Tools

IncidentFlow MCP exposes 48 tools: 44 operational tools across six domains plus 4 meta tools for discovery and diagnostics. Every tool is read‑only except knowledge_upsert, which writes to workspace memory.

All tools return the same response envelope, are scoped to the authenticated workspace, and never mutate clusters, deployments, or integrations.

Conventions

• Access — read (observability only) or write (workspace memory only).
• response_mode — many tools accept summary (default) or full to control payload size.
• Allow‑lists — Grafana dashboards and Kubernetes namespaces are limited to what the workspace has approved.
• Discovery — call incidentflow_capabilities for the authoritative, machine‑readable inventory with per‑tool safety metadata.

Kubernetes (17)

Read‑only cluster diagnostics through the IncidentFlow Kubernetes Agent.

Tool	Description	Access
k8s_connection_health	Check whether the agent is online, the cluster is reachable, and core read‑only permissions work.	read
k8s_agent_status	Agent registry status, version, heartbeat, and selected cluster identity.	read
k8s_rbac_check	Report the read‑only Kubernetes permissions available to the agent.	read
k8s_cluster_overview	SRE overview: pod health, unhealthy pods, deployment counts, warning events, top restarts, plus a health assessment.	read
k8s_namespace_overview	Read‑only overview scoped to one allowed namespace (pods, events, deployments, services, restarts).	read
k8s_list_namespaces	List namespaces visible to the agent.	read
k8s_list_pods	Pod health and readiness in a namespace — phase, container readiness, restarts, age.	read
k8s_show_unhealthy_pods	Find pods that are not ready, crash‑looping, pending, failed, or high‑restart, with reasons.	read
k8s_get_pod	Quick health status for one pod — readiness, restart count, node, phase.	read
k8s_describe_pod	Structured pod investigation report — the primary tool for why a pod is unhealthy.	read
k8s_debug_pod	Full automated pod investigation: state, recent logs, related events, owner deployment.	read
k8s_get_pod_logs	Stream recent, filtered/redacted container log lines (kubectl logs equivalent).	read
k8s_list_deployments	List deployments in an allowed namespace with rollout and availability metadata.	read
k8s_get_rollout_status	Deployment rollout readiness, availability, and progress.	read
k8s_list_services	List services in an allowed namespace — type, ports, selectors.	read
k8s_list_events	Namespace events, warnings first and deduplicated with occurrence counts.	read
k8s_analyze_workload	Inspect a workload rollout, related pods, unhealthy status, and redacted recent logs.	read

Argo CD (8)

Read‑only GitOps deployment context from the connected Argo CD integration.

Tool	Description	Access
argocd_connection_health	Connection health, authentication, RBAC, version, and application counts.	read
argocd_list_applications	List visible applications with filters (project, namespace, destination, health, sync).	read
argocd_get_application	Normalized application details — project, destination, sources, health, sync, recent history.	read
argocd_get_application_resources	Resource‑tree metadata (manifests and Secret data intentionally omitted).	read
argocd_get_sync_history	Recent sync/deployment history — revision, time, source, initiator.	read
argocd_get_last_operation	Latest operation state — phase, timing, message, sync revision, resource results.	read
argocd_find_recent_deployments	Recent deployment events across visible applications, with optional filters.	read
argocd_analyze_application	Compact health and sync analysis from status, last operation, history, and resource tree.	read

Grafana / Prometheus (8)

Guarded, read‑only metrics from allow‑listed dashboards and datasources.

Tool	Description	Access
grafana_connection_health	Read‑only Grafana connection health: normalized status, datasource count, and warnings.	read
grafana_list_dashboards	Discover dashboards approved for the current workspace.	read
grafana_get_dashboard	Dashboard metadata, panels, and datasource references for a known UID.	read
grafana_extract_panel_queries	Extract the PromQL expressions embedded in an allow‑listed dashboard.	read
grafana_metrics_query	Point‑in‑time PromQL result through server‑side guardrails.	read
grafana_metrics_query_range	PromQL time series over a bounded window through server‑side guardrails.	read
analyze_dashboard_health	Health summary for an allow‑listed dashboard over a time window (per‑panel series + anomaly flags).	read
grafana_get_panel_view	Render one allow‑listed timeseries panel (Apps SDK view).	read

Slack / Incidents (6)

Read‑only incident context, alert parsing, and correlation.

Tool	Description	Access
incident_summary	Structured incident summary — title, severity, status, affected services, timeline, recommendations.	read
incident_thread_summary	SRE‑focused human‑context summary of a Slack incident thread (no command execution).	read
correlate_alerts	Group alerts by shared service, label affinity, and time proximity.	read
external_status_check	Public status for external providers (e.g. GitHub, AWS) — current status, incidents, history.	read
slack_alerts_list	Recent alerts from a configured Slack channel, parsed into structured incident context.	read
slack_alert_thread_get	Parse a Slack alert thread — replies, commands, links, hypotheses, decisions.	read

Knowledge (5)

Public documentation search, integration setup guidance, and private workspace memory.

Tool	Description	Access
integration_guide	Structured, documentation‑backed setup/verify/troubleshoot guidance for an integration (Kubernetes, Slack, Grafana, Argo CD). Secret‑free command templates only.	read
public_knowledge_search	Search official IncidentFlow documentation and product knowledge.	read
private_knowledge_search	Search authenticated workspace knowledge — incidents, RCAs, postmortems, runbooks, service context.	read
knowledge_get	Retrieve one workspace document deterministically by id, point id, or exact title.	read
knowledge_upsert	Create or update one workspace knowledge document (runbook, incident, RCA, postmortem, note).	write

Meta (4)

Discovery and diagnostics. Excluded from the 44 operational count.

Tool	Description	Access
incidentflow_capabilities	Canonical capability inventory grouped by category, with per‑tool safety metadata.	read
mcp_version	Server version, release tag, build commit, image provenance, environment, and tool counts.	read
incidentflow_auth_status	Authenticated user, active workspace, role, and runtime environment.	read
incidentflow_integrations_status	Which integrations are connected for the active workspace.	read

Schema strictness

Each tool publishes a JSON Schema for its response data. Owned, fully‑typed tools are strict (additionalProperties: false); tools that pass through upstream integration payloads are permissive (upstream fields tolerated). The strict tools today are k8s_agent_status, k8s_rbac_check, incident_thread_summary, knowledge_upsert, and mcp_version. Retrieve any schema from GET /schemas/{schema_id}.