rootly-mcp-server 2.3.4__tar.gz → 2.3.8__tar.gz

{rootly_mcp_server-2.3.4 → rootly_mcp_server-2.3.8}/.github/workflows/dependency-review.yml

@@ -12,4 +12,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Dependency Review
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4

{rootly_mcp_server-2.3.4 → rootly_mcp_server-2.3.8}/.gitignore

@@ -199,4 +199,4 @@ test_output/
 !CONTRIBUTING.md
 !CHANGELOG.md
 .beads/
-.mcp.json
+.claude/

rootly_mcp_server-2.3.8/.mcp.json

@@ -0,0 +1,10 @@
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp",
+      "headers": {
+        "Authorization": "Bearer ${ROOTLY_API_TOKEN}"
+      }
+    }
+  }
+}

{rootly_mcp_server-2.3.4 → rootly_mcp_server-2.3.8}/CHANGELOG.md

@@ -5,69 +5,129 @@ All notable changes to the Rootly MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [2.3.4] - Released 2026-04-30
+## [2.3.8] - Released 2026-05-19
+
+### Security
+
+- **Bearer Auth Enforcement on Hosted Transports**: Required Bearer authentication on MCP transport paths in hosted mode so unauthenticated requests are rejected before any tool dispatch
+- **Upstream Token Validation**: Validated Bearer tokens against the upstream Rootly API before granting MCP access, surfacing malformed or expired credentials at the edge with clearer errors
+- **Dependency Advisories**: Bumped `urllib3` (≥2.7.0), `python-multipart` (≥0.0.27), and `pip` (≥26.1) to resolve five open Dependabot advisories (urllib3 CVE-2026-44431/44432, python-multipart CVE-2026-42561, pip CVE-2026-6357/3219)
+
+### Performance
+
+- **`get_alert_by_short_id` Now O(1)**: Replaced the up-to-20-page sequential scan with a single direct `GET /v1/alerts/{short_id}` point lookup. P95 spikes of 41s on this tool collapse to ~200ms; not-found responses no longer cost 10+ seconds; workspaces with >2,000 alerts no longer silently fail
+- **`get_oncall_handoff_summary` Fan-Out Parallelized**: Replaced sequential per-schedule shift and incident fetches with `asyncio.gather` capped by a `Semaphore(10)`. Worst-case p95 of ~15s on populated workspaces drops to ~1–2s
+- **Lookup-Maps Helper Parallelized**: `_fetch_users_and_schedules_maps` (used by `list_shifts`, `check_responder_availability`, `check_oncall_health_risk`, `create_override_recommendation`, `find_related_incidents`) now runs the three independent resource fetches concurrently with intra-resource page fan-out. Cold-cache worst case drops from ~15s to ~1s — meaningfully more impactful since v2.3.7 made sessions stateless and the in-memory cache is repaid more often
+- **Shared `_fetch_all_pages` Helper Across Five Shift Tools**: `list_shifts`, `get_oncall_schedule_summary`, `check_responder_availability`, `create_override_recommendation`, and `check_oncall_health_risk` now all route through the same paginated, concurrency-capped helper instead of duplicating sequential pagination loops. Each tool saves 2–5s worst case under load
+
+### Fixed
+
+- **`get_oncall_shift_metrics` Silent Data Loss**: The function previously fetched only page 1 of schedules and teams (no pagination loop), causing team-id filtering to silently drop schedules whose teams lived past page 1. Now uses the shared paginated, cached helper so all schedules are considered
+- **OAuth Authorization Server Discovery**: Derived the OAuth authorization server URL from the API base URL so discovery works against staging and self-hosted Rootly instances
+- **OAuth Protected Resource Metadata**: Removed `scopes_supported` from the protected resource metadata, advertised only the granular scopes the resource actually accepts, and included resource-specific scopes for clients that key off them
+- **Pagination Resilience**: `asyncio.gather` callsites that fan out pages now use `return_exceptions=True` with an `isinstance(_, BaseException)` guard so a single transient httpx error on one page no longer aborts the entire handler
+- **Missing `total_pages` Metadata Fallback**: When upstream omits `meta.total_pages`, the helper now falls back to fetching up to `max_pages` (preserving the legacy "keep going until a short page" semantics) instead of silently truncating to page 1
+
+### Dependencies
+
+- **Routine Refresh**: Pulled in the latest minor and patch dependency updates from Dependabot
+- **CI Action Bump**: Updated `actions/dependency-review-action` from 4.9.0 to 5.0.0
+
+### Repo
+
+- **`.claude/` Ignored**: Stopped tracking transient `.claude/worktrees/` directories and added `.claude/` to `.gitignore` so local Claude Code state no longer pollutes diffs
+
+### Testing
+
+- New unit tests for the parallelized fan-out paths, the missing-`total_pages` fallback, exception-tolerance in `asyncio.gather`, the `get_oncall_shift_metrics` pagination regression, and the direct-GET path for `get_alert_by_short_id`
+
+## [2.3.7] - Released 2026-05-08
 
 ### Features
 
-- **Incident Timeline Events Enabled by Default**: Exposed incident timeline event creation in the default MCP write surface so agents can add timeline entries without extra configuration
+- **MCP OAuth2 Authorization Discovery**: Added hosted-only OAuth protected resource metadata and `WWW-Authenticate` discovery headers so compatible MCP clients can discover Rootly's authorization server automatically
+
+### Fixed
+
+- **Hosted Streamable HTTP Session Accumulation**: Defaulted hosted streamable HTTP to stateless mode so the server no longer accumulates long-lived MCP sessions when clients do not explicitly terminate them
+- **Full Hosted HTTP Coverage**: Applied the stateless hosted default to both dual-transport deployments and direct hosted `streamable-http` mode for consistent leak mitigation
+
+### Configuration
+
+- **Hosted Docker Default**: Set `FASTMCP_STATELESS_HTTP=true` in the Docker image so standard hosted deployments use the safer stateless configuration by default while still allowing explicit operator override
+
+### Testing
+
+- **Hosted Transport Coverage**: Added focused tests for hosted stateless defaults and explicit `FASTMCP_STATELESS_HTTP` override behavior across both transport entry paths
+
+## [2.3.6] - Released 2026-05-07
+
+### Features
+
+- **Open Plugins Discovery Support**: Added a root `.mcp.json` so plugin catalogs like cursor.directory can auto-detect the hosted Rootly MCP configuration and generate one-click install flows
 
 ### Dependencies
 
 - **Routine Dependency Refresh**: Pulled in the latest minor and patch dependency updates from Dependabot
 
-## [2.3.2] - Released 2026-04-23
+## [2.3.5] - Released 2026-05-07
 
 ### Fixed
 
-- **Generated Write Payload Forwarding**: Normalized generated OpenAPI write-tool payloads to unwrap top-level `body` envelopes before forwarding to the Rootly API, fixing failures such as `createWorkflow` returning `Invalid payload ({data: "Expected hash"})`
+- **Sequential Incident Reference Resolution**: Added server-side resolution for incident references like `4460`, `#4460`, and `INC-4460`, so callers no longer need to convert sequential incident numbers to UUIDs themselves
+- **Broader Incident Tool Support**: Applied the same reference resolution behavior across `getIncident`, `updateIncident`, `find_related_incidents`, `suggest_solutions`, and the `incident://{incident_id}` resource for a more consistent incident workflow
 
 ### Testing
 
-- **Request-Path Regression Coverage**: Added transport regression tests that assert write requests forward unwrapped JSON payloads and preserve already-correct non-envelope payloads
+- **Incident Reference Coverage**: Added focused test coverage for UUID and sequential incident references, not-found handling, bounded lookup behavior, and the expanded incident tool/resource paths
 
-## [2.3.1] - Released 2026-04-23
+## [2.3.4] - Released 2026-04-30
+
+### Features
+
+- **Incident Timeline Events Enabled by Default**: Enabled creating incident timeline events by default, so timeline entries can now be created through MCP without extra configuration
+
+### Dependencies
+
+- **Routine Dependency Refresh**: Pulled in the latest minor and patch dependency updates from Dependabot
+
+## [2.3.3] - Released 2026-04-23
 
 ### Fixed
 
-- **Create Operations Restored**: Restored missing create operations for workflows, schedules, and configuration resources by expanding `DEFAULT_WRITE_ALLOWED_PATHS` to include collection/base paths (not only `/{id}` update paths)
-- **Write Surface Completeness**: Re-enabled create + update parity across key families including workflows, workflow groups, schedules, escalation policies, services, teams, environments, dashboards, playbooks, monitoring, retrospectives, communications, causes, and catalogs
-- **Test Accuracy**: Corrected alert source tool-name assertions in unit tests (`createAlertSource` / `updateAlertSource`) to prevent false confidence
+- **Schema and Path Interpretation**: Improved how the MCP interprets API schemas and path patterns so more tools can be exposed correctly
+- **Write Path Coverage**: Fixed write-path coverage gaps so generated tools line up more reliably with endpoints that support write actions
+- **Write Availability Guidance**: Improved the guidance returned when a write action is not available for the current endpoint or configuration
+- **Hyphenated Resource Matching**: Tightened path matching so hyphenated resources like `status-pages` are handled correctly
 
-### Notes
+## [2.3.2] - Released 2026-04-23
 
-- `createWorkflow` remains the correct tool name (singular), not `createWorkflows`
-- Security exclusions for sensitive families remain unchanged
+### Fixed
 
-## [2.3.0] - Released 2026-04-23
+- **Generated Write Request Shape**: Fixed how generated MCP tools send create and update requests for API-backed endpoints
+- **Affected Endpoints**: This affected tools tied to endpoints like `/v1/workflows`, `/v1/workflow_groups`, `/v1/schedules`, and other generated write operations that expected a specific request shape
+- **Create Workflow Reliability**: As a result, tools like `createWorkflow` can complete successfully instead of stopping during request submission
 
-### Features
+### Testing
 
-- **Comprehensive API Coverage Expansion**: Expanded MCP tool surface from 124 to 150+ tools by updating to latest Rootly API specification with 95+ operations
-- **Enhanced Tool Discoverability**: Added contextual "WHEN TO USE" guidance to tool descriptions for improved AI agent decision-making
-- **Workflow-Focused Tool Subsets**: Introduced 5 predefined tool configurations optimized for specific use cases (Incident Response, Schedule Management, Monitoring Setup, Retrospectives, Administration)
-- **Operational Context Resources**: Added new MCP resources for real-time operational awareness:
-  - `rootly://oncall-status` - Live on-call status across teams for incident response context
-  - `rootly://workflow-guide` - Step-by-step workflow guidance for common Rootly operations
-- **Expanded Write Operations**: Added 54 non-destructive write operations while maintaining security boundaries
-- **API Path Coverage**: Increased DEFAULT_ALLOWED_PATHS from ~80 to 151 endpoints covering workflows, dashboards, communications, playbooks, and monitoring
+- **Request-Path Regression Coverage**: Added transport regression tests that assert write requests forward unwrapped JSON payloads and preserve already-correct non-envelope payloads
 
-### Enhanced
+## [2.3.1] - Released 2026-04-23
 
-- **Tool Descriptions**: Enhanced incident and on-call tool descriptions with specific usage context and best practices
-- **Environment Configuration**: Improved environment-based tool subset configuration following MCP best practices
-- **Error Handling**: Robust error handling in new resource implementations with proper categorization
+### Fixed
 
-### Documentation
+- **Restored Create Actions**: Restored missing create actions for key configuration endpoints, including workflows, workflow groups, schedules, schedule rotations, escalation policies, escalation paths, services, teams, and environments
+- **Create and Update Parity**: Closed the gap where users could list or update those records but could not create new ones through MCP
+- **Test Accuracy**: Corrected alert source tool-name assertions in unit tests (`createAlertSource` / `updateAlertSource`)
 
-- **README Updates**: Updated tool counts, added workflow subset configurations, and enhanced setup guidance
-- **Configuration Examples**: Added 5 workflow-focused environment configurations for optimal AI performance
-- **API Coverage**: Documented comprehensive endpoint coverage while highlighting security exclusions
+## [2.3.0] - Released 2026-04-23
 
-### Security
+### Features
 
-- **Maintained Boundaries**: Preserved security exclusions for sensitive operations (API keys, user management, webhooks, financial data)
-- **Curated Approach**: Continued read-first philosophy with carefully selected write operations
-- **Input Validation**: Maintained existing security controls and validation patterns
+- **Broader API Coverage**: Expanded the MCP to cover many more Rootly API areas, including workflows, workflow groups, workflow tasks, schedules, schedule rotations, escalation policies, escalation paths, services, teams, environments, dashboards, playbooks, retrospectives, and monitoring-related resources
+- **More Write Actions**: Added more write actions across those areas, especially update actions, so the MCP can do more than just read data
+- **Wider Operational Use**: Made the MCP useful for more operational and configuration work, not just incident search and on-call lookups
+- **Workflow-Focused Tooling**: Introduced workflow-focused tool subsets and supporting resources for common MCP use cases
 
 ### Testing
 

{rootly_mcp_server-2.3.4 → rootly_mcp_server-2.3.8}/Dockerfile

@@ -28,6 +28,7 @@ EXPOSE 8000
 ENV PYTHONUNBUFFERED=1
 ENV FASTMCP_HOST=0.0.0.0
 ENV FASTMCP_PORT=8000
+ENV FASTMCP_STATELESS_HTTP=true
 ENV ROOTLY_TRANSPORT=both
 ENV ROOTLY_LOG_LEVEL=INFO
 

{rootly_mcp_server-2.3.4 → rootly_mcp_server-2.3.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rootly-mcp-server
-Version: 2.3.4
+Version: 2.3.8
 Summary: Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation
 Project-URL: Homepage, https://github.com/Rootly-AI-Labs/Rootly-MCP-server
 Project-URL: Issues, https://github.com/Rootly-AI-Labs/Rootly-MCP-server/issues
@@ -24,14 +24,14 @@ Requires-Python: >=3.12
 Requires-Dist: authlib>=1.6.11
 Requires-Dist: brotli>=1.2.0
 Requires-Dist: cryptography>=46.0.7
-Requires-Dist: fastmcp[code-mode]==3.2.0
+Requires-Dist: fastmcp[code-mode]==3.2.4
 Requires-Dist: httpx==0.28.1
 Requires-Dist: numpy>=1.24.0
-Requires-Dist: pydantic==2.12.5
+Requires-Dist: pydantic==2.13.4
 Requires-Dist: pygments>=2.20.0
 Requires-Dist: python-dotenv>=1.2.2
 Requires-Dist: python-multipart>=0.0.26
-Requires-Dist: requests==2.33.1
+Requires-Dist: requests==2.34.0
 Requires-Dist: scikit-learn>=1.3.0
 Provides-Extra: dev
 Requires-Dist: bandit>=1.7.0; extra == 'dev'

{rootly_mcp_server-2.3.4 → rootly_mcp_server-2.3.8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rootly-mcp-server"
-version = "2.3.4"
+version = "2.3.8"
 description = "Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -36,15 +36,15 @@ classifiers = [
     "License :: OSI Approved :: Apache Software License",
 ]
 dependencies = [
-    "fastmcp[code-mode]==3.2.0",  # Pin to patched version with Code Mode support
+    "fastmcp[code-mode]==3.2.4",  # Pin to patched version with Code Mode support
     "authlib>=1.6.11",  # Override vulnerable transitive authlib (GHSA-jj8c-mmj3-mmgv)
     "python-dotenv>=1.2.2",  # Override vulnerable transitive python-dotenv (GHSA-m8f7-34r5-grfg)
     "python-multipart>=0.0.26",  # Override vulnerable transitive python-multipart (CVE-2026-40347)
     "cryptography>=46.0.7",  # Override vulnerable transitive cryptography
     "Pygments>=2.20.0",  # Override vulnerable transitive Pygments
-    "requests==2.33.1", # Pin to patched version
+    "requests==2.34.0", # Pin to patched version
     "httpx==0.28.1",   # Pin to specific version
-    "pydantic==2.12.5",  # Pin to specific version
+    "pydantic==2.13.4",  # Pin to specific version
     "brotli>=1.2.0",    # For Brotli compression support in httpx
     "scikit-learn>=1.3.0", # For text similarity and ML utilities
     "numpy>=1.24.0",    # For numerical operations

{rootly_mcp_server-2.3.4 → rootly_mcp_server-2.3.8}/src/rootly_mcp_server/__main__.py

@@ -63,6 +63,20 @@ def normalize_transport_or_default(value: str, default: TransportName = "stdio")
         return default
 
 
+def streamable_http_stateless_enabled(*, hosted: bool, fastmcp_stateless_http: bool) -> bool:
+    """Choose streamable HTTP session mode with a safe hosted default.
+
+    Hosted streamable HTTP traffic is high-churn and most clients do not send
+    DELETE to close MCP sessions. On current MCP SDK versions that leaks
+    stateful session transports until process restart. We therefore default
+    hosted deployments to stateless mode unless the operator explicitly sets
+    ``FASTMCP_STATELESS_HTTP``.
+    """
+    if "FASTMCP_STATELESS_HTTP" in os.environ:
+        return fastmcp_stateless_http
+    return hosted
+
+
 def parse_args():
     """Parse command-line arguments."""
     parser = argparse.ArgumentParser(description="Start the Rootly MCP server for API integration.")
@@ -259,7 +273,12 @@ def run_dual_http_server(
     sse_path = fastmcp.settings.sse_path
     streamable_path = fastmcp.settings.streamable_http_path
     message_path = fastmcp.settings.message_path
-    stateless_http = fastmcp.settings.stateless_http
+    stateless_http = streamable_http_stateless_enabled(
+        hosted=True, fastmcp_stateless_http=fastmcp.settings.stateless_http
+    )
+    logger.info(
+        "Streamable HTTP configured in %s mode", "stateless" if stateless_http else "stateful"
+    )
 
     sse_transport = SseServerTransport(message_path)
 
@@ -453,6 +472,11 @@ def main():
                 logger.info("Code Mode enabled at path: %s", code_mode_path)
 
         logger.info(f"Running server with transport: {normalized_transport}...")
+        direct_streamable_stateless_http = streamable_http_stateless_enabled(
+            hosted=hosted_mode,
+            fastmcp_stateless_http=os.getenv("FASTMCP_STATELESS_HTTP", "").lower()
+            in ("true", "1", "yes"),
+        )
         if normalized_transport == "both":
             run_dual_http_server(
                 server=server,
@@ -464,13 +488,16 @@ def main():
         elif normalized_transport == "stdio":
             server.run(transport=normalized_transport)
         else:
-            server.run(
-                transport=normalized_transport,
-                middleware=get_hosted_auth_middleware(),
+            run_kwargs = {
+                "transport": normalized_transport,
+                "middleware": get_hosted_auth_middleware(),
                 # Override FastMCP's default of 0s to allow active SSE connections
                 # to finish gracefully during deployments (avoids 502s).
-                uvicorn_config={"timeout_graceful_shutdown": 30},
-            )
+                "uvicorn_config": {"timeout_graceful_shutdown": 30},
+            }
+            if normalized_transport == "streamable-http":
+                run_kwargs["stateless_http"] = direct_streamable_stateless_http
+            server.run(**run_kwargs)
 
     except FileNotFoundError as e:
         logger.error(f"File not found: {e}")

{rootly_mcp_server-2.3.4 → rootly_mcp_server-2.3.8}/src/rootly_mcp_server/server.py

@@ -25,7 +25,14 @@ from .tools.alerts import register_alert_tools
 from .tools.incidents import register_incident_tools
 from .tools.oncall import register_oncall_tools
 from .tools.resources import register_resource_handlers
-from .utils import sanitize_parameters_in_spec
+from .utils import (
+    OAUTH_PROTECTED_RESOURCE_PATH,
+    auth_header_state,
+    derive_oauth_server_url,
+    is_mcp_server_url_static,
+    resolve_mcp_server_url,
+    sanitize_parameters_in_spec,
+)
 
 # Set up logger
 logger = logging.getLogger(__name__)
@@ -84,15 +91,7 @@ def _fingerprint_auth_header(auth_header: str) -> str:
 
 def _auth_header_state(auth_header: str) -> str:
     """Classify Authorization header shape without exposing token contents."""
-    raw = (auth_header or "").strip()
-    if not raw:
-        return "missing"
-    parts = raw.split(None, 1)
-    if not parts or parts[0].lower() != "bearer":
-        return "invalid_format"
-    if len(parts) == 1 or not parts[1].strip():
-        return "missing_token"
-    return "bearer"
+    return auth_header_state(auth_header)
 
 
 def _validate_bearer_auth_header(auth_header: str) -> str:
@@ -541,6 +540,85 @@ def create_rootly_mcp_server(
 
         return PlainTextResponse("OK")
 
+    # OAuth 2.0 Protected Resource Metadata (RFC 9728)
+    # MCP clients fetch this to discover which authorization server to use.
+    if hosted:
+        from starlette.responses import JSONResponse
+
+        async def _oauth_protected_resource_handler(request):
+            mcp_server_url = resolve_mcp_server_url(request)
+
+            cache = "max-age=3600" if is_mcp_server_url_static() else "no-store"
+            return JSONResponse(
+                {
+                    "resource": mcp_server_url,
+                    "authorization_servers": [derive_oauth_server_url(base_url)],
+                    "scopes_supported": [
+                        "openid",
+                        "profile",
+                        "email",
+                        "ir.incidents:read",
+                        "ir.incidents:write",
+                        "ir.services:read",
+                        "ir.services:write",
+                        "ir.environments:read",
+                        "ir.environments:write",
+                        "ir.functionalities:read",
+                        "ir.functionalities:write",
+                        "ir.severities:read",
+                        "ir.severities:write",
+                        "ir.incident_types:read",
+                        "ir.incident_types:write",
+                        "ir.incident_roles:read",
+                        "ir.incident_roles:write",
+                        "ir.workflows:read",
+                        "ir.workflows:write",
+                        "ir.catalogs:read",
+                        "ir.catalogs:write",
+                        "ir.groups:read",
+                        "ir.groups:write",
+                        "ir.playbooks:read",
+                        "ir.playbooks:write",
+                        "ir.retrospectives:read",
+                        "ir.retrospectives:write",
+                        "ir.status_pages:read",
+                        "ir.status_pages:write",
+                        "ir.form_fields:read",
+                        "ir.form_fields:write",
+                        "ir.pulses:read",
+                        "ir.pulses:write",
+                        "oc.alerts:read",
+                        "oc.alerts:write",
+                        "oc.schedules:read",
+                        "oc.schedules:write",
+                        "oc.escalation_policies:read",
+                        "oc.escalation_policies:write",
+                        "oc.alert_routing_rules:read",
+                        "oc.alert_routing_rules:write",
+                        "oc.heartbeats:read",
+                        "oc.heartbeats:write",
+                        "oc.alert_sources:read",
+                        "oc.alert_sources:write",
+                        "oc.live_call_routing:read",
+                        "oc.live_call_routing:write",
+                        "oc.shift_overrides:read",
+                        "oc.shift_overrides:write",
+                    ],
+                    "bearer_methods_supported": ["header"],
+                },
+                headers={"Cache-Control": cache},
+            )
+
+        # RFC 9728 §5: clients may request the path-suffixed variant first
+        # (e.g. /.well-known/oauth-protected-resource/mcp for a resource at /mcp).
+        @mcp.custom_route(OAUTH_PROTECTED_RESOURCE_PATH + "/{path:path}", methods=["GET"])
+        async def oauth_protected_resource_suffixed(request):
+            return await _oauth_protected_resource_handler(request)
+
+        @mcp.custom_route(OAUTH_PROTECTED_RESOURCE_PATH, methods=["GET"])
+        async def oauth_protected_resource(request):
+            return await _oauth_protected_resource_handler(request)
+
     # Add some custom tools for enhanced functionality
 
     @mcp.tool()

{rootly_mcp_server-2.3.4 → rootly_mcp_server-2.3.8}/src/rootly_mcp_server/server_defaults.py

@@ -349,6 +349,7 @@ DEFAULT_WRITE_ALLOWED_PATHS = [
     # Incident mutations
     "/alert_events/{id}",
     "/incidents/{incident_id}/action_items",
+    "/incidents/{incident_id}/events",
     "/incidents/{incident_id}/form_field_selections",
     "/incident_form_field_selections/{id}",
     # On-call schedules - create + update

rootly_mcp_server-2.3.8/src/rootly_mcp_server/tools/alerts.py

@@ -0,0 +1,87 @@
+"""Alert tool registration for Rootly MCP server."""
+
+from __future__ import annotations
+
+from collections.abc import Awaitable, Callable
+from typing import Annotated, Any, Protocol
+from urllib.parse import quote
+
+from pydantic import Field
+
+JsonDict = dict[str, Any]
+MakeAuthenticatedRequest = Callable[..., Awaitable[Any]]
+
+
+class MCPErrorLike(Protocol):
+    """Protocol for MCP error helpers used by alert tools."""
+
+    @staticmethod
+    def tool_error(
+        error_message: str,
+        error_type: str = "execution_error",
+        details: dict[str, Any] | None = None,
+    ) -> JsonDict: ...
+
+    @staticmethod
+    def categorize_error(exception: Exception) -> tuple[str, str]: ...
+
+
+def register_alert_tools(
+    mcp: Any,
+    make_authenticated_request: MakeAuthenticatedRequest,
+    mcp_error: MCPErrorLike,
+) -> None:
+    """Register alert tools on the MCP server."""
+
+    @mcp.tool()
+    async def get_alert_by_short_id(
+        short_id: Annotated[
+            str,
+            Field(
+                description="The alert short_id (e.g., 'PhIQtP') or full alert URL (e.g., 'https://rootly.com/account/alerts/PhIQtP')"
+            ),
+        ],
+    ) -> JsonDict:
+        """Get alert details by short_id or alert URL. Use this when a user pastes an alert URL or short_id from a pager notification and wants to investigate the alert."""
+        try:
+            alert_short_id = short_id.strip()
+            if "/" in alert_short_id:
+                alert_short_id = alert_short_id.rstrip("/").split("/")[-1]
+
+            if not alert_short_id:
+                return mcp_error.tool_error("short_id is required", "validation_error")
+
+            # GET /v1/alerts/{id} accepts the short_id as well as the UUID
+            # (undocumented but supported), so a single point lookup avoids
+            # listing/filtering altogether.
+            response = await make_authenticated_request(
+                "GET", f"/v1/alerts/{quote(alert_short_id, safe='')}"
+            )
+            if response.status_code == 404:
+                return mcp_error.tool_error(
+                    f"Alert with short_id '{alert_short_id}' not found",
+                    "not_found",
+                )
+            response.raise_for_status()
+
+            data = response.json().get("data", {})
+            attrs = data.get("attributes", {})
+            return {
+                "id": data.get("id"),
+                "short_id": attrs.get("short_id"),
+                "summary": attrs.get("summary"),
+                "status": attrs.get("status"),
+                "source": attrs.get("source"),
+                "description": attrs.get("description"),
+                "started_at": attrs.get("started_at"),
+                "ended_at": attrs.get("ended_at"),
+                "noise": attrs.get("noise"),
+                "url": attrs.get("url"),
+                "created_at": attrs.get("created_at"),
+            }
+
+        except Exception as e:
+            error_type, error_message = mcp_error.categorize_error(e)
+            return mcp_error.tool_error(
+                f"Failed to get alert by short_id: {error_message}", error_type
+            )