rootly-mcp-server 2.3.7__tar.gz → 2.3.9__tar.gz

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.9}/.github/workflows/dependency-review.yml

@@ -12,4 +12,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Dependency Review
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.9}/.gitignore

@@ -199,3 +199,4 @@ test_output/
 !CONTRIBUTING.md
 !CHANGELOG.md
 .beads/
+.claude/

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.9}/CHANGELOG.md

@@ -5,6 +5,61 @@ All notable changes to the Rootly MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.3.9] - Released 2026-05-21
+
+### Performance
+
+- **Hosted Default Tool Surface Slimmed**: Default hosted deployments now expose a curated core profile of 55 high-usage tools instead of the full 200+ tool surface, improving MCP client tool-discovery performance while preserving a broad self-hosted default
+- **Hosted and Self-Hosted Defaults Split**: Hosted/serverless instances now default to the slim allowlist, while local and self-hosted deployments continue to expose the full tool catalog unless explicitly overridden
+
+### Configuration
+
+- **Hosted Allowlist Override Behavior**: `ROOTLY_MCP_ENABLED_TOOLS` now cleanly overrides the hosted default profile when operators want a narrower or broader remote tool surface
+
+### Documentation
+
+- **README Deployment Guidance Updated**: Documented the new hosted-versus-self-hosted tool defaults, the hosted override behavior, and the current approximate tool counts for each mode
+
+### Dependencies
+
+- **Lockfile Sync**: Regenerated `uv.lock` so the lockfile matches the current pinned versions in `pyproject.toml`, including `requests==2.34.0` and `pydantic==2.13.4`
+
+## [2.3.8] - Released 2026-05-19
+
+### Security
+
+- **Bearer Auth Enforcement on Hosted Transports**: Required Bearer authentication on MCP transport paths in hosted mode so unauthenticated requests are rejected before any tool dispatch
+- **Upstream Token Validation**: Validated Bearer tokens against the upstream Rootly API before granting MCP access, surfacing malformed or expired credentials at the edge with clearer errors
+- **Dependency Advisories**: Bumped `urllib3` (≥2.7.0), `python-multipart` (≥0.0.27), and `pip` (≥26.1) to resolve five open Dependabot advisories (urllib3 CVE-2026-44431/44432, python-multipart CVE-2026-42561, pip CVE-2026-6357/3219)
+
+### Performance
+
+- **`get_alert_by_short_id` Now O(1)**: Replaced the up-to-20-page sequential scan with a single direct `GET /v1/alerts/{short_id}` point lookup. P95 spikes of 41s on this tool collapse to ~200ms; not-found responses no longer cost 10+ seconds; workspaces with >2,000 alerts no longer silently fail
+- **`get_oncall_handoff_summary` Fan-Out Parallelized**: Replaced sequential per-schedule shift and incident fetches with `asyncio.gather` capped by a `Semaphore(10)`. Worst-case p95 of ~15s on populated workspaces drops to ~1–2s
+- **Lookup-Maps Helper Parallelized**: `_fetch_users_and_schedules_maps` (used by `list_shifts`, `check_responder_availability`, `check_oncall_health_risk`, `create_override_recommendation`, `find_related_incidents`) now runs the three independent resource fetches concurrently with intra-resource page fan-out. Cold-cache worst case drops from ~15s to ~1s — meaningfully more impactful since v2.3.7 made sessions stateless and the in-memory cache is repaid more often
+- **Shared `_fetch_all_pages` Helper Across Five Shift Tools**: `list_shifts`, `get_oncall_schedule_summary`, `check_responder_availability`, `create_override_recommendation`, and `check_oncall_health_risk` now all route through the same paginated, concurrency-capped helper instead of duplicating sequential pagination loops. Each tool saves 2–5s worst case under load
+
+### Fixed
+
+- **`get_oncall_shift_metrics` Silent Data Loss**: The function previously fetched only page 1 of schedules and teams (no pagination loop), causing team-id filtering to silently drop schedules whose teams lived past page 1. Now uses the shared paginated, cached helper so all schedules are considered
+- **OAuth Authorization Server Discovery**: Derived the OAuth authorization server URL from the API base URL so discovery works against staging and self-hosted Rootly instances
+- **OAuth Protected Resource Metadata**: Removed `scopes_supported` from the protected resource metadata, advertised only the granular scopes the resource actually accepts, and included resource-specific scopes for clients that key off them
+- **Pagination Resilience**: `asyncio.gather` callsites that fan out pages now use `return_exceptions=True` with an `isinstance(_, BaseException)` guard so a single transient httpx error on one page no longer aborts the entire handler
+- **Missing `total_pages` Metadata Fallback**: When upstream omits `meta.total_pages`, the helper now falls back to fetching up to `max_pages` (preserving the legacy "keep going until a short page" semantics) instead of silently truncating to page 1
+
+### Dependencies
+
+- **Routine Refresh**: Pulled in the latest minor and patch dependency updates from Dependabot
+- **CI Action Bump**: Updated `actions/dependency-review-action` from 4.9.0 to 5.0.0
+
+### Repo
+
+- **`.claude/` Ignored**: Stopped tracking transient `.claude/worktrees/` directories and added `.claude/` to `.gitignore` so local Claude Code state no longer pollutes diffs
+
+### Testing
+
+- New unit tests for the parallelized fan-out paths, the missing-`total_pages` fallback, exception-tolerance in `asyncio.gather`, the `get_oncall_shift_metrics` pagination regression, and the direct-GET path for `get_alert_by_short_id`
+
 ## [2.3.7] - Released 2026-05-08
 
 ### Features

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.9}/Dockerfile

@@ -18,6 +18,13 @@ COPY . .
 # Install the package and its dependencies
 RUN uv pip install --system --no-cache-dir -e .
 
+# Install MCPcat for hosted telemetry without changing the repo dependency graph.
+# MCPcat's current package metadata pins an older Pydantic range, but the SDK
+# imports successfully with our runtime pin, so we restore the server's pinned
+# version after installation.
+RUN uv pip install --system --no-cache-dir mcpcat==0.1.14 \
+    && uv pip install --system --no-cache-dir pydantic==2.13.4
+
 # Create non-root user
 RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /app
 

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rootly-mcp-server
-Version: 2.3.7
+Version: 2.3.9
 Summary: Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation
 Project-URL: Homepage, https://github.com/Rootly-AI-Labs/Rootly-MCP-server
 Project-URL: Issues, https://github.com/Rootly-AI-Labs/Rootly-MCP-server/issues
@@ -27,11 +27,11 @@ Requires-Dist: cryptography>=46.0.7
 Requires-Dist: fastmcp[code-mode]==3.2.4
 Requires-Dist: httpx==0.28.1
 Requires-Dist: numpy>=1.24.0
-Requires-Dist: pydantic==2.13.3
+Requires-Dist: pydantic==2.13.4
 Requires-Dist: pygments>=2.20.0
 Requires-Dist: python-dotenv>=1.2.2
 Requires-Dist: python-multipart>=0.0.26
-Requires-Dist: requests==2.33.1
+Requires-Dist: requests==2.34.0
 Requires-Dist: scikit-learn>=1.3.0
 Provides-Extra: dev
 Requires-Dist: bandit>=1.7.0; extra == 'dev'
@@ -65,7 +65,21 @@ Use the hosted MCP server. No local installation required.
 
 ### General Remote Setup
 
-Default remote config (HTTP streamable):
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+Your MCP client handles OAuth2 login automatically — a browser window opens for you to authenticate with Rootly. No API token needed.
+
+**With API Token:**
 
 ```json
 {
@@ -86,10 +100,7 @@ SSE (alternative):
 {
   "mcpServers": {
     "rootly": {
-      "url": "https://mcp.rootly.com/sse",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/sse"
     }
   }
 }
@@ -101,10 +112,7 @@ Code Mode:
 {
   "mcpServers": {
     "rootly": {
-      "url": "https://mcp.rootly.com/mcp-codemode",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/mcp-codemode"
     }
   }
 }
@@ -117,47 +125,35 @@ Code Mode:
 
 <br>
 
-**Streamable HTTP**
+**With OAuth2 (recommended):**
 
 ```bash
-claude mcp add --transport http rootly https://mcp.rootly.com/mcp \
-  --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
-```
-
-Code Mode:
+claude mcp add --transport http rootly https://mcp.rootly.com/mcp
 
-```bash
-claude mcp add rootly-codemode --transport http https://mcp.rootly.com/mcp-codemode \
-  --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
+# Code Mode:
+claude mcp add --transport http rootly-codemode https://mcp.rootly.com/mcp-codemode
 ```
 
-SSE (alternative):
+**With API Token:**
 
 ```bash
-claude mcp add --transport sse rootly-sse https://mcp.rootly.com/sse \
+claude mcp add --transport http rootly https://mcp.rootly.com/mcp \
   --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
 ```
 
-**Manual Configuration**
-
-Create `.mcp.json` in your project root:
+**Manual Configuration** — Create `.mcp.json` in your project root:
 
 ```json
 {
   "mcpServers": {
     "rootly": {
       "type": "http",
-      "url": "https://mcp.rootly.com/mcp",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/mcp"
     }
   }
 }
 ```
 
-Restart Claude Code after updating the config.
-
 </details>
 
 <details>
@@ -196,6 +192,20 @@ Or configure manually in `~/.gemini/settings.json`:
 
 Add to `.cursor/mcp.json` or `~/.cursor/mcp.json`:
 
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+**With API Token:**
+
 ```json
 {
   "mcpServers": {
@@ -218,6 +228,20 @@ Add to `.cursor/mcp.json` or `~/.cursor/mcp.json`:
 
 Add to `~/.codeium/windsurf/mcp_config.json`:
 
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "serverUrl": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+**With API Token:**
+
 ```json
 {
   "mcpServers": {
@@ -240,6 +264,15 @@ Add to `~/.codeium/windsurf/mcp_config.json`:
 
 Add to `~/.codex/config.toml`:
 
+**With OAuth2 (recommended):**
+
+```toml
+[mcp_servers.rootly]
+url = "https://mcp.rootly.com/mcp"
+```
+
+**With API Token:**
+
 ```toml
 [mcp_servers.rootly]
 url = "https://mcp.rootly.com/mcp"
@@ -253,9 +286,23 @@ bearer_token_env_var = "ROOTLY_API_TOKEN"
 
 <br>
 
+**With OAuth2 (recommended):**
+
 Add to `claude_desktop_config.json`:
 
-> **Note:** The `--transport http` flag ensures HTTP streamable transport is used instead of auto-falling back to SSE.
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+Claude Desktop handles OAuth2 login automatically.
+
+**With API Token (via mcp-remote):**
 
 ```json
 {
@@ -350,7 +397,14 @@ Choose one transport per server process:
 - **SSE** endpoint path: `/sse`
 - **Code Mode (experimental)** endpoint path: `/mcp-codemode` in hosted dual-transport mode
 
-Both hosted and self-hosted deployments expose the same curated tool surface by default, including the default write-enabled tools. To restrict that surface to read-only tools, start the server with `--no-enable-write-tools` or set `ROOTLY_MCP_ENABLE_WRITE_TOOLS=false`.
+Hosted and self-hosted deployments now have different defaults:
+
+- Hosted defaults to a slim core profile of about 50-60 high-usage tools for better MCP client performance.
+- Self-hosted keeps the full tool surface by default.
+
+To restrict either deployment to read-only tools, start the server with `--no-enable-write-tools` or set `ROOTLY_MCP_ENABLE_WRITE_TOOLS=false`.
+
+To override the hosted default core profile, set `ROOTLY_MCP_ENABLED_TOOLS` (or pass `--enabled-tools`) with a comma-separated allowlist of exact tool names. When that variable is set, it fully replaces the default hosted selection.
 
 To expose only a specific subset of MCP tools on a self-hosted deployment, set `ROOTLY_MCP_ENABLED_TOOLS` (or pass `--enabled-tools`) with a comma-separated allowlist of exact tool names, for example `list_incidents,getIncident,get_server_version`.
 
@@ -418,13 +472,13 @@ docker run -p 8000:8000 \
 
 ## Workflow-Focused Tool Subsets
 
-With 150+ tools available, you may want to configure focused subsets for optimal AI agent performance. Use `ROOTLY_MCP_ENABLED_TOOLS` to activate specific workflows:
+The full self-hosted surface exposes 200+ tools, while hosted defaults to a slim core profile. If you want even tighter workflow-specific subsets, use `ROOTLY_MCP_ENABLED_TOOLS`:
 
 ### 🚨 Incident Response (25 tools)
 *Essential tools for emergency responders and incident commanders*
 
 ```bash
-ROOTLY_MCP_ENABLED_TOOLS="listIncidents,getIncident,createIncident,updateIncident,search_incidents,find_related_incidents,suggest_solutions,createIncidentActionItem,listIncidentActionItems,updateIncidentFormFieldSelection,listTeams,getCurrentUser,listServices,listSeverities,getAlert,listAlerts,updateAlert,listEscalationPolicies,getEscalationPolicy,listOnCallRoles,listSchedules,getScheduleShifts,get_oncall_handoff_summary,get_shift_incidents,list_endpoints"
+ROOTLY_MCP_ENABLED_TOOLS="list_incidents,getIncident,createIncident,updateIncident,search_incidents,find_related_incidents,suggest_solutions,createIncidentActionItem,listIncidentActionItems,updateIncidentFormFieldSelection,listTeams,getCurrentUser,listServices,listSeverities,getAlert,listAlerts,updateAlert,listEscalationPolicies,getEscalationPolicy,listOnCallRoles,listSchedules,getScheduleShifts,get_oncall_handoff_summary,get_shift_incidents,list_endpoints"
 ```
 
 ### 📅 On-Call Management (35 tools)  
@@ -452,7 +506,7 @@ ROOTLY_MCP_ENABLED_TOOLS="getIncident,updateIncident,find_related_incidents,sugg
 *For leadership and metrics teams (read-only focus)*
 
 ```bash
-ROOTLY_MCP_ENABLED_TOOLS="listIncidents,search_incidents,collect_incidents,listTeams,listServices,listSchedules,get_oncall_shift_metrics,get_shift_incidents,listDashboards,getDashboard,listAlerts,listHeartbeats,listPulses,getCurrentUser,list_endpoints"
+ROOTLY_MCP_ENABLED_TOOLS="list_incidents,search_incidents,collect_incidents,listTeams,listServices,listSchedules,get_oncall_shift_metrics,get_shift_incidents,listDashboards,getDashboard,listAlerts,listHeartbeats,listPulses,getCurrentUser,list_endpoints"
 ```
 
 ### Multiple MCP Instances for Different Teams
@@ -466,7 +520,7 @@ You can run multiple MCP instances with different tool subsets:
       "command": "uvx", "args": ["--from", "rootly-mcp-server", "rootly-mcp-server"],
       "env": {
         "ROOTLY_API_TOKEN": "<token>",
-        "ROOTLY_MCP_ENABLED_TOOLS": "listIncidents,getIncident,createIncident,find_related_incidents,suggest_solutions..."
+        "ROOTLY_MCP_ENABLED_TOOLS": "list_incidents,getIncident,createIncident,find_related_incidents,suggest_solutions..."
       }
     },
     "rootly-oncall-management": {
@@ -514,7 +568,10 @@ You can run multiple MCP instances with different tool subsets:
 
 ## Supported Tools
 
-The default server configuration exposes **150+ tools**.
+The default tool surface depends on deployment mode:
+
+- Hosted default: about **56 tools**
+- Self-hosted default: about **218 tools**
 
 ### Custom Agentic Tools
 
@@ -610,7 +667,7 @@ listIncidentActionItems
 listIncidentAlerts
 listIncidentFormFieldSelections
 listIncident_Types
-listIncidents
+listIncidents  (deprecated alias — use `list_incidents`)
 listOnCallRoles
 listOnCallShadows
 listOverrideShifts

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.9}/README.md

@@ -21,7 +21,21 @@ Use the hosted MCP server. No local installation required.
 
 ### General Remote Setup
 
-Default remote config (HTTP streamable):
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+Your MCP client handles OAuth2 login automatically — a browser window opens for you to authenticate with Rootly. No API token needed.
+
+**With API Token:**
 
 ```json
 {
@@ -42,10 +56,7 @@ SSE (alternative):
 {
   "mcpServers": {
     "rootly": {
-      "url": "https://mcp.rootly.com/sse",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/sse"
     }
   }
 }
@@ -57,10 +68,7 @@ Code Mode:
 {
   "mcpServers": {
     "rootly": {
-      "url": "https://mcp.rootly.com/mcp-codemode",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/mcp-codemode"
     }
   }
 }
@@ -73,47 +81,35 @@ Code Mode:
 
 <br>
 
-**Streamable HTTP**
+**With OAuth2 (recommended):**
 
 ```bash
-claude mcp add --transport http rootly https://mcp.rootly.com/mcp \
-  --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
-```
-
-Code Mode:
+claude mcp add --transport http rootly https://mcp.rootly.com/mcp
 
-```bash
-claude mcp add rootly-codemode --transport http https://mcp.rootly.com/mcp-codemode \
-  --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
+# Code Mode:
+claude mcp add --transport http rootly-codemode https://mcp.rootly.com/mcp-codemode
 ```
 
-SSE (alternative):
+**With API Token:**
 
 ```bash
-claude mcp add --transport sse rootly-sse https://mcp.rootly.com/sse \
+claude mcp add --transport http rootly https://mcp.rootly.com/mcp \
   --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
 ```
 
-**Manual Configuration**
-
-Create `.mcp.json` in your project root:
+**Manual Configuration** — Create `.mcp.json` in your project root:
 
 ```json
 {
   "mcpServers": {
     "rootly": {
       "type": "http",
-      "url": "https://mcp.rootly.com/mcp",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/mcp"
     }
   }
 }
 ```
 
-Restart Claude Code after updating the config.
-
 </details>
 
 <details>
@@ -152,6 +148,20 @@ Or configure manually in `~/.gemini/settings.json`:
 
 Add to `.cursor/mcp.json` or `~/.cursor/mcp.json`:
 
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+**With API Token:**
+
 ```json
 {
   "mcpServers": {
@@ -174,6 +184,20 @@ Add to `.cursor/mcp.json` or `~/.cursor/mcp.json`:
 
 Add to `~/.codeium/windsurf/mcp_config.json`:
 
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "serverUrl": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+**With API Token:**
+
 ```json
 {
   "mcpServers": {
@@ -196,6 +220,15 @@ Add to `~/.codeium/windsurf/mcp_config.json`:
 
 Add to `~/.codex/config.toml`:
 
+**With OAuth2 (recommended):**
+
+```toml
+[mcp_servers.rootly]
+url = "https://mcp.rootly.com/mcp"
+```
+
+**With API Token:**
+
 ```toml
 [mcp_servers.rootly]
 url = "https://mcp.rootly.com/mcp"
@@ -209,9 +242,23 @@ bearer_token_env_var = "ROOTLY_API_TOKEN"
 
 <br>
 
+**With OAuth2 (recommended):**
+
 Add to `claude_desktop_config.json`:
 
-> **Note:** The `--transport http` flag ensures HTTP streamable transport is used instead of auto-falling back to SSE.
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+Claude Desktop handles OAuth2 login automatically.
+
+**With API Token (via mcp-remote):**
 
 ```json
 {
@@ -306,7 +353,14 @@ Choose one transport per server process:
 - **SSE** endpoint path: `/sse`
 - **Code Mode (experimental)** endpoint path: `/mcp-codemode` in hosted dual-transport mode
 
-Both hosted and self-hosted deployments expose the same curated tool surface by default, including the default write-enabled tools. To restrict that surface to read-only tools, start the server with `--no-enable-write-tools` or set `ROOTLY_MCP_ENABLE_WRITE_TOOLS=false`.
+Hosted and self-hosted deployments now have different defaults:
+
+- Hosted defaults to a slim core profile of about 50-60 high-usage tools for better MCP client performance.
+- Self-hosted keeps the full tool surface by default.
+
+To restrict either deployment to read-only tools, start the server with `--no-enable-write-tools` or set `ROOTLY_MCP_ENABLE_WRITE_TOOLS=false`.
+
+To override the hosted default core profile, set `ROOTLY_MCP_ENABLED_TOOLS` (or pass `--enabled-tools`) with a comma-separated allowlist of exact tool names. When that variable is set, it fully replaces the default hosted selection.
 
 To expose only a specific subset of MCP tools on a self-hosted deployment, set `ROOTLY_MCP_ENABLED_TOOLS` (or pass `--enabled-tools`) with a comma-separated allowlist of exact tool names, for example `list_incidents,getIncident,get_server_version`.
 
@@ -374,13 +428,13 @@ docker run -p 8000:8000 \
 
 ## Workflow-Focused Tool Subsets
 
-With 150+ tools available, you may want to configure focused subsets for optimal AI agent performance. Use `ROOTLY_MCP_ENABLED_TOOLS` to activate specific workflows:
+The full self-hosted surface exposes 200+ tools, while hosted defaults to a slim core profile. If you want even tighter workflow-specific subsets, use `ROOTLY_MCP_ENABLED_TOOLS`:
 
 ### 🚨 Incident Response (25 tools)
 *Essential tools for emergency responders and incident commanders*
 
 ```bash
-ROOTLY_MCP_ENABLED_TOOLS="listIncidents,getIncident,createIncident,updateIncident,search_incidents,find_related_incidents,suggest_solutions,createIncidentActionItem,listIncidentActionItems,updateIncidentFormFieldSelection,listTeams,getCurrentUser,listServices,listSeverities,getAlert,listAlerts,updateAlert,listEscalationPolicies,getEscalationPolicy,listOnCallRoles,listSchedules,getScheduleShifts,get_oncall_handoff_summary,get_shift_incidents,list_endpoints"
+ROOTLY_MCP_ENABLED_TOOLS="list_incidents,getIncident,createIncident,updateIncident,search_incidents,find_related_incidents,suggest_solutions,createIncidentActionItem,listIncidentActionItems,updateIncidentFormFieldSelection,listTeams,getCurrentUser,listServices,listSeverities,getAlert,listAlerts,updateAlert,listEscalationPolicies,getEscalationPolicy,listOnCallRoles,listSchedules,getScheduleShifts,get_oncall_handoff_summary,get_shift_incidents,list_endpoints"
 ```
 
 ### 📅 On-Call Management (35 tools)  
@@ -408,7 +462,7 @@ ROOTLY_MCP_ENABLED_TOOLS="getIncident,updateIncident,find_related_incidents,sugg
 *For leadership and metrics teams (read-only focus)*
 
 ```bash
-ROOTLY_MCP_ENABLED_TOOLS="listIncidents,search_incidents,collect_incidents,listTeams,listServices,listSchedules,get_oncall_shift_metrics,get_shift_incidents,listDashboards,getDashboard,listAlerts,listHeartbeats,listPulses,getCurrentUser,list_endpoints"
+ROOTLY_MCP_ENABLED_TOOLS="list_incidents,search_incidents,collect_incidents,listTeams,listServices,listSchedules,get_oncall_shift_metrics,get_shift_incidents,listDashboards,getDashboard,listAlerts,listHeartbeats,listPulses,getCurrentUser,list_endpoints"
 ```
 
 ### Multiple MCP Instances for Different Teams
@@ -422,7 +476,7 @@ You can run multiple MCP instances with different tool subsets:
       "command": "uvx", "args": ["--from", "rootly-mcp-server", "rootly-mcp-server"],
       "env": {
         "ROOTLY_API_TOKEN": "<token>",
-        "ROOTLY_MCP_ENABLED_TOOLS": "listIncidents,getIncident,createIncident,find_related_incidents,suggest_solutions..."
+        "ROOTLY_MCP_ENABLED_TOOLS": "list_incidents,getIncident,createIncident,find_related_incidents,suggest_solutions..."
       }
     },
     "rootly-oncall-management": {
@@ -470,7 +524,10 @@ You can run multiple MCP instances with different tool subsets:
 
 ## Supported Tools
 
-The default server configuration exposes **150+ tools**.
+The default tool surface depends on deployment mode:
+
+- Hosted default: about **56 tools**
+- Self-hosted default: about **218 tools**
 
 ### Custom Agentic Tools
 
@@ -566,7 +623,7 @@ listIncidentActionItems
 listIncidentAlerts
 listIncidentFormFieldSelections
 listIncident_Types
-listIncidents
+listIncidents  (deprecated alias — use `list_incidents`)
 listOnCallRoles
 listOnCallShadows
 listOverrideShifts

{rootly_mcp_server-2.3.7 → rootly_mcp_server-2.3.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rootly-mcp-server"
-version = "2.3.7"
+version = "2.3.9"
 description = "Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -42,9 +42,9 @@ dependencies = [
     "python-multipart>=0.0.26",  # Override vulnerable transitive python-multipart (CVE-2026-40347)
     "cryptography>=46.0.7",  # Override vulnerable transitive cryptography
     "Pygments>=2.20.0",  # Override vulnerable transitive Pygments
-    "requests==2.33.1", # Pin to patched version
+    "requests==2.34.0", # Pin to patched version
     "httpx==0.28.1",   # Pin to specific version
-    "pydantic==2.13.3",  # Pin to specific version
+    "pydantic==2.13.4",  # Pin to specific version
     "brotli>=1.2.0",    # For Brotli compression support in httpx
     "scikit-learn>=1.3.0", # For text similarity and ML utilities
     "numpy>=1.24.0",    # For numerical operations