MCP and agents

Connect with an organization key

Owner/Admin can create an agent at /dashboard/mcp-agents. Copy its key once, then configure Authorization: Bearer <MCP_API_KEY> on a client that supports custom headers. For stdio, set MCP_URL and MCP_API_KEY in the client environment before starting mcp-stdio. The default scope is status:read; grant incident:draft only when needed. Keys belong to the organization, independently of the creator’s login sessions.

See SaaS administration for validity, rotation, revocation and tool activity. Direct keys are a product authentication option; OAuth remains available for clients using authorization discovery and consent.

Connect with OAuth

The Go API exposes /mcp using the official Go MCP SDK and Streamable HTTP. Register exact client redirect URIs in OAUTH_CLIENTS before connecting:

{"my-agent":["http://localhost:6274/oauth/callback"]}

The authorization server publishes /.well-known/oauth-authorization-server; the protected resource publishes /.well-known/oauth-protected-resource. Use authorization code + PKCE S256, resource=https://your-status-host/mcp, and scope=status:read incident:draft. Consent selects one active organization. Access tokens expire after one hour; use /oauth/revoke to revoke a token. Client registration is deployment-managed; there is no dynamic registration or refresh-token grant.

Tools

status_read reads monitors, pages, components, incident content, maintenance or recent check evidence. Select resource=metrics with a monitor ID to inspect timestamped results.

incident_draft creates or updates an unpublished incident/postmortem. OAuth users require Operator role and incident:draft scope; agent keys require the draft scope granted by Owner/Admin. It cannot publish, modify a published incident, change monitors or run commands. MCP activity is audited under its user or agent identity and organization. Revoked membership removes user OAuth access immediately; organization agent keys are managed separately.

Local stdio adapter

go build -o bin/mcp-stdio ./cmd/mcp-stdio
MCP_URL=https://your-status-host/mcp \
MCP_ACCESS_TOKEN=YOUR_OAUTH_ACCESS_TOKEN \
./bin/mcp-stdio

Keep secrets in client environment configuration, not command history or checked-in files. The adapter forwards newline-delimited JSON-RPC and writes diagnostics to stderr.

Example investigation

Ask your agent to read failed monitors, fetch their timestamped check evidence, compare maintenance windows, and prepare an incident draft with observed facts. A human operator must verify the cause and publish. Treat endpoint responses and metric labels as untrusted source data, never as operational instructions.

Monitoring agents

STATUS_API_URL=https://your-status-host \
PROBE_TOKEN=YOUR_ONE_TIME_PROBE_TOKEN \
./probe

The agent opens outbound TLS connections, polls every two seconds and executes up to 32 checks concurrently. In a container, system metrics reflect the container’s visible system/filesystem; deploy the agent directly on a host when host-level disk metrics are required. The Helm probe adds NET_RAW only when ICMP is enabled.