attach_alert
Attach alerts to an incident from provided data
Run incident response through Rootly from your editor — declare and update incidents, work the on-call rota, wire alert routing, close out retrospectives.
LABSCO SUMMARY
Beyond the expected incident CRUD there is a genuinely useful layer for the person carrying the pager: handoff summaries, shift metrics, responder availability and an override recommendation, plus similar-incident lookup while you are still triaging. The whole surface is far more than a model should carry every turn, so pick the slim profile or an explicit tool list unless you really need the configuration endpoints.
Rootly's server over its incident management API, covering incidents, alerts, on-call schedules, workflows, catalogs, status pages and the configuration behind them.
A Rootly account. The hosted server needs nothing installed: point the client at https://mcp.rootly.com/mcp over streamable HTTP and complete OAuth2 in the browser, or send a Rootly API token as a bearer header; SSE and a code-mode endpoint are available too. To run it yourself, install rootly-mcp-server from PyPI with ROOTLY_API_TOKEN. The full tool surface is large — the hosted slim profile, selected with a tool_profile parameter or the X-Rootly-Tool-Profile header, cuts it to about 70 tools, and ROOTLY_MCP_ENABLED_TOOLS sets an exact list.
One command plus a key — claude mcp add --transport http rootly https://mcp.rootly.com/mcp, then supply credentials
USE CASES
Create it with its severity and services, then update it as the picture changes.
Search the incident history, pull related incidents, and read the suggested solutions.
Read the handoff summary and the shift's incidents, then check the metrics for the rotation.
Check who is actually available, get an override recommendation, and create the override shift.
Set up the alert source, then the route and the routing rules that decide who is paged.
Work the retrospective steps and file the action items that came out of it.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
attach_alertAttach alerts to an incident from provided data
check_oncall_health_riskCheck if any at-risk responders (based on On-Call Health analysis) are scheduled for on-call.
Integrates with On-Call Health (oncallhealth.ai) to identify responders with elevated workload health risk and checks if they are scheduled during the specified period. Optionally recommends safe replacement responders.
Privacy: This tool surfaces identifiable employee workload health data from On-Call Health. It is an opt-in feature — an administrator must explicitly configure the ONCALLHEALTH_API_KEY environment variable to enable it. On-Call Health displays a visible indicator on each responder's profile page showing their health score and risk level, ensuring employees are aware that workload analytics are collected and visible to their organization.
Requires ONCALLHEALTH_API_KEY environment variable.
check_responder_availabilityCheck if specific users are scheduled for on-call in a date range.
Use this to verify if at-risk users (from On-Call Health) are scheduled, or to check availability before assigning new shifts.
Returns scheduled users with their shifts and total hours, plus users who are not scheduled.
collect_incidentsCollect a bounded working set of incidents across multiple pages for audits and analysis.
Use this instead of list_incidents when you want a compact batch of incidents in one tool call, while keeping payload size under control.
create_alertCreates a new alert from provided data
create_alert_eventCreates a new alert event
create_alert_groupCreates a new alert group. Note: For enhanced functionality and future compatibility, consider using the advanced alert grouping with conditions field instead of the legacy group_by_alert_title, group_by_alert_urgency, and attributes fields.
create_alert_routeCreates a new alert route from provided data. Note: This endpoint requires access to Advanced Alert Routing. If you're unsure whether you have access to this feature, please contact Rootly customer support.
Asynchronous Rule Creation
For organizations with large numbers of routing rules, Rootly supports asynchronous rule processing to improve performance. When enabled, rule creation happens in the background.
Important: When async processing is enabled, the rules list in the API response will not be up-to-date immediately after creation. You should refetch the alert route after a few minutes to get the updated rules.
If you experience slow operations when managing alert routes with many rules, contact Rootly customer support to enable asynchronous rule processing for your organization.
create_alert_routing_ruleCreates a new alert routing rule from provided data. Note: If you are an advanced alert routing user, you should use the Alert Routes endpoint instead of this endpoint. If you don't know whether you are an advanced user, please contact Rootly customer support.
create_alert_urgencyCreates a new alert urgency from provided data
create_alerts_sourceCreates a new alert source from provided data
create_catalogCreates a new catalog from provided data
create_catalog_entityCreates a new Catalog Entity from provided data
create_causeCreates a new cause from provided data
create_custom_field[DEPRECATED] Use form field endpoints instead. Creates a new custom field from provided data
create_custom_formCreates a new custom form from provided data
create_dashboardCreates a new dashboard from provided data
create_environmentCreates a new environment from provided data
create_escalation_levelCreates a new escalation level from provided data
create_escalation_level_pathsCreates a new escalation level from provided data
create_escalation_pathCreates a new escalation path from provided data
create_escalation_policyCreates a new escalation policy from provided data
create_form_fieldCreates a new form_field from provided data
create_form_field_optionCreates a new form_field_option from provided data
create_form_setCreates a new form_set from provided data
create_functionalityCreates a new functionality from provided data
create_heartbeatCreates a new heartbeat from provided data
create_incidentCreate an incident with a scoped set of fields for agent-driven workflows.
create_incident_action_itemCreates a new action item from provided data
create_incident_custom_field_selection[DEPRECATED] Use form field endpoints instead. Creates a new incident custom field selection from provided data
create_incident_eventCreates a new event from provided data
create_incident_form_field_selectionCreates a new incident form field selection from provided data
create_incident_typeCreates a new incident_type from provided data
create_live_call_routerCreates a new Live Call Router from provided data
create_on_call_roleCreates a new On-Call Role from provided data
create_on_call_shadowCreates a new on call shadow configuration from provided data
create_override_recommendationRecommend replacement responders for an override shift.
Finds users in the same schedule rotation who are not already heavily loaded during the period.
Returns recommended replacements sorted by current load (lowest first), plus a ready-to-use override payload for the top recommendation.
create_override_shiftCreates a new override shift from provided data. If any existing override shifts overlap with the specified time range, they will be automatically deleted and replaced by the new override. This endpoint is idempotent: re-sending an identical override (same user and same start/end time) returns the existing override with a 200 status and does not recreate it.
create_playbookCreates a new playbook from provided data
create_pulseCreates a new pulse from provided data
create_retrospective_processCreates a new retrospective process from provided data
create_scheduleCreates a new schedule from provided data
create_schedule_rotationCreates a new schedule rotation from provided data
create_schedule_rotation_active_dayCreates a new schedule rotation active day from provided data
create_schedule_rotation_userCreates a new schedule rotation user from provided data
create_serviceCreates a new service from provided data
create_severityCreates a new severity from provided data
create_status_pageCreates a new status page from provided data
create_status_page_templateCreates a new template from provided data
create_sub_statusCreates a new Sub-Status from provided data
create_teamCreates a new team from provided data
create_user_email_addressCreates a new user email address from provided data
create_user_notification_ruleCreates a new user notification rule from provided data
create_user_phone_numberCreates a new user phone number from provided data
create_workflowCreates a new workflow from provided data
create_workflow_form_field_conditionCreates a new workflow form field condition from provided data
create_workflow_groupCreates a new workflow group from provided data
create_workflow_runCreates a new workflow run from provided data
create_workflow_taskCreates a new workflow task from provided data
find_related_incidents🔍 Find historically similar incidents using ML similarity analysis - CRITICAL for incident response.
WHEN TO USE:
Provide either incident_id OR incident_description (e.g., 'website is down', 'database timeout errors'). Use status_filter to limit to specific incident statuses or leave empty for all incidents.
get_alertRetrieves a specific alert by id
get_alert_by_short_idGet alert details by short_id or alert URL. Use this when a user pastes an alert URL or short_id from a pager notification and wants to investigate the alert.
get_alert_eventRetrieves a specific alert_event by id
get_alert_groupRetrieves a specific alert group by id
get_alert_routeGet a specific alert route by id. Note: This endpoint requires access to Advanced Alert Routing. If you're unsure whether you have access to this feature, please contact Rootly customer support.
Optional Parameters
true, the response will include IDs for all nested resources (destinations, condition_groups, conditions). This is useful when you need to reference these nested resources for updates or deletions via PATCH requests.Example: GET /v1/alert_routes/{id}?show_nested_ids=true
get_alert_routing_ruleRetrieves a specific alert routing rule by id. Note: If you are an advanced alert routing user, you should use the Alert Routes endpoint instead of this endpoint. If you don't know whether you are an advanced user, please contact Rootly customer support.
get_alert_urgencyRetrieves a specific alert urgency by id
get_alerts_sourceRetrieves a specific alert source by id
get_catalogRetrieves a specific catalog by id
get_catalog_entityRetrieves a specific Catalog Entity by id
get_causeRetrieves a specific cause by id
get_current_userGet current user
get_custom_fieldRetrieves a specific custom_field by id
get_custom_field_option[DEPRECATED] Use form field endpoints instead. Retrieves a specific custom field option by id
get_custom_formRetrieves a specific custom form by id
get_dashboardRetrieves a specific dashboard by id
get_dashboard_panelRetrieves a specific dashboard panel by id
get_environmentRetrieves a specific environment by id
get_escalation_levelRetrieves a specific escalation level by id
get_escalation_pathRetrieves a specific escalation path by id
get_escalation_policyRetrieves a specific escalation policy by id
get_form_fieldRetrieves a specific form_field by id
get_form_field_optionRetrieves a specific form_field_option by id
get_form_field_placementRetrieves a specific form_field_placement by id
get_form_field_placement_conditionRetrieves a specific form_field_placement_condition by id
get_form_setRetrieves a specific form_set by id
get_form_set_conditionRetrieves a specific form_set_condition by id
get_functionalityRetrieves a specific functionality by id
get_functionality_incidents_chartGet functionality incidents chart
get_functionality_uptime_chartGet functionality uptime chart
get_heartbeatRetrieves a specific heartbeat by id
get_incidentRetrieve a single incident with PIR-related fields for direct verification.
get_incident_action_itemsRetrieves a specific incident_action_item by id
get_incident_custom_field_selection[DEPRECATED] Use form field endpoints instead. Retrieves a specific incident custom field selection by id
get_incident_form_field_selectionRetrieves a specific incident form field selection by id
get_incident_retrospective_stepRetrieves a specific incident retrospective step by id
get_incident_sub_statusRetrieves a specific incident_sub_status by id
get_incident_typeRetrieves a specific incident_type by id
get_live_call_routerRetrieves a specific Live Call Router by id
get_meeting_recordingRetrieve a single meeting recording session including its status, duration, speaker count, word count, and transcript summary.
get_on_call_roleRetrieves a specific On-Call Role by id
get_on_call_shadowRetrieves a specific On Call Shadow configuration by ID
get_oncall_handoff_summaryGet current on-call handoff summary. Shows who's currently on-call and who's next. Optionally fetch incidents (set include_incidents=True, but slower).
Use filter_by_region=True with a timezone to see only people on-call during business hours in that region (e.g., timezone='Asia/Tokyo', filter_by_region=True shows only APAC on-call during APAC business hours).
Useful for:
get_oncall_schedule_summaryGet compact on-call schedule summary for a date range.
Returns one entry per user per schedule (not raw shifts), with aggregated hours. Optimized for AI agent context windows.
Use this instead of listShifts when you need:
get_oncall_shift_metrics📊 Get on-call workload metrics and shift statistics - ESSENTIAL for fairness and planning.
WHEN TO USE:
Returns shift counts, total hours, and statistics grouped by user, schedule, or team.
Examples:
get_override_shiftRetrieves a specific override shift by id
get_playbookRetrieves a specific playbook by id
get_playbook_taskRetrieves a specific playbook_task by id
get_pulseRetrieves a specific pulse by id
get_retrospective_processRetrieves a specific retrospective process by id
get_retrospective_process_groupRetrieves a specific Retrospective Process Group by id
get_retrospective_stepRetrieves a specific retrospective step by id
get_scheduleRetrieves a specific schedule by id
get_schedule_rotationRetrieves a specific schedule rotation by id
get_schedule_shiftsRetrieves schedule shifts
get_server_versionGet the Rootly MCP server version.
Returns the current version of the deployed MCP server. Useful for checking if the server has been updated.
get_serviceRetrieves a specific service by id
get_service_incidents_chartGet service incidents chart
get_service_uptime_chartGet service uptime chart
get_severityRetrieves a specific severity by id
get_shift_incidentsGet incidents and alerts that occurred during a specific shift or time period.
Useful for:
Returns incident details including severity, status, duration, and basic summary.
get_status_pageRetrieves a specific status page by id
get_status_page_templateRetrieves a specific status_page_template by id
get_sub_statusRetrieves a specific Sub-Status by id
get_teamRetrieves a specific team by id
get_team_incidents_chartGet team incidents chart
get_userRetrieves a specific user by id
get_user_email_addressesRetrieves all email addresses for the specified user
get_user_phone_numbersRetrieves all phone numbers for the specified user
get_workflowRetrieves a specific workflow by id
get_workflow_form_field_conditionRetrieves a specific workflow form field condition by id
get_workflow_groupRetrieves a specific workflow group by id
get_workflow_taskRetrieves a specific workflow_task by id
list_alert_eventsList alert_events
list_alert_groupsList alert groups
list_alert_routesList all alert routes for the current team with filtering and pagination. Note: This endpoint requires access to Advanced Alert Routing. If you're unsure whether you have access to this feature, please contact Rootly customer support.
list_alert_routing_rulesList alert routing rules. Note: If you are an advanced alert routing user, you should use the Alert Routes endpoint instead of this endpoint. If you don't know whether you are an advanced user, please contact Rootly customer support.
list_alert_urgenciesList alert urgencies
list_alertsList alerts
list_alerts_sourcesList alert sources
list_all_incident_action_itemsList all action items for an organization
list_all_meeting_recordingsList meeting recordings across the organization. Returns the current user's standalone recordings plus incident-backed recordings the user can access. Supports filtering by status, platform, and created_by.
list_catalog_entitiesList Catalog Entities
list_catalogsList catalogs
list_causesList causes
list_custom_fields[DEPRECATED] Use form field endpoints instead. List Custom fields
list_custom_formsList custom forms
list_dashboardsList dashboards
list_endpointsList all available Rootly API endpoints with their descriptions.
list_environmentsList environments
list_escalation_levelsList escalation levels
list_escalation_levels_pathsList escalation levels
list_escalation_pathsList escalation paths
list_escalation_policiesList escalation policies
list_form_field_optionsList form_field_options
list_form_fieldsList form_fields
list_form_setsList form_sets
list_functionalitiesList functionalities
list_heartbeatsList heartbeats
list_incident_action_itemsList incident action items
list_incident_alertsList incident alerts
list_incident_custom_field_selections[DEPRECATED] Use form field endpoints instead. List incident custom field selections
list_incident_eventsList incident events
list_incident_form_field_selectionsList incident form field selections
list_incident_rolesList role assignments for an incident (who is Commander, Scribe, etc.).
Returns one entry per defined role with role metadata and the assigned user (or user_id: null for roles that are defined on the incident but not yet assigned). Use this to answer questions like "who is the incident commander?", "is there a postmortem owner?", or "list all roles for INC-4460".
Implementation note: this wraps GET /v1/incidents/{id}?include=roles and flattens the JSON:API included array of incident_role_assignments into a flat table so callers don't need to walk the relationships graph.
list_incident_typesList incident types
list_incidents🚨 List incidents with structured filters - ESSENTIAL for incident response.
WHEN TO USE:
Use this when you need date-range, team, service, severity, or status filters. For simple text searches, prefer search_incidents instead.
list_live_call_routersList Live Call Routers
list_meeting_recordingsList all meeting recording sessions for an incident. Returns recordings sorted by session number. Each recording represents one bot session with its own transcript, status, and metadata.
list_on_call_rolesList On-Call Roles
list_on_call_shadowsList shadow shifts for schedule
list_override_shiftsList override shifts
list_playbooksList playbooks
list_pulsesList pulses
list_retrospective_processesList retrospective processes
list_schedule_rotation_active_daysList schedule rotation active days
list_schedule_rotation_usersList schedule rotation users
list_schedule_rotationsList schedule rotations
list_schedulesList schedules
list_servicesList services
list_severitiesList severities
list_shiftsList on-call shifts with reliable filtering, enrichment, and MCP-level pagination.
Unlike the raw API, this tool:
Use this instead of the auto-generated listShifts when you need user filtering or dependable pagination on large tenants.
list_status_page_templatesList status page templates
list_status_pagesList status pages
list_sub_statusesList Sub-Statuses
list_teamsList teams
list_user_notification_rulesList user notification rules
list_usersList users
list_workflow_form_field_conditionsList workflow form field conditions
list_workflow_groupsList workflow groups
list_workflow_runsList workflow runs
list_workflow_tasksList workflow tasks
list_workflowsList workflows
patch_alert_routeUpdates an alert route. Note: This endpoint requires access to Advanced Alert Routing. If you're unsure whether you have access to this feature, please contact Rootly customer support.
search_incidentsSearch incidents with flexible pagination control.
Use page_number=0 to fetch all matching results across multiple pages up to max_results. Use page_number>0 to fetch a specific page.
Argument caps: page_size <= 20, max_results <= 10.
suggest_solutions💡 Get actionable solution recommendations from similar resolved incidents - KEY for incident response.
WHEN TO USE:
Provide either incident_id OR title/description. Defaults to resolved incidents for solution mining.
update_alertUpdates an alert
update_alert_eventUpdates a specific alert event. Only alert events with kind 'note' (user-created notes) can be updated. System-generated events are immutable to maintain audit trail integrity.
update_alert_groupUpdate a specific alert group by id. Note: For enhanced functionality and future compatibility, consider using the advanced alert grouping with conditions field instead of the legacy group_by_alert_title, group_by_alert_urgency, and attributes fields.
update_alert_routeUpdate a specific alert route by id. Note: This endpoint requires access to Advanced Alert Routing. If you're unsure whether you have access to this feature, please contact Rootly customer support.
Asynchronous Rule Creation
For organizations with large numbers of routing rules, Rootly supports asynchronous rule processing to improve performance. When enabled, rule updates happen in the background.
Important: When async processing is enabled, the rules list in the API response will not be up-to-date immediately after update. You should refetch the alert route after a few minutes to get the updated rules.
If you experience slow operations when managing alert routes with many rules, contact Rootly customer support to enable asynchronous rule processing for your organization.
update_alert_routing_ruleUpdate a specific alert routing rule by id. Note: If you are an advanced alert routing user, you should use the Alert Routes endpoint instead of this endpoint. If you don't know whether you are an advanced user, please contact Rootly customer support.
update_alert_urgencyUpdate a specific alert urgency by id
update_alerts_sourceUpdate a specific alert source by id
update_catalogUpdate a specific catalog by id
update_catalog_entityUpdate a specific Catalog Entity by id
update_causeUpdate a specific cause by id
update_custom_field[DEPRECATED] Use form field endpoints instead. Update a specific custom field by id
update_custom_field_option[DEPRECATED] Use form field endpoints instead. Update a specific custom field option by id
update_custom_formUpdate a specific custom form by id
update_dashboardUpdate a specific dashboard by id
update_dashboard_panelUpdate a specific dashboard panel by id
update_environmentUpdate a specific environment by id
update_escalation_levelUpdate a specific escalation level by id
update_escalation_pathUpdate a specific escalation path by id
update_escalation_policyUpdate a specific escalation policy by id
update_form_fieldUpdate a specific form_field by id
update_form_field_optionUpdate a specific form_field_option by id
update_form_field_placementUpdate a specific form_field_placement by id
update_form_field_placement_conditionUpdate a specific form_field_placement_condition by id
update_form_setUpdate a specific form_set by id
update_form_set_conditionUpdate a specific form_set_condition by id
update_functionalityUpdate a specific functionality by id
update_heartbeatUpdate a specific heartbeat by id
update_incidentUpdate scoped incident fields for PIR lifecycle automation.
update_incident_action_itemUpdate a specific incident action item by id
update_incident_custom_field_selection[DEPRECATED] Use form field endpoints instead. Update a specific incident custom field selection by id
update_incident_form_field_selectionUpdate a specific incident form field selection by id
update_incident_retrospective_stepUpdate a specific incident retrospective step by id
update_incident_sub_statusUpdate a specific incident_sub_status by id
update_incident_typeUpdate a specific incident_type by id
update_live_call_routerUpdate a specific Live Call Router by id
update_on_call_roleUpdate a specific On-Call Role by id
update_on_call_shadowUpdate a specific on call shadow configuration by id
update_override_shiftUpdate a specific override shift by id
update_playbookUpdate a specific playbook by id
update_playbook_taskUpdate a specific playbook task by id
update_pulseUpdate a specific pulse by id
update_retrospective_processUpdates a specific retrospective process by id
update_retrospective_process_groupUpdate a specific Retrospective Process Group by id
update_retrospective_stepUpdate a specific retrospective step by id
update_scheduleUpdates a specific schedule by id
update_schedule_rotationUpdate a specific schedule rotation by id
update_serviceUpdate a specific service by id
update_severityUpdate a specific severity by id
update_status_pageUpdate a specific status page by id
update_status_page_templateUpdate a specific template event by id
update_sub_statusUpdate a specific Sub-Status by id
update_teamUpdate a specific team by id
update_workflowUpdate a specific workflow by id
update_workflow_form_field_conditionUpdate a specific workflow form field condition by id
update_workflow_groupUpdate a specific workflow group by id
update_workflow_taskUpdate a specific workflow task by id
BEFORE YOU INSTALL
252 tools when we connected. The hosted slim profile (?tool_profile=slim) exposes about 70; ROOTLY_MCP_ENABLE_WRITE_TOOLS=false makes it read-only, and ROOTLY_MCP_ENABLED_TOOLS sets an exact allowlist. Delete operations are off by default.
CONTEXT COST
Rated by the size of the 252 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
claude mcp add --transport http rootly https://mcp.rootly.com/mcphttps://mcp.rootly.com/mcpAdd this hosted endpoint to your MCP client using the credentials listed under Requirements.
{
"mcpServers": {
"rootly": {
"type": "http",
"url": "https://mcp.rootly.com/mcp"
}
}
}{
"mcpServers": {
"rootly": {
"command": "uvx",
"args": [
"--from",
"rootly-mcp-server",
"rootly-mcp-server"
],
"env": {
"ROOTLY_API_TOKEN": "<YOUR_ROOTLY_API_TOKEN>"
}
}
}
}{
"mcpServers": {
"rootly": {
"url": "https://mcp.rootly.com/mcp"
}
}
}{
"mcpServers": {
"rootly": {
"serverUrl": "https://mcp.rootly.com/mcp"
}
}
}[mcp_servers.rootly]
url = "https://mcp.rootly.com/mcp"
bearer_token_env_var = "ROOTLY_API_TOKEN"