How to Connect incident.io to Gemini via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → incident.io, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

incident.io + Gemini

incident.io incident response in any AI agent: list and read incidents with their updates and timeline, look up severities, statuses, roles, types and custom fields, manage actions and follow-ups, read and resolve alerts, see who is on call, page people through escalations and browse users, teams and the catalog. It can also declare and edit incidents and post updates.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

INCIDENT_IO_API_KEY

Step 1 — Get credentials

Setting up takes about 2 minutes. You need an incident.io account and an API key.

1. In incident.io open Settings, API keys (https://app.incident.io/settings/api-keys) and click Add new. Only an admin, or a role allowed to manage API keys, can do this.
2. Name the key and tick what it may do. For reading, give it at least view data (viewer), plus catalog, schedules and on-call viewing; private incidents need their own permission. For writing, add create incidents, edit incidents, manage actions and follow-ups, create escalations and so on. A tool whose permission the key lacks answers 403.
3. Copy the key (it is shown only once) into INCIDENT_IO_API_KEY, without Bearer in front. The connector sends it as a Bearer token to https://api.incident.io.
4. Install the connector and run incident_io_get_identity: it shows the key's name, the dashboard URL of your organisation and the roles granted to the key, such as viewer, incident_creator, incident_editor, on_call_viewer or escalation_creator.

What is going on right now: incident_io_list_incidents with status_category: ["live"] (shown as Active in the app) or ["triage"], newest first, with reference, name, summary, status, severity, type, mode, visibility, roles, custom fields, timestamps, Slack channel and permalink. Filters cover status category, status, severity (also "at least this severe" with severity_gte), type, mode and created or updated date, combined with filter_mode all or any; filters on custom fields and roles go in extra_filters. Then incident_io_get_incident for the full incident with duration metrics and postmortem link, incident_io_list_incident_updates for the updates and incident_io_list_incident_timeline_items for notes, pinned messages and updates in order. Test and tutorial incidents are hidden unless you ask for those modes.

Configuration to look up ids: incident_io_list_severities, incident_io_list_incident_statuses, incident_io_list_incident_roles, incident_io_list_incident_types, incident_io_list_custom_fields, incident_io_get_custom_field, incident_io_list_custom_field_options and incident_io_list_incident_timestamps. The AI reads these first and then uses the ids to filter, create or edit.

Running an incident:

• incident_io_create_incident declares an incident with name, summary, severity, status, type, visibility (public or private), mode, role assignments, custom field values and timestamps. It needs an idempotency_key and visibility. Mode test tries it out without a real incident; retrospective records a past one.
• incident_io_create_incident_update posts an update for responders and stakeholders and can move status and severity at the same time.
• incident_io_edit_incident changes name, summary, severity, status (resolve by moving to a closed status), roles, custom fields, timestamps, call link or Slack channel name. Only the fields you pass change; notify_incident_channel tells the channel about it.
• Actions during the incident: incident_io_list_actions, incident_io_get_action, incident_io_create_action, incident_io_update_action (outstanding, completed, not_doing).
• Follow-ups after the incident: incident_io_list_follow_ups, incident_io_get_follow_up, incident_io_create_follow_up, incident_io_update_follow_up, with priority, category, labels, assignee or team and a linked external issue (Jira, Linear and others). Updating an action or follow-up replaces it, so the AI always sends the current text and status along.

Alerts: incident_io_list_alerts (filter by status such as firing, source, deduplication key or date), incident_io_get_alert, incident_io_list_incident_alerts for which alerts belong to which incident, and incident_io_resolve_alert to resolve a firing alert by hand when the source will not send a resolve event; incidents and escalations it started may resolve too, depending on the alert route. Alert sources (Datadog, Grafana, Prometheus, CloudWatch, HTTP, email, heartbeat and more) with incident_io_list_alert_sources and incident_io_get_alert_source; their secret tokens are left out.

On-call: incident_io_list_schedules and incident_io_get_schedule show rotations, layers and current shifts; incident_io_list_schedule_entries gives the final entries after overrides for a time window, which answers "who is on call now". incident_io_list_escalation_paths and incident_io_list_escalations show who gets paged and what happened; incident_io_create_escalation pages people through an escalation path or directly by user id.

Organisation and catalog: incident_io_list_users (find someone by email or Slack id), incident_io_get_user, incident_io_list_teams, incident_io_list_catalog_types, incident_io_get_catalog_type, incident_io_list_catalog_entries (look up one entry with identifier) and incident_io_get_catalog_entry.

Before writing: a new standard incident opens a Slack or Teams channel and alerts people, an update is shared with responders and subscribers, and an escalation pages people on call. The AI shows you what it is about to do and waits for your yes. When a create is retried, it reuses the same idempotency_key, so the retry does not create a second incident, update or page.

Switched off at install: none. All 43 tools are on, including the write tools; what the key may do is set by the permissions you tick on it in incident.io.

Data formats: ids are ULIDs (26 characters, for example 01FCNDV6P870EA6S7TK1DSYDG0); the human reference is reference (INC-123). Times are ISO 8601 in UTC, date filters take YYYY-MM-DD. Status categories in the API: triage, live (Active), learning (Post-incident), paused, closed, declined, canceled, merged. A higher severity rank means more severe. Custom field answers leave out the option lists, which incident_io_list_custom_field_options returns.

Paging: lists return pagination_meta with after; the AI calls again with after set to it until it is missing. page_size is 25 by default and up to 250 for most lists. incident_io_list_schedule_entries pages by putting pagination_meta.after into entry_window_start.

Limits: 1,200 requests a minute per key.

Common errors: 401 means a wrong or deleted key. 403 means the key lacks the permission for that call; incident_io_get_identity shows its roles, and you tick the missing one under Settings, API keys. 404 is an unknown id. 422 is a validation error whose errors name the field, for example a status transition that is not allowed. 429 means the rate limit; wait a minute.

The connector does not delete incidents, actions, follow-ups or catalog entries, does not create or change alert sources, schedules or escalation paths, and does not return alert source secret tokens.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Gemini

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Gemini CLI reads MCP servers from ~/.gemini/settings.json (on Windows %USERPROFILE%\.gemini\settings.json). Add:

{
  "mcpServers": {
    "anythingmcp": {
      "httpUrl": "https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID",
      "headers": { "X-API-Key": "YOUR_MCP_API_KEY" }
    }
  }
}

1. Create an MCP API key in AnythingMCP under MCP Servers → your server → API keys, and paste it in place of YOUR_MCP_API_KEY.
2. Save the file and restart gemini.
3. Run /mcp inside Gemini CLI (or gemini mcp list in your shell): anythingmcp should show as connected.
4. Start prompting: Gemini CLI can now call the incident.io tools.

Available tools

Example prompts

• "Which incidents are active right now? Give me severity, status, the incident lead and the latest update for each."
• "Who is on call on the Platform schedule right now, and who takes over next?"
• "Summarise the timeline of INC-123 and list its open follow-ups with their assignees."
• "Declare a private test incident called Checkout latency with severity Minor. Show me the details before creating it."
• "Which alerts are still firing from Datadog, and are any of them attached to an incident?"

FAQ

Where does Gemini CLI look for MCP servers? In ~/.gemini/settings.json for your user, or in .gemini/settings.json inside a project. gemini mcp list shows each server and whether it connects.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT
• Connect to Cursor
• Connect to Meta Muse
• Connect to Microsoft Copilot