AI agent tools for incident response
In this catalog, an incident response tool is one that helps triage alerts, investigate outages and write postmortems. Our enrichment pass tags 77 listings with it: 33 MCP servers, 15 agent skills, 2 plugins and 27 AI agents. By listing rank, the top MCP server is Netdata, the top agent skill is alerting-oncall and the top AI agent is HolmesGPT. 16 of the 77 are published by the vendor behind the product, and 48 were active in the last 30 days. 10 of the 33 MCP servers run only as remote servers, with nothing to install locally. Each entry below links to its listing page, with grades, install commands and sources.
Updated Oct 26, 2026 · Built from catalog data; how we rank and grade
What the job is
- Tagged listings
- 77
- By type
- 33 MCP servers, 15 agent skills, 2 plugins and 27 AI agents
- Published by the vendor
- 16 of 77
- Active in the last 30 days
- 48 of 77
- Open source
- 48 of 77
- MCP servers that run only remotely
- 10 of 33
- Hosts named by the MCP servers
- Claude Code (32), Cursor (32), VS Code (32)
Building blocks by type
The top entries of each type, by listing rank. Open a listing for its install command, grades and sources.
MCP servers 33 tagged
- 1Netdata
netdata
Real-time infrastructure monitoring with metrics, logs, alerts, and ML-based anomaly detection.
- Most GitHub stars here (81,116)
- Remote server, no local install
- Active in the last 30 days
★ 81.1KLast active Oct 23, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf
AFreshness: A–Security: not graded yet - 2
OneUptimeoneuptime.comOfficial
Manage incidents, alerts, monitors, status pages, on-call and telemetry in OneUptime.
- Published by the vendor
- 7.8K GitHub stars
- Remote server, no local install
★ 7.8KLast active Oct 26, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf
AFreshness: A–Security: not graded yet - 3openstatus
openstatus.devOfficial
Manage monitors, status pages, incidents and maintenances in your openstatus workspace.
- Published by the vendor
- 9.2K GitHub stars
- Remote server, no local install
★ 9.2KLast active Oct 24, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf
AFreshness: A–Security: not graded yet - 4Rootly
rootly.comOfficial
Incident management, on-call scheduling, and intelligent analysis powered by Rootly.
- Published by the vendor
- Most weekly downloads here (1.2K)
- Runs locally or as a remote server
★ 45↓ 1.2K/wkLast active Oct 24, 2026Local (stdio), Remote (SSE)Claude Code, VS Code, Codex, Cursor +2
AFreshness: A–Security: not graded yet - 5Superlog
superlog.shOfficial
Open-source agent that observes and fixes your application.
- Published by the vendor
- 1.5K GitHub stars
- Remote server, no local install
★ 1.5KLast active Oct 15, 2026Remote (HTTP)Claude Code, VS Code, Cursor, Windsurf
AFreshness: A–Security: not graded yet
Agent skills 15 tagged
- 1alerting-oncall
devops-skills
Set up alerting rules, configure on-call rotations, and manage incident response workflows.
- Repository has 48.4K stars
- Active in the last 30 days
- Open source (MIT)
★ 48.4KLast active Oct 24, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 2secops-cases
Google LLCOfficial
Manage Google Security Operations (SecOps) SOAR cases throughout their lifecycle.
- Published by the vendor
- Repository has 21.5K stars
- Active in the last 30 days
★ 21.5KLast active Oct 22, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 3childhood
thedotmack
Babysit a shipped release after merge, publication, or deployment.
- Largest repository here (102,760 stars)
- Active in the last 30 days
- Open source (Apache-2.0)
★ 102.8KLast active Oct 23, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 4security-advisory
modelcontextprotocolOfficial
Take a privately reported vulnerability through this repo's security advisory flow: board it as a draft card, check whether the code is this repo's server or…
- Published by the vendor
- Repository has 91.5K stars
- Active in the last 30 days
★ 91.5KLast active Oct 19, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet - 5triage-frontend-issues
getsentryOfficial
Triage new issues in the Sentry `javascript` project by archiving non-actionable noise.
- Published by the vendor
- Repository has 1.1K stars
- Active in the last 30 days
★ 1.1KLast active Sep 28, 2026Claude Code, Claude apps, Codex, Cursor +6
AFreshness: A–Security: not graded yet
Plugins 2 tagged
- 1
Nimbus — On-Call & Incident Agentnimbus-agent
Private, local-first agent for on-call & platform engineers — /incident, /deploys, /owns, /blast grounded in your own index, with a signed, verifiable record…
- Active in the last 30 days
- Open source (MIT)
Last active Oct 4, 2026VS Code, Cursor, Windsurf, VSCodium
AFreshness: A–Security: not graded yet - 2
IronShiftIronShift
Your AI-powered cloud infrastructure copilot.
- Most GitHub stars here (4)
- Open source (MIT)
★ 4Last active Apr 6, 2026VS Code, Cursor, Windsurf, VSCodium
DFreshness: D–Security: not graded yet
AI agents 27 tagged
- 1HolmesGPT
Robusta
Open-source agent that investigates production incidents and finds root causes across Kubernetes, cloud and SaaS data sources.
- Most GitHub stars here (3,678)
- Active in the last 30 days
- Open source (Apache-2.0)
★ 3.7KLast active Oct 22, 2026
AFreshness: A–Security: not graded yet - 2ongrid
ongridio
Ops agent that finds the root cause of infrastructure problems, can fix them, and runs from Slack, Telegram or Lark
- 1.2K GitHub stars
- Active in the last 30 days
- Open source (AGPL-3.0)
★ 1.2KLast active Oct 22, 2026
AFreshness: A–Security: not graded yet - 3aurora
Arvo-AI
Open-source AI agent that investigates cloud and Kubernetes incidents, writes root-cause analyses and drafts fix pull requests.
- Active in the last 30 days
- Open source (Apache-2.0)
★ 443Last active Oct 23, 2026
AFreshness: A–Security: not graded yet - 4outage.me
Smart Signals LLC
Live outage, provider-reliability and exploited-vulnerability intelligence for cloud and SaaS, from official provider status pages and CISA/FIRST/NVD.
CFreshness: C–Security: not graded yet - 5Agent Rescue Desk Production Triage Agent
Agent Rescue Desk
Stateless production-failure triage for sanitized n8n, MCP, webhook, retry, and AI agent tool-routing incidents, with a fixed-scope rescue path when static…
CFreshness: C–Security: not graded yet
For business buyers: agents with stated pricing
Only agents whose listing states pricing are shown, with what the listing says. Check the publisher's pricing page before you buy.
| Agent | Pricing in its listing | Source |
|---|---|---|
| Charlotte AICrowdStrike | Usage-based; pricing page checked Oct 2026 | Pricing page |
| NeuBird HawkeyeNeuBird | Usage-based; $0 per month; pricing page checked Oct 2026 | Pricing page |
| AWS DevOps AgentAmazon Web Services | Usage-based with a free tier; pricing page checked Oct 2026 | Pricing page |
| PagerDuty AI AgentsPagerDuty | Paid; $415 per month; pricing page checked Oct 2026 | Pricing page |
Questions
- What are the top tools for incident response?
- By listing rank, the top MCP server is Netdata, the top agent skill is alerting-oncall and the top AI agent is HolmesGPT. Rank weighs adoption, freshness, documentation and publisher identity; money never changes it.
- How many tools does the catalog list for incident response?
- 77 listings are tagged for it: 33 MCP servers, 15 agent skills, 2 plugins and 27 AI agents. Tags come from an automated enrichment pass over the top-ranked listings, so tools outside that pass are not counted.
- Which AI apps do the MCP servers work with?
- Of the 33 MCP servers, 32 list Claude Code, 32 list Cursor and 32 list VS Code as a supported host. Open a listing for its install command and the other hosts it names.
- Do the AI agents for incident response cost money?
- Pricing is stated for 4 of the 27 agents: Charlotte AI (usage-based), NeuBird Hawkeye (usage-based), AWS DevOps Agent (usage-based with a free tier). The other agents state no pricing in their listings.
77 listings are tagged for this use case; the lists above show the top entries.