Better Stack MCP

@Better Stack MCP show me all open incidents from the last 24 hours with their current status and assigned responders

Found 3 open incidents in the past 24 hours: 1. **Database connection timeout** (Critical) — Opened 14:32 UTC, assigned to @sarah-ops. Status: Investigating. Affected: api.example.com 2. **Elevated error rate on checkout** (High) — Opened 09:15 UTC, assigned to @payments-team. Status: Identified, deploying fix. 3. **CDN cache miss spike** (Medium) — Opened 22:47 UTC, unassigned. Status: Acknowledged. This is an illustrative example showing how the MCP would surface incident metadata from your Better Stack account.

This example demonstrates read access to incident data. Requires OAuth scope for viewing incidents and team assignments. The MCP pulls live data, so results depend on your account's current state. Useful for daily standups or handoff reviews when you need a quick incident snapshot without opening the dashboard.

@Better Stack MCP create a new incident for 'Payment gateway returning 503 errors' with high severity and assign it to the on-call engineer

Created incident #INC-4782: **Payment gateway returning 503 errors** - Severity: High - Status: Open - Assigned to: @mike-oncall (current on-call rotation) - Created: 2024-01-15 16:42 UTC - Incident URL: https://betterstack.com/team/acme/incidents/4782 Notifications sent to #incidents Slack channel and on-call phone. This example shows the confirmation you'd receive after the MCP executes the create action.

This write action requires OAuth scope for incident creation and team member lookup. The MCP will trigger real notifications (Slack, PagerDuty, SMS) based on your escalation policies — confirm the severity level before running. On-call assignment pulls from your current rotation schedule, so the assigned person changes based on who's active.

@Better Stack MCP analyze the last 30 days of incidents and tell me which services had the most downtime and what the common causes were

Analyzed 47 incidents over the past 30 days: **Most affected services:** 1. api.example.com — 8 incidents, 4.2 hours total downtime 2. checkout.example.com — 5 incidents, 1.8 hours downtime 3. cdn.example.com — 4 incidents, 0.9 hours downtime **Common root causes:** - Database connection pool exhaustion (12 incidents) - Third-party API timeouts (8 incidents) - Memory leaks in Node.js workers (6 incidents) The API service shows a pattern of database-related failures during peak traffic hours. This illustrative summary demonstrates how the MCP pairs incident data with AI reasoning.

This synthesis example combines the MCP's incident retrieval with the AI's pattern-recognition capabilities. Requires read access to historical incident data and metadata (tags, root cause fields). The analysis quality depends on how consistently your team documents incidents — sparse metadata yields generic summaries. Best used for monthly retrospectives or capacity planning discussions.

When Better Stack MCP helps on-call engineers debug faster

A 5-person SRE team gets paged at 3am for a production outage. The on-call engineer opens Switchy, asks the AI to pull the last 2 hours of logs and correlate them with the alert timeline from Better Stack. Because the MCP uses OAuth2, the engineer doesn't fumble with API keys in the middle of the night—they authorized once during onboarding. The AI surfaces the spike in 500 errors 12 minutes before the alert fired, links to the deploy that went out at that timestamp, and suggests the rollback command. This works when your incident response lives in Better Stack and your team is small enough that one shared Switchy workspace covers everyone on-call. If you're running a 24/7 NOC with 40 engineers, you'll want dedicated tooling instead. For teams under 15 people who already use Better Stack for uptime monitoring, this MCP turns your AI into a faster incident co-pilot.

Using Better Stack MCP to prep reliability reports without spreadsheets

A product manager and two backend engineers meet every Monday to review last week's uptime and decide what to fix next. Before the MCP, someone spent 20 minutes screenshotting graphs and copying incident summaries into a Google Doc. Now the PM asks Switchy to pull the week's downtime events, group them by service, and rank by customer impact. The AI queries Better Stack through the MCP, formats the data into a table, and flags the three services that breached the SLA. The OAuth2 flow means the PM doesn't need engineering to set up API access—they connected their Better Stack account once and it works for the whole team. This scenario breaks down if you need custom aggregations or want to blend Better Stack data with Datadog or PagerDuty—then you're writing SQL or Python. For straightforward weekly reviews at teams under 10 people, the MCP saves the prep busywork.

When Better Stack MCP helps support agents answer 'is it down?' faster

A 4-person support team fields tickets from customers asking if the app is down or if it's just them. The support agent opens Switchy, pastes the customer's email, and asks the AI to check Better Stack for incidents affecting that account's region in the last hour. The MCP queries the uptime monitors and incident log, then replies with either 'no incidents, likely a local network issue' or 'yes, API gateway was down for 8 minutes starting at 2:14pm UTC.' The OAuth2 setup means the support lead authorized Better Stack once for the whole team—no per-agent API key juggling. This works when your support volume is under 50 tickets a day and your infrastructure monitoring lives in Better Stack. If you're running a high-touch enterprise support org or need to cross-reference logs from five different tools, you'll want a dedicated status page or a more complex integration. For small teams who want to answer 'is it us?' in under 30 seconds, the MCP delivers.