Skip to content
Agentmart
Submit a tool

Best agent skills for incident response

We found 136 agent skills for incident response in the catalog; these are the 15 that rank highest. The order comes from our rank, which weighs adoption, freshness, documentation and publisher identity. Nobody can pay for a place on this list. alerting-oncall, ai-sre-incident-response and data-breach-response lead it. google-cloud-waf-operational-excellence and campaign-postmortem are published by the company that makes them. alerting-oncall comes from the largest repository here (48,428 stars). 8 of the 15 had activity in the last 30 days. Each entry lists why it made the list and links to its install page.

Updated Oct 26, 2026 · Built from catalog data; how we rank and grade

Top 15 of 136

  1. 1
    alerting-oncall

    devops-skills

    Set up alerting rules, configure on-call rotations, and manage incident response workflows.

    • Largest repository here (48,428 stars)
    • Active in the last 30 days
    • Open source (MIT)

    ★ 48.4KLast active Oct 24, 2026Claude Code, Claude apps, Codex, Cursor +6

  2. 2
    ai-sre-incident-response

    devops-skills

    Build AI-focused SRE incident response practices for LLM outages, degraded quality, runaway cost events, and safety regressions.

    • Largest repository here (48,428 stars)
    • Active in the last 30 days
    • Open source (MIT)

    ★ 48.4KLast active Oct 24, 2026Claude Code, Claude apps, Codex, Cursor +6

  3. 3
    data-breach-response

    The Glass Room

    Data breach incident response with ENISA severity scoring, notification timelines, and compliance tracking.

    • Active in the last 30 days
    • Ships helper scripts
    • For Python

    ★ 976Last active Oct 23, 2026Claude Code, Claude apps, Codex, Cursor +6

  4. 4
    service

    spotify

    Inspect a Spotify Portal service's owner, team, on-call contact, Slack channel, runbook, build, deployment, runtime, incidents, or documentation.

    • Repository has 2.5K stars
    • Open source (Apache-2.0)

    ★ 2.5KLast active Aug 11, 2026Claude Code, Claude apps, Codex, Cursor +6

  5. 5
    gdpr-breach-sentinel-oliver-schmidt-prietz

    Oliver Schmidt-Prietz

    Elite incident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34.

    ★ 895Last active Jul 30, 2026Claude Code, Claude apps, Codex, Cursor +6

  6. 6
    root-cause-analysis

    autohandai

    Produce a written root-cause analysis for an incident, outage, regression, or recurring failure, with a timeline, contributing factors, and prevention actions.

    • Open source (Apache-2.0)

    ★ 210Last active Sep 22, 2026Claude Code, Claude apps, Codex, Cursor +6

  7. 7
    postmortem

    Dimon94

    Recall or record confirmed reusable failure lessons.

    • Ships helper scripts
    • For JavaScript

    ★ 107Last active Sep 4, 2026Claude Code, Claude apps, Codex, Cursor +6

  8. 8
    postmortem-draft

    runxhq

    Turn resolved-incident fragments into a traceable postmortem that separates fragment-cited facts from hypotheses, blocks publication while unknowns remain…

    • Active in the last 30 days
    • Open source (Apache-2.0)
    • Ships helper scripts

    ★ 104Last active Oct 18, 2026Claude Code, Claude apps, Codex, Cursor +6

  9. 9
    dfir

    transilienceai

    Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline…

    • Open source (MIT)

    ★ 591Last active Jun 9, 2026Claude Code, Claude apps, Codex, Cursor +6

  10. 10
    google-cloud-waf-operational-excellence

    googleOfficial

    Generates operational guidance for CI/CD deployment pipelines, observability, monitoring, logging, and incident management on Google Cloud based on the design…

    • Published by the vendor
    • Repository has 21.5K stars
    • Active in the last 30 days

    ★ 21.5KLast active Oct 21, 2026Claude Code, Claude apps, Codex, Cursor +6

  11. 11
    sre-engineer

    https://github.com/Jeffallan

    Defines service level objectives, creates error budget policies, designs incident response procedures, develops capacity models, and produces monitoring…

    • Repository has 12K stars
    • Active in the last 30 days
    • Open source (MIT)

    ★ 12KLast active Oct 16, 2026Claude Code, Claude apps, Codex, Cursor +6

  12. 12
    campaign-postmortem

    zapierOfficial

    Build sourced campaign retrospectives from goals, launch context, performance data, team feedback, and follow-up actions.

    • Published by the vendor
    • Open source (MIT)

    ★ 351Last active May 19, 2026Claude Code, Claude apps, Codex, Cursor +6

  13. 13
    building-incident-response-playbook

    adriannoes

    Designs and documents structured incident response playbooks that define step-by-step procedures for specific incident types aligned with NIST SP 800-61r3 and…

    • Active in the last 30 days
    • Open source (Apache-2.0)
    • Ships helper scripts

    ★ 72Last active Oct 24, 2026Claude Code, Claude apps, Codex, Cursor +6

  14. 14
    bip-infra

    matsen

    Cold-start a long-lived infra session that tracks compute hosts and outages for the whole fleet — verifies outage reports independently, broadcasts status and…

    • Active in the last 30 days
    • Open source (MIT)

    ★ 33Last active Oct 22, 2026Claude Code, Claude apps, Codex, Cursor +6

  15. 15
    js-security-audit

    c0x12c

    Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response.

    ★ 109Last active Jun 18, 2026Claude Code, Claude apps, Codex, Cursor +6

Related