incident-triage-mcp
incident-triage-mcp is a Model Context Protocol (MCP) server for incident response workflows.
It exposes auditable, tool-based incident triage capabilities that AI hosts/agents can call over MCP (stdio or streamable-http) without giving the model direct infrastructure access.
What It Provides
- MCP tools for incident triage and evidence retrieval
- Deterministic incident summaries from normalized evidence bundles
- Safe action gating (RBAC, confirm tokens, audit logging)
- Ticketing integrations (Jira / ServiceNow)
- Notification integrations (Slack / Teams)
- Optional Airflow workflow trigger integration
- Standalone mode (no Airflow required)
Typical Architecture
- Agent/LLM host calls MCP tools only
- MCP server enforces guardrails and orchestrates triage actions
- Airflow (optional) collects/normalizes evidence into an
EvidenceBundle v1 - Evidence backend can be filesystem (local) or S3-compatible storage (prod)
Install
pip install incident-triage-mcp
Optional AWS extras (S3 / CloudWatch / X-Ray related integrations):
pip install "incident-triage-mcp[aws]"
Run
MCP server (stdio)
MCP_TRANSPORT=stdio incident-triage-mcp
MCP server (HTTP)
MCP_TRANSPORT=streamable-http MCP_HTTP_AUTH_MODE=api_key MCP_HTTP_API_KEY=change-me incident-triage-mcp
Local LangGraph agent CLI
incident-triage-agent --incident-id INC-123 --service payments-api
Core Configuration (overview)
WORKFLOW_BACKEND=none|airflowEVIDENCE_BACKEND=fs|s3|none(legacyairflowmode still supported)MCP_TRANSPORT=stdio|streamable-httpMCP_HTTP_AUTH_MODE=none|api_key|jwt_hs256JIRA_PROVIDER=mock|cloud|servicenowNOTIFY_PROVIDER=slack|teams
Project Links
- GitHub: https://github.com/felixkwasisarpong/incident-triage-mcp
- Issues: https://github.com/felixkwasisarpong/incident-triage-mcp/issues
For full setup (Docker, Kubernetes, Airflow, Helm, provider configs, and demos), see the repository README.md.
3 maintainers
Metadata
3 maintainers
Release files for incident-triage-mcp 0.2.9
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| incident_triage_mcp-0.2.9.tar.gz | 97.1 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| incident_triage_mcp-0.2.9-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 177.6 kB
Release files / incident_triage_mcp-0.2.9.tar.gz
| Download URL | incident_triage_mcp-0.2.9.tar.gz |
|---|---|
| Size | 97.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b2d31d2e68fe18116ebe64cc970a50f76dbceba7fbaee378ffe67f686c86d779
|
|
BLAKE2b-256 checksum How to use checksums |
5cce95d7a24c3e988ed70403c059df5eb6b0cc424f1fd584dd6c07ff5a1dc0b6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Release files / incident_triage_mcp-0.2.9-py3-none-any.whl
| Download URL | incident_triage_mcp-0.2.9-py3-none-any.whl |
|---|---|
| Size | 80.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
c63a447142a2b9fb7bc537dc3d5461f317480ad8b6bee96f4a78fdfbe8082bcc
|
|
BLAKE2b-256 checksum How to use checksums |
38cf99527faf878e5cc06de17b77c4273527d3a56478ab316acbb84e5120e856
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Security for incident-triage-mcp 0.2.9
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
