Skip the install. Get this working in under 2 minutes.
Start a free trial on cloud.anythingmcp.com, add the incident.io in one click, then point your AI client (Claude, ChatGPT, Copilot or Cursor) at the generated MCP endpoint. No Docker, no git clone, zero engineering experience required.
Summary
incident.io incident response in any AI agent: list and read incidents with their updates and timeline, look up severities, statuses, roles, types and custom fields, manage actions and follow-ups, read and resolve alerts, see who is on call, page people through escalations and browse users, teams and the catalog. It can also declare and edit incidents and post updates.
Try asking
Example prompts for incident.io
Click any prompt to copy it. Paste into Claude, ChatGPT, Cursor, Gemini, Copilot or OpenClaw to run it against this connector.
Claude is AI and can make mistakes. Please double-check responses.
💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → incident.io, paste your credentials, mint an MCP API key and you're done. No Docker, no
git clone, no local server.
incident.io + Microsoft Copilot
incident.io incident response in any AI agent: list and read incidents with their updates and timeline, look up severities, statuses, roles, types and custom fields, manage actions and follow-ups, read and resolve alerts, see who is on call, page people through escalations and browse users, teams and the catalog. It can also declare and edit incidents and post updates.
Prerequisites
See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:
INCIDENT_IO_API_KEY
Step 1 — Get credentials
Setting up takes about 2 minutes. You need an incident.io account and an API key.
- In incident.io open Settings, API keys (https://app.incident.io/settings/api-keys) and click Add new. Only an admin, or a role allowed to manage API keys, can do this.
- Name the key and tick what it may do. For reading, give it at least view data (viewer), plus catalog, schedules and on-call viewing; private incidents need their own permission. For writing, add create incidents, edit incidents, manage actions and follow-ups, create escalations and so on. A tool whose permission the key lacks answers 403.
- Copy the key (it is shown only once) into
INCIDENT_IO_API_KEY, withoutBearerin front. The connector sends it as a Bearer token tohttps://api.incident.io. - Install the connector and run
incident_io_get_identity: it shows the key's name, the dashboard URL of your organisation and the roles granted to the key, such as viewer, incident_creator, incident_editor, on_call_viewer or escalation_creator.
What is going on right now: incident_io_list_incidents with status_category: ["live"] (shown as Active in the app) or ["triage"], newest first, with reference, name, summary, status, severity, type, mode, visibility, roles, custom fields, timestamps, Slack channel and permalink. Filters cover status category, status, severity (also "at least this severe" with severity_gte), type, mode and created or updated date, combined with filter_mode all or any; filters on custom fields and roles go in extra_filters. Then incident_io_get_incident for the full incident with duration metrics and postmortem link, incident_io_list_incident_updates for the updates and incident_io_list_incident_timeline_items for notes, pinned messages and updates in order. Test and tutorial incidents are hidden unless you ask for those modes.
Configuration to look up ids: incident_io_list_severities, incident_io_list_incident_statuses, incident_io_list_incident_roles, incident_io_list_incident_types, incident_io_list_custom_fields, incident_io_get_custom_field, incident_io_list_custom_field_options and incident_io_list_incident_timestamps. The AI reads these first and then uses the ids to filter, create or edit.
Running an incident:
incident_io_create_incidentdeclares an incident with name, summary, severity, status, type, visibility (public or private), mode, role assignments, custom field values and timestamps. It needs anidempotency_keyandvisibility. Modetesttries it out without a real incident;retrospectiverecords a past one.incident_io_create_incident_updateposts an update for responders and stakeholders and can move status and severity at the same time.incident_io_edit_incidentchanges name, summary, severity, status (resolve by moving to a closed status), roles, custom fields, timestamps, call link or Slack channel name. Only the fields you pass change;notify_incident_channeltells the channel about it.- Actions during the incident:
incident_io_list_actions,incident_io_get_action,incident_io_create_action,incident_io_update_action(outstanding, completed, not_doing). - Follow-ups after the incident:
incident_io_list_follow_ups,incident_io_get_follow_up,incident_io_create_follow_up,incident_io_update_follow_up, with priority, category, labels, assignee or team and a linked external issue (Jira, Linear and others). Updating an action or follow-up replaces it, so the AI always sends the current text and status along.
Alerts: incident_io_list_alerts (filter by status such as firing, source, deduplication key or date), incident_io_get_alert, incident_io_list_incident_alerts for which alerts belong to which incident, and incident_io_resolve_alert to resolve a firing alert by hand when the source will not send a resolve event; incidents and escalations it started may resolve too, depending on the alert route. Alert sources (Datadog, Grafana, Prometheus, CloudWatch, HTTP, email, heartbeat and more) with incident_io_list_alert_sources and incident_io_get_alert_source; their secret tokens are left out.
On-call: incident_io_list_schedules and incident_io_get_schedule show rotations, layers and current shifts; incident_io_list_schedule_entries gives the final entries after overrides for a time window, which answers "who is on call now". incident_io_list_escalation_paths and incident_io_list_escalations show who gets paged and what happened; incident_io_create_escalation pages people through an escalation path or directly by user id.
Organisation and catalog: incident_io_list_users (find someone by email or Slack id), incident_io_get_user, incident_io_list_teams, incident_io_list_catalog_types, incident_io_get_catalog_type, incident_io_list_catalog_entries (look up one entry with identifier) and incident_io_get_catalog_entry.
Before writing: a new standard incident opens a Slack or Teams channel and alerts people, an update is shared with responders and subscribers, and an escalation pages people on call. The AI shows you what it is about to do and waits for your yes. When a create is retried, it reuses the same idempotency_key, so the retry does not create a second incident, update or page.
Switched off at install: none. All 43 tools are on, including the write tools; what the key may do is set by the permissions you tick on it in incident.io.
Data formats: ids are ULIDs (26 characters, for example 01FCNDV6P870EA6S7TK1DSYDG0); the human reference is reference (INC-123). Times are ISO 8601 in UTC, date filters take YYYY-MM-DD. Status categories in the API: triage, live (Active), learning (Post-incident), paused, closed, declined, canceled, merged. A higher severity rank means more severe. Custom field answers leave out the option lists, which incident_io_list_custom_field_options returns.
Paging: lists return pagination_meta with after; the AI calls again with after set to it until it is missing. page_size is 25 by default and up to 250 for most lists. incident_io_list_schedule_entries pages by putting pagination_meta.after into entry_window_start.
Limits: 1,200 requests a minute per key.
Common errors: 401 means a wrong or deleted key. 403 means the key lacks the permission for that call; incident_io_get_identity shows its roles, and you tick the missing one under Settings, API keys. 404 is an unknown id. 422 is a validation error whose errors name the field, for example a status transition that is not allowed. 429 means the rate limit; wait a minute.
The connector does not delete incidents, actions, follow-ups or catalog entries, does not create or change alert sources, schedules or escalation paths, and does not return alert source secret tokens.
Step 2 — Install the adapter
curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d
Step 3 — Add the connector in Microsoft Copilot
Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (
https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide showsYOUR_SERVER_ID.
Microsoft Copilot uses MCP servers through agents built in Copilot Studio: you add AnythingMCP to an agent as a tool, then publish the agent to Microsoft 365 Copilot and Teams. Copilot Studio connects from Microsoft's cloud over Streamable HTTP, which AnythingMCP supports.
- In Copilot Studio, open your agent (or create one), go to Tools and choose Add a tool → New tool → Model Context Protocol.
- Enter a Server name (for example
AnythingMCP), a Server description that says what the connector does, and the Server URLhttps://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID. Copilot Studio uses the description to decide when to call the server. - Under authentication, choose API key, set Type to Header and the header name to
X-API-Key, then select Create. - In Add tool, choose Create a new connection, paste an MCP API key from AnythingMCP (MCP Servers → your server → API keys) and select Add to agent.
- Try it in the agent's Test pane: ask for something that needs the
incident.iotools. - Select Publish, then Channels → Microsoft 365 and Microsoft Teams, keep Make agent available in Microsoft Copilot selected and choose Add channel. See agent in Teams installs it for you; in Microsoft 365 Copilot, type @ and pick the agent.
Prefer per-user sign-in? Choose OAuth 2.0 → Dynamic discovery instead of an API key: each user then signs in to AnythingMCP the first time the agent calls it.
Self-hosting? Use your instance's public HTTPS address instead of https://cloud.anythingmcp.com. Copilot Studio connects from Microsoft's cloud, so localhost does not work.
Available tools
| Tool | What it does |
|---|---|
incident_io_get_identity | Show which API key the connector uses: its name, the organisation's dashboard URL and the roles (permissions) granted to it, e.g. viewer… |
incident_io_list_incidents | List incidents, newest first: id, reference (INC-123), name, summary, status and status category, severity, type, mode, visibility, role… |
incident_io_get_incident | Get one incident with everything on it: reference, name, summary, status, severity, type, mode, visibility, role assignments, custom field… |
incident_io_create_incident | Declare an incident: name, summary, severity, status, type, visibility and mode, with role assignments and custom field values |
incident_io_edit_incident | Edit an incident: rename it, change its summary, severity or status (resolve it by moving to a closed status), assign roles, set custom… |
incident_io_list_incident_updates | List the updates of an incident (or of all incidents), newest first: message, new status and severity, who posted it and when |
incident_io_create_incident_update | Post an update to an incident: a message for responders and stakeholders, optionally moving it to another status or severity at the same… |
incident_io_list_incident_timeline_items | List the timeline of one incident: the items added to it (notes, pinned messages, updates) with their time and author, in order |
incident_io_list_severities | List the severities configured in incident.io (e.g |
incident_io_list_incident_statuses | List the incident statuses (e.g |
incident_io_list_incident_roles | List the incident roles (e.g |
incident_io_list_incident_types | List the incident types (e.g |
incident_io_list_custom_fields | List the custom fields of incidents with id, name, description and type (single_select, multi_select, text, link, numeric), and for… |
incident_io_get_custom_field | Get one custom field: name, description, type and, for catalog fields, the catalog type it draws its values from |
incident_io_list_custom_field_options | List the options of a single or multi select custom field: id (value_option_id), value and sort key |
incident_io_list_incident_timestamps | List the incident timestamps tracked for every incident (reported at, accepted at, impact started, resolved at, ...) with their ids, for… |
incident_io_list_actions | List actions (tasks done during an incident), optionally of one incident: id, description, status (outstanding, completed, not_doing)… |
incident_io_get_action | Get one action: description, status, assignee, incident and completion time |
incident_io_create_action | Add an action to an incident: a task to do now, optionally assigned to a user |
incident_io_update_action | Update an action: mark it completed or not_doing (or outstanding again), reassign it or change its text |
incident_io_list_follow_ups | List follow-ups (work to do after an incident), optionally of one incident or team: id, title, description, status, priority, assignee… |
incident_io_get_follow_up | Get one follow-up: title, description, status, priority, category, assignee, labels, incident and the linked external issue |
incident_io_create_follow_up | Add a follow-up to an incident: a title, optional description, assignee or team, priority, category and labels |
incident_io_update_follow_up | Update a follow-up: complete it or mark it not_doing, reassign it, change priority, labels or text |
incident_io_list_alerts | List alerts received from monitoring tools, newest first: id, title, description, status (firing, resolved), alert source, deduplication… |
incident_io_get_alert | Get one alert with its title, description, status, source, deduplication key, attributes, source URL and times |
incident_io_resolve_alert | Resolve a firing alert by hand, e.g. when the source will not send a resolve event |
incident_io_list_incident_alerts | List the links between alerts and incidents: which alerts are attached to an incident, or which incidents an alert belongs to |
incident_io_list_alert_sources | List the alert sources (Datadog, Grafana, Prometheus, CloudWatch, HTTP, email, heartbeat, ...) with id, name, type, the template that… |
incident_io_get_alert_source | Get one alert source: name, type, template (title, description, attributes), filters, owning teams and source-specific options |
incident_io_list_schedules | List on-call schedules with id, name, time zone, rotations and layers, and (with page_size 25 or less) the current and next shifts |
incident_io_get_schedule | Get one on-call schedule: time zone, rotations with their layers, handover times and members, and the current shifts |
incident_io_list_schedule_entries | Show who is on call on a schedule in a time window: the final entries after overrides, each with user, start and end |
incident_io_list_escalation_paths | List the escalation paths (who gets paged in which order, through which schedules and users) with id and name |
incident_io_list_escalations | List escalations (pages sent to people) with id, title, status (pending, triggered, acked, resolved, expired, cancelled, snoozed, ...)… |
incident_io_create_escalation | Page people: start an escalation that follows an escalation path, or notifies the given users directly, with a title included in every… |
incident_io_list_users | List the users of the organisation with id, name, email, Slack user id and role |
incident_io_get_user | Get one user: name, email, Slack user id, base role and custom roles |
incident_io_list_teams | List the teams of the organisation with id and name; team ids are used for follow-ups and alert source ownership |
incident_io_list_catalog_types | List the catalog types (services, teams, features, environments, ...) with id, name, description, type name, attribute schema and whether… |
incident_io_get_catalog_type | Get one catalog type with its attribute schema (names, types, which attributes link to other types) |
incident_io_list_catalog_entries | List the entries of one catalog type (e.g. every service) with id, name, external id, aliases, rank and attribute values |
incident_io_get_catalog_entry | Get one catalog entry with its attribute values; with expand true also the entries that link to it |
Example prompts
- "Which incidents are active right now? Give me severity, status, the incident lead and the latest update for each."
- "Who is on call on the Platform schedule right now, and who takes over next?"
- "Summarise the timeline of INC-123 and list its open follow-ups with their assignees."
- "Declare a private test incident called Checkout latency with severity Minor. Show me the details before creating it."
- "Which alerts are still firing from Datadog, and are any of them attached to an incident?"
FAQ
Which Copilot is this for? Microsoft 365 Copilot at work, through agents built in Copilot Studio. The Microsoft Copilot app for personal accounts has no option to add your own MCP server.
What do I need? A work account with access to Copilot Studio (a license or a trial) to build the agent. People who use it in Microsoft 365 Copilot or Teams need access to the agent: share it with them, or ask an admin to publish it to the organization. If your organization applies data policies to Power Platform connectors, they cover MCP servers too.
The agent doesn't call the tools. Check that the header name is exactly X-API-Key and that the key belongs to the same MCP server as the URL, and make the server description specific: Copilot Studio uses it to decide when to call the server. Publish the agent again after each change; in an open chat, type "start over" to get the new version.
Next steps
- Connector landing page
- Connect to Claude
- Connect to ChatGPT
- Connect to Cursor
- Connect to Gemini
- Connect to Meta Muse
Was this guide helpful?