mcp-allquiet

An MCP server for All Quiet, the incident management and on-call platform. It lets Claude, Cursor or any MCP client triage incidents, check who is on call and reach every operation of the All Quiet public API.

Built on the official MCP Python SDK v2 (mcp 2.x). Not affiliated with All Quiet.

Why

All Quiet has a complete public API (136 operations) but no official MCP server. Exposing one tool per operation would put 136 tool schemas into the model's context before the first question. This server ships 10 tools:

• 5 incident tools for the on-call loop, returning compact summaries.
• 5 generic tools driven by the bundled OpenAPI spec, which reach every other operation (teams, schedules, overrides, integrations, routing, status pages, maintenance windows...).

Install

Requires uv and an All Quiet API key (the API needs a Pro or Enterprise plan).

Claude Code:

claude mcp add allquiet -e ALLQUIET_API_KEY=your-key -- uvx mcp-allquiet

Claude Desktop, Cursor and other clients (mcpServers JSON):

{
  "mcpServers": {
    "allquiet": {
      "command": "uvx",
      "args": ["mcp-allquiet"],
      "env": { "ALLQUIET_API_KEY": "your-key" }
    }
  }
}

Configuration

The API key decides what the model can do

All Quiet keys carry per-resource scopes (incidents:list, teams:update...), can be limited to teams, and can expire. The server has no read-only switch on purpose: create a key with only list/get scopes and every write fails at the API. A personal access token can never do more than its user can in the UI.

A personal access token only reaches teams its user belongs to. A team created through the API stays out of reach (403) until a POST /team-membership adds the user as Administrator. Organization API keys skip team role checks.

Keys spanning several organizations need the organizationId query parameter on many operations. The API says so in its error, and the model can pass it through the generic tools.

Tools

Tools carry MCP annotations (readOnlyHint, destructiveHint), so clients can ask before writes and deletes.

Security

• The key is read from the environment and only sent to the configured https:// host. It never appears in tool output or error messages (tested).
• Generic tools accept only path templates that exist in the bundled spec. Path parameters are percent-encoded as a single segment, so a value cannot rewrite the path.
• Responses are truncated at 40k characters and error bodies at 2k.
• Incident content is untrusted input. Titles, messages and attributes often come from alert payloads written by third parties. Treat what the model reads there as data, and keep write scopes off keys you use with untrusted incident sources.

Report vulnerabilities through SECURITY.md.

Limitations

• stdio transport only.
• POST /inbound-integration/{id}/call-routing-media/{purpose} needs multipart/form-data and is not supported.
• No retries. A 429 returns the Retry-After value to the model.

Development

uv sync
uv run pytest
uv run ruff check && uv run ruff format --check && uv run ty check

Try it with the MCP Inspector:

ALLQUIET_API_KEY=your-key npx @modelcontextprotocol/inspector uv run mcp-allquiet

Refresh the bundled OpenAPI spec:

curl -s https://allquiet.app/api/swagger/public-v1/swagger.json \
  | python -c "import json,sys; json.dump(json.load(sys.stdin), sys.stdout, separators=(',',':'))" \
  > src/mcp_allquiet/openapi.json

See CONTRIBUTING.md.

License

MIT