Model Context Protocol server for evidence-driven incident triage with safe actions and workflow integrations.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"incident-triage-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# incident-triage-mcp `incident-triage-mcp` is a **Model Context Protocol (MCP) server** for incident response workflows. It exposes auditable, tool-based incident triage capabilities that AI hosts/agents can call over MCP (`stdio` or `streamable-http`) without giving the model direct infrastructure access. ## What It Provides - MCP tools for incident triage and evidence retrieval - Deterministic incident summaries from normalized evidence bundles - Safe action gating (RBAC, confirm tokens, audit logging) - Ticketing integrations (Jira / ServiceNow) - Notification integrations (Slack / Teams) - Optional Airflow workflow trigger integration - Standalone mode (no Airflow required) ## Typical Architecture - **Agent/LLM host** calls MCP tools only - **MCP server** enforces guardrails and orchestrates triage actions - **Airflow (optional)** collects/normalizes evidence into an `EvidenceBundle v1` - **Evidence backend** can be filesystem (local) or S3-compatible storage (prod) ## Install ```bash pip install incident-triage-mcp ``` Optional AWS extras (S3 / CloudWatch / X-Ray related integrations): ```bash pip install "incident-triage-mcp[aws]" ``` ## Run ### MCP server (stdio) ```bash MCP_TRANSPORT=stdio incident-triage-mcp ``` ### MCP server (HTTP) ```bash MCP_TRANSPORT=streamable-http MCP_HTTP_AUTH_MODE=api_key MCP_HTTP_API_KEY=change-me incident-triage-mcp ``` ### Local LangGraph agent CLI ```bash incident-triage-agent --incident-id INC-123 --service payments-api ``` ## Core Configuration (overview) - `WORKFLOW_BACKEND=none|airflow` - `EVIDENCE_BACKEND=fs|s3|none` (legacy `airflow` mode still supported) - `MCP_TRANSPORT=stdio|streamable-http` - `MCP_HTTP_AUTH_MODE=none|api_key|jwt_hs256` - `JIRA_PROVIDER=mock|cloud|servicenow` - `NOTIFY_PROVIDER=slack|teams` ## Project Links - GitHub: https://github.com/felixkwasisarpong/incident-triage-mcp - Issues: https://github.com/felixkwasisarpong/incident-triage-mcp/issues For full setup (Docker, Kubernete…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.