with optional investigation, post-mortem, and update history
`incident_stats`	Aggregate counts and workload by 10+ dimensions
`incident_unmerge`	Reverse a merge, restoring an incident as standalone
`incident_update`	Update incident fields (status, severity, roles, custom fields)
`incident_update_list`	Full status update history for an incident
`investigation_feedback`	Record whether an investigation was helpful
`investigation_start`	Start an AI investigation for an incident
`investigation_steer`	Redirect a running investigation's hypothesis
`investigation_sync`	Download a full investigation as an archive for LLM analysis
`maintenance_window_alerts`	Count the alerts a maintenance window held back
`maintenance_window_create`	Schedule a window where matching alerts don't page
`maintenance_window_delete`	Cancel a maintenance window that hasn't started
`maintenance_window_list`	List maintenance windows by status
`maintenance_window_update`	Change a window's name, lead, or times, or end one now
`nexus_health_show`	Health of the AI data sources you've connected
`notification_pause_create`	Pause someone's notifications so escalations skip them
`notification_pause_delete`	Cancel an upcoming pause, or end an active one now
`notification_pause_list`	List notification pauses for a user or schedule
`notification_pause_update`	Change a pause's times or reason
`resource_list`	List the resources available to read
`resource_show`	Read organisation config, analysis playbooks, or telemetry datasources
`schedule_list`	List on-call schedules
`schedule_override_create`	Put someone on call, or clear the schedule, for a period
`schedule_override_delete`	Remove an override, restoring the underlying rotation
`schedule_show`	Schedule details with current and upcoming shifts
`status_page_update`	Draft a status page update for a human to publish
`suggestion_list`	List AI suggestions waiting on a human
`team_list`	List teams
`team_show`	Team details with owned escalation paths, alert sources, and schedules
`telemetry_inspect`	Discover the real labels and metric names on a datasource
`time_spent_stats`	Responder hours by person, period, or custom field
`user_list`	Find users by name or email

Suggested access for each AI app

The documentation this list comes from doesn't mark incident.io's tools as read-only or destructive. Read each tool's description and decide per app before allowing it.

Coding agent in Claude Code or Cursor. Allow the read tools so the agent can look things up without stopping, and require approval for tools that change shared data.

Chat or research app in Claude Desktop. Allow reading and searching. Allow writes only where you want the app to act for you.

Unattended agent, such as a scheduled Codex job. No one is watching the session, so keep it narrow: allow what the job needs, require approval for changes and block the rest.

Blocked tools are removed from the tool list an app sees, so it won't try them. Because rules apply per app, the same incident.io connection can be broad in one app and read-only in another, and the credential stays in Toolstile instead of each app's config file.

How it works with Toolstile

Connect once. Add incident.io to a workspace (browser sign-in). Toolstile keeps the credential, so no agent config holds it.
Choose access per app. Give Claude Code every incident.io tool, give Cursor only the read tools, or keep incident.io away from an app entirely.
Share approved accounts. Teammates use the connection without copying tokens, and you can remove access in one place.
Review activity. See which app called which tool and when, so you can tighten access with evidence.

Add the incident.io MCP server to an AI app

Through Toolstile, every AI app uses one gateway entry, whichever servers you connect. In Claude Code:

Shell

claude mcp add --transport http toolstile 'https://mcp.toolstile.com/mcp'

Then connect incident.io in your workspace and choose which of its tools that app may use. Client setup covers Codex, Cursor and Claude Desktop.

To connect directly instead, add the incident.io endpoint to each app separately. In Claude Code:

Shell

claude mcp add --transport http incidentio 'https://mcp.incident.io/mcp'

In Cursor's mcp.json:

JSON

{
  "mcpServers": {
    "incidentio": {
      "url": "https://mcp.incident.io/mcp"
    }
  }
}

Some servers accept only clients they have approved, or need a token header. Check the incident.io MCP documentation for what your client needs.

Before you connect

A incident.io account. Sign-in uses your incident.io permissions.

Server details

Detail	Value
Publisher	incident.io
Endpoint	`https://mcp.incident.io/mcp`
Authentication	Browser sign-in
Categories	Development
Tool list	92 tools, observed 29 October 2026 (docs)

incident.io MCP documentation

incident.io MCP server for Claude, Codex and Cursor