Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions servers/incident-triage-mcp/readme.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
# Incident Triage MCP

`incident-triage-mcp` is a Model Context Protocol (MCP) server for evidence-driven incident response workflows.

It exposes auditable triage and action tools to AI hosts/agents while keeping direct infrastructure access out of the model runtime.

## What It Provides

- Incident triage summaries from normalized evidence bundles (`EvidenceBundle v1`)
- Evidence retrieval / wait-for-bundle orchestration
- Jira / ServiceNow ticket drafting and creation
- Slack / Teams notifications
- Optional Airflow DAG trigger integration
- Safe actions (RBAC, confirm tokens, audit logging, idempotency)

## Safe Defaults (Docker MCP Toolkit / Catalog)

This registry entry is intended to be safe to run locally without external dependencies:

- `MCP_TRANSPORT=stdio`
- `WORKFLOW_BACKEND=none`
- `EVIDENCE_BACKEND=fs`
- `JIRA_PROVIDER=mock`
- `BUNDLE_ONLY_MODE=true`

You can enable Airflow/Jira/Slack/Teams later by supplying env vars and secrets.

## Common Modes

### Standalone / Local

- `WORKFLOW_BACKEND=none`
- `EVIDENCE_BACKEND=fs`

### Airflow-Orchestrated (local or prod)

- `WORKFLOW_BACKEND=airflow`
- `EVIDENCE_BACKEND=fs` (local PVC/filesystem) or `s3` (prod object storage)

## Project

- Repository: https://github.com/felixkwasisarpong/incident-triage-mcp
- PyPI: https://pypi.org/project/incident-triage-mcp/

For full setup (Docker, Kubernetes, Airflow, Helm, and provider configuration), see the repository `README.md`.
99 changes: 99 additions & 0 deletions servers/incident-triage-mcp/server.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
name: incident-triage-mcp
image: docker.io/fsarpong/incident-triage-mcp:0.2.8
type: server

meta:
category: devops
tags:
- incident-response
- observability
- workflow
- jira
- airflow

about:
title: Incident Triage
description: >-
Evidence-driven incident triage tools with safe actions, ticketing,
notifications, and optional Airflow orchestration.
icon: https://raw.githubusercontent.com/felixkwasisarpong/incident-triage-mcp/main/docs/assets/icon.png

source:
project: https://github.com/felixkwasisarpong/incident-triage-mcp
branch: main
commit: eeb1d95857b71fd7bced8575ea4a559417d211c9

run:
command:
- --transport=stdio
env:
WORKFLOW_BACKEND: none
EVIDENCE_BACKEND: fs
EVIDENCE_DIR: /evidence
RUNBOOKS_DIR: /runbooks
JIRA_PROVIDER: mock
BUNDLE_ONLY_MODE: "true"

config:
description: >-
Configure optional workflow, ticketing, and notification integrations. Safe
defaults run standalone with mock Jira and local filesystem evidence.
secrets:
- name: incident-triage-mcp.jira-api-token
env: JIRA_API_TOKEN
example: atlassian_api_token_here
description: Jira Cloud API token when JIRA_PROVIDER=cloud.
required: false
- name: incident-triage-mcp.confirm-token
env: CONFIRM_TOKEN
example: change-me-confirm-token
description: Confirmation token for live safe actions.
required: false
- name: incident-triage-mcp.airflow-password
env: AIRFLOW_PASSWORD
example: airflow_password_here
description: Airflow API password when WORKFLOW_BACKEND=airflow.
required: false
- name: incident-triage-mcp.slack-webhook-url
env: SLACK_WEBHOOK_URL
example: https://hooks.slack.com/services/XXX/YYY/ZZZ
description: Slack incoming webhook URL.
required: false
- name: incident-triage-mcp.teams-webhook-url
env: TEAMS_WEBHOOK_URL
example: https://outlook.office.com/webhook/...
description: Teams incoming webhook URL.
required: false
env:
- name: WORKFLOW_BACKEND
example: airflow
- name: EVIDENCE_BACKEND
example: s3
- name: EVIDENCE_DIR
example: /evidence
- name: RUNBOOKS_DIR
example: /runbooks
- name: BUNDLE_ONLY_MODE
example: "true"
- name: AIRFLOW_BASE_URL
example: https://airflow.example.com
- name: AIRFLOW_USERNAME
example: admin
- name: AIRFLOW_API_VERSION
example: v2
- name: AIRFLOW_AUTH_MODE
example: token
- name: JIRA_PROVIDER
example: cloud
- name: JIRA_BASE_URL
example: https://your-org.atlassian.net
- name: JIRA_EMAIL
example: you@example.com
- name: JIRA_PROJECT_KEY
example: INC
- name: JIRA_ISSUE_TYPE
example: Task
- name: SLACK_DEFAULT_CHANNEL
example: "#incident-triage"
- name: TEAMS_DEFAULT_CHANNEL
example: Incident Triage