rootly-mcp-server 2.3.8__tar.gz → 2.3.9__tar.gz

{rootly_mcp_server-2.3.8 → rootly_mcp_server-2.3.9}/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to the Rootly MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.3.9] - Released 2026-05-21
+
+### Performance
+
+- **Hosted Default Tool Surface Slimmed**: Default hosted deployments now expose a curated core profile of 55 high-usage tools instead of the full 200+ tool surface, improving MCP client tool-discovery performance while preserving a broad self-hosted default
+- **Hosted and Self-Hosted Defaults Split**: Hosted/serverless instances now default to the slim allowlist, while local and self-hosted deployments continue to expose the full tool catalog unless explicitly overridden
+
+### Configuration
+
+- **Hosted Allowlist Override Behavior**: `ROOTLY_MCP_ENABLED_TOOLS` now cleanly overrides the hosted default profile when operators want a narrower or broader remote tool surface
+
+### Documentation
+
+- **README Deployment Guidance Updated**: Documented the new hosted-versus-self-hosted tool defaults, the hosted override behavior, and the current approximate tool counts for each mode
+
+### Dependencies
+
+- **Lockfile Sync**: Regenerated `uv.lock` so the lockfile matches the current pinned versions in `pyproject.toml`, including `requests==2.34.0` and `pydantic==2.13.4`
+
 ## [2.3.8] - Released 2026-05-19
 
 ### Security

{rootly_mcp_server-2.3.8 → rootly_mcp_server-2.3.9}/Dockerfile

@@ -18,6 +18,13 @@ COPY . .
 # Install the package and its dependencies
 RUN uv pip install --system --no-cache-dir -e .
 
+# Install MCPcat for hosted telemetry without changing the repo dependency graph.
+# MCPcat's current package metadata pins an older Pydantic range, but the SDK
+# imports successfully with our runtime pin, so we restore the server's pinned
+# version after installation.
+RUN uv pip install --system --no-cache-dir mcpcat==0.1.14 \
+    && uv pip install --system --no-cache-dir pydantic==2.13.4
+
 # Create non-root user
 RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /app
 

{rootly_mcp_server-2.3.8 → rootly_mcp_server-2.3.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rootly-mcp-server
-Version: 2.3.8
+Version: 2.3.9
 Summary: Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation
 Project-URL: Homepage, https://github.com/Rootly-AI-Labs/Rootly-MCP-server
 Project-URL: Issues, https://github.com/Rootly-AI-Labs/Rootly-MCP-server/issues
@@ -65,7 +65,21 @@ Use the hosted MCP server. No local installation required.
 
 ### General Remote Setup
 
-Default remote config (HTTP streamable):
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+Your MCP client handles OAuth2 login automatically — a browser window opens for you to authenticate with Rootly. No API token needed.
+
+**With API Token:**
 
 ```json
 {
@@ -86,10 +100,7 @@ SSE (alternative):
 {
   "mcpServers": {
     "rootly": {
-      "url": "https://mcp.rootly.com/sse",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/sse"
     }
   }
 }
@@ -101,10 +112,7 @@ Code Mode:
 {
   "mcpServers": {
     "rootly": {
-      "url": "https://mcp.rootly.com/mcp-codemode",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/mcp-codemode"
     }
   }
 }
@@ -117,47 +125,35 @@ Code Mode:
 
 <br>
 
-**Streamable HTTP**
+**With OAuth2 (recommended):**
 
 ```bash
-claude mcp add --transport http rootly https://mcp.rootly.com/mcp \
-  --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
-```
-
-Code Mode:
+claude mcp add --transport http rootly https://mcp.rootly.com/mcp
 
-```bash
-claude mcp add rootly-codemode --transport http https://mcp.rootly.com/mcp-codemode \
-  --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
+# Code Mode:
+claude mcp add --transport http rootly-codemode https://mcp.rootly.com/mcp-codemode
 ```
 
-SSE (alternative):
+**With API Token:**
 
 ```bash
-claude mcp add --transport sse rootly-sse https://mcp.rootly.com/sse \
+claude mcp add --transport http rootly https://mcp.rootly.com/mcp \
   --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
 ```
 
-**Manual Configuration**
-
-Create `.mcp.json` in your project root:
+**Manual Configuration** — Create `.mcp.json` in your project root:
 
 ```json
 {
   "mcpServers": {
     "rootly": {
       "type": "http",
-      "url": "https://mcp.rootly.com/mcp",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/mcp"
     }
   }
 }
 ```
 
-Restart Claude Code after updating the config.
-
 </details>
 
 <details>
@@ -196,6 +192,20 @@ Or configure manually in `~/.gemini/settings.json`:
 
 Add to `.cursor/mcp.json` or `~/.cursor/mcp.json`:
 
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+**With API Token:**
+
 ```json
 {
   "mcpServers": {
@@ -218,6 +228,20 @@ Add to `.cursor/mcp.json` or `~/.cursor/mcp.json`:
 
 Add to `~/.codeium/windsurf/mcp_config.json`:
 
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "serverUrl": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+**With API Token:**
+
 ```json
 {
   "mcpServers": {
@@ -240,6 +264,15 @@ Add to `~/.codeium/windsurf/mcp_config.json`:
 
 Add to `~/.codex/config.toml`:
 
+**With OAuth2 (recommended):**
+
+```toml
+[mcp_servers.rootly]
+url = "https://mcp.rootly.com/mcp"
+```
+
+**With API Token:**
+
 ```toml
 [mcp_servers.rootly]
 url = "https://mcp.rootly.com/mcp"
@@ -253,9 +286,23 @@ bearer_token_env_var = "ROOTLY_API_TOKEN"
 
 <br>
 
+**With OAuth2 (recommended):**
+
 Add to `claude_desktop_config.json`:
 
-> **Note:** The `--transport http` flag ensures HTTP streamable transport is used instead of auto-falling back to SSE.
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+Claude Desktop handles OAuth2 login automatically.
+
+**With API Token (via mcp-remote):**
 
 ```json
 {
@@ -350,7 +397,14 @@ Choose one transport per server process:
 - **SSE** endpoint path: `/sse`
 - **Code Mode (experimental)** endpoint path: `/mcp-codemode` in hosted dual-transport mode
 
-Both hosted and self-hosted deployments expose the same curated tool surface by default, including the default write-enabled tools. To restrict that surface to read-only tools, start the server with `--no-enable-write-tools` or set `ROOTLY_MCP_ENABLE_WRITE_TOOLS=false`.
+Hosted and self-hosted deployments now have different defaults:
+
+- Hosted defaults to a slim core profile of about 50-60 high-usage tools for better MCP client performance.
+- Self-hosted keeps the full tool surface by default.
+
+To restrict either deployment to read-only tools, start the server with `--no-enable-write-tools` or set `ROOTLY_MCP_ENABLE_WRITE_TOOLS=false`.
+
+To override the hosted default core profile, set `ROOTLY_MCP_ENABLED_TOOLS` (or pass `--enabled-tools`) with a comma-separated allowlist of exact tool names. When that variable is set, it fully replaces the default hosted selection.
 
 To expose only a specific subset of MCP tools on a self-hosted deployment, set `ROOTLY_MCP_ENABLED_TOOLS` (or pass `--enabled-tools`) with a comma-separated allowlist of exact tool names, for example `list_incidents,getIncident,get_server_version`.
 
@@ -418,13 +472,13 @@ docker run -p 8000:8000 \
 
 ## Workflow-Focused Tool Subsets
 
-With 150+ tools available, you may want to configure focused subsets for optimal AI agent performance. Use `ROOTLY_MCP_ENABLED_TOOLS` to activate specific workflows:
+The full self-hosted surface exposes 200+ tools, while hosted defaults to a slim core profile. If you want even tighter workflow-specific subsets, use `ROOTLY_MCP_ENABLED_TOOLS`:
 
 ### 🚨 Incident Response (25 tools)
 *Essential tools for emergency responders and incident commanders*
 
 ```bash
-ROOTLY_MCP_ENABLED_TOOLS="listIncidents,getIncident,createIncident,updateIncident,search_incidents,find_related_incidents,suggest_solutions,createIncidentActionItem,listIncidentActionItems,updateIncidentFormFieldSelection,listTeams,getCurrentUser,listServices,listSeverities,getAlert,listAlerts,updateAlert,listEscalationPolicies,getEscalationPolicy,listOnCallRoles,listSchedules,getScheduleShifts,get_oncall_handoff_summary,get_shift_incidents,list_endpoints"
+ROOTLY_MCP_ENABLED_TOOLS="list_incidents,getIncident,createIncident,updateIncident,search_incidents,find_related_incidents,suggest_solutions,createIncidentActionItem,listIncidentActionItems,updateIncidentFormFieldSelection,listTeams,getCurrentUser,listServices,listSeverities,getAlert,listAlerts,updateAlert,listEscalationPolicies,getEscalationPolicy,listOnCallRoles,listSchedules,getScheduleShifts,get_oncall_handoff_summary,get_shift_incidents,list_endpoints"
 ```
 
 ### 📅 On-Call Management (35 tools)  
@@ -452,7 +506,7 @@ ROOTLY_MCP_ENABLED_TOOLS="getIncident,updateIncident,find_related_incidents,sugg
 *For leadership and metrics teams (read-only focus)*
 
 ```bash
-ROOTLY_MCP_ENABLED_TOOLS="listIncidents,search_incidents,collect_incidents,listTeams,listServices,listSchedules,get_oncall_shift_metrics,get_shift_incidents,listDashboards,getDashboard,listAlerts,listHeartbeats,listPulses,getCurrentUser,list_endpoints"
+ROOTLY_MCP_ENABLED_TOOLS="list_incidents,search_incidents,collect_incidents,listTeams,listServices,listSchedules,get_oncall_shift_metrics,get_shift_incidents,listDashboards,getDashboard,listAlerts,listHeartbeats,listPulses,getCurrentUser,list_endpoints"
 ```
 
 ### Multiple MCP Instances for Different Teams
@@ -466,7 +520,7 @@ You can run multiple MCP instances with different tool subsets:
       "command": "uvx", "args": ["--from", "rootly-mcp-server", "rootly-mcp-server"],
       "env": {
         "ROOTLY_API_TOKEN": "<token>",
-        "ROOTLY_MCP_ENABLED_TOOLS": "listIncidents,getIncident,createIncident,find_related_incidents,suggest_solutions..."
+        "ROOTLY_MCP_ENABLED_TOOLS": "list_incidents,getIncident,createIncident,find_related_incidents,suggest_solutions..."
       }
     },
     "rootly-oncall-management": {
@@ -514,7 +568,10 @@ You can run multiple MCP instances with different tool subsets:
 
 ## Supported Tools
 
-The default server configuration exposes **150+ tools**.
+The default tool surface depends on deployment mode:
+
+- Hosted default: about **56 tools**
+- Self-hosted default: about **218 tools**
 
 ### Custom Agentic Tools
 
@@ -610,7 +667,7 @@ listIncidentActionItems
 listIncidentAlerts
 listIncidentFormFieldSelections
 listIncident_Types
-listIncidents
+listIncidents  (deprecated alias — use `list_incidents`)
 listOnCallRoles
 listOnCallShadows
 listOverrideShifts

{rootly_mcp_server-2.3.8 → rootly_mcp_server-2.3.9}/README.md

@@ -21,7 +21,21 @@ Use the hosted MCP server. No local installation required.
 
 ### General Remote Setup
 
-Default remote config (HTTP streamable):
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+Your MCP client handles OAuth2 login automatically — a browser window opens for you to authenticate with Rootly. No API token needed.
+
+**With API Token:**
 
 ```json
 {
@@ -42,10 +56,7 @@ SSE (alternative):
 {
   "mcpServers": {
     "rootly": {
-      "url": "https://mcp.rootly.com/sse",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/sse"
     }
   }
 }
@@ -57,10 +68,7 @@ Code Mode:
 {
   "mcpServers": {
     "rootly": {
-      "url": "https://mcp.rootly.com/mcp-codemode",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/mcp-codemode"
     }
   }
 }
@@ -73,47 +81,35 @@ Code Mode:
 
 <br>
 
-**Streamable HTTP**
+**With OAuth2 (recommended):**
 
 ```bash
-claude mcp add --transport http rootly https://mcp.rootly.com/mcp \
-  --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
-```
-
-Code Mode:
+claude mcp add --transport http rootly https://mcp.rootly.com/mcp
 
-```bash
-claude mcp add rootly-codemode --transport http https://mcp.rootly.com/mcp-codemode \
-  --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
+# Code Mode:
+claude mcp add --transport http rootly-codemode https://mcp.rootly.com/mcp-codemode
 ```
 
-SSE (alternative):
+**With API Token:**
 
 ```bash
-claude mcp add --transport sse rootly-sse https://mcp.rootly.com/sse \
+claude mcp add --transport http rootly https://mcp.rootly.com/mcp \
   --header "Authorization: Bearer YOUR_ROOTLY_API_TOKEN"
 ```
 
-**Manual Configuration**
-
-Create `.mcp.json` in your project root:
+**Manual Configuration** — Create `.mcp.json` in your project root:
 
 ```json
 {
   "mcpServers": {
     "rootly": {
       "type": "http",
-      "url": "https://mcp.rootly.com/mcp",
-      "headers": {
-        "Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
-      }
+      "url": "https://mcp.rootly.com/mcp"
     }
   }
 }
 ```
 
-Restart Claude Code after updating the config.
-
 </details>
 
 <details>
@@ -152,6 +148,20 @@ Or configure manually in `~/.gemini/settings.json`:
 
 Add to `.cursor/mcp.json` or `~/.cursor/mcp.json`:
 
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+**With API Token:**
+
 ```json
 {
   "mcpServers": {
@@ -174,6 +184,20 @@ Add to `.cursor/mcp.json` or `~/.cursor/mcp.json`:
 
 Add to `~/.codeium/windsurf/mcp_config.json`:
 
+**With OAuth2 (recommended):**
+
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "serverUrl": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+**With API Token:**
+
 ```json
 {
   "mcpServers": {
@@ -196,6 +220,15 @@ Add to `~/.codeium/windsurf/mcp_config.json`:
 
 Add to `~/.codex/config.toml`:
 
+**With OAuth2 (recommended):**
+
+```toml
+[mcp_servers.rootly]
+url = "https://mcp.rootly.com/mcp"
+```
+
+**With API Token:**
+
 ```toml
 [mcp_servers.rootly]
 url = "https://mcp.rootly.com/mcp"
@@ -209,9 +242,23 @@ bearer_token_env_var = "ROOTLY_API_TOKEN"
 
 <br>
 
+**With OAuth2 (recommended):**
+
 Add to `claude_desktop_config.json`:
 
-> **Note:** The `--transport http` flag ensures HTTP streamable transport is used instead of auto-falling back to SSE.
+```json
+{
+  "mcpServers": {
+    "rootly": {
+      "url": "https://mcp.rootly.com/mcp"
+    }
+  }
+}
+```
+
+Claude Desktop handles OAuth2 login automatically.
+
+**With API Token (via mcp-remote):**
 
 ```json
 {
@@ -306,7 +353,14 @@ Choose one transport per server process:
 - **SSE** endpoint path: `/sse`
 - **Code Mode (experimental)** endpoint path: `/mcp-codemode` in hosted dual-transport mode
 
-Both hosted and self-hosted deployments expose the same curated tool surface by default, including the default write-enabled tools. To restrict that surface to read-only tools, start the server with `--no-enable-write-tools` or set `ROOTLY_MCP_ENABLE_WRITE_TOOLS=false`.
+Hosted and self-hosted deployments now have different defaults:
+
+- Hosted defaults to a slim core profile of about 50-60 high-usage tools for better MCP client performance.
+- Self-hosted keeps the full tool surface by default.
+
+To restrict either deployment to read-only tools, start the server with `--no-enable-write-tools` or set `ROOTLY_MCP_ENABLE_WRITE_TOOLS=false`.
+
+To override the hosted default core profile, set `ROOTLY_MCP_ENABLED_TOOLS` (or pass `--enabled-tools`) with a comma-separated allowlist of exact tool names. When that variable is set, it fully replaces the default hosted selection.
 
 To expose only a specific subset of MCP tools on a self-hosted deployment, set `ROOTLY_MCP_ENABLED_TOOLS` (or pass `--enabled-tools`) with a comma-separated allowlist of exact tool names, for example `list_incidents,getIncident,get_server_version`.
 
@@ -374,13 +428,13 @@ docker run -p 8000:8000 \
 
 ## Workflow-Focused Tool Subsets
 
-With 150+ tools available, you may want to configure focused subsets for optimal AI agent performance. Use `ROOTLY_MCP_ENABLED_TOOLS` to activate specific workflows:
+The full self-hosted surface exposes 200+ tools, while hosted defaults to a slim core profile. If you want even tighter workflow-specific subsets, use `ROOTLY_MCP_ENABLED_TOOLS`:
 
 ### 🚨 Incident Response (25 tools)
 *Essential tools for emergency responders and incident commanders*
 
 ```bash
-ROOTLY_MCP_ENABLED_TOOLS="listIncidents,getIncident,createIncident,updateIncident,search_incidents,find_related_incidents,suggest_solutions,createIncidentActionItem,listIncidentActionItems,updateIncidentFormFieldSelection,listTeams,getCurrentUser,listServices,listSeverities,getAlert,listAlerts,updateAlert,listEscalationPolicies,getEscalationPolicy,listOnCallRoles,listSchedules,getScheduleShifts,get_oncall_handoff_summary,get_shift_incidents,list_endpoints"
+ROOTLY_MCP_ENABLED_TOOLS="list_incidents,getIncident,createIncident,updateIncident,search_incidents,find_related_incidents,suggest_solutions,createIncidentActionItem,listIncidentActionItems,updateIncidentFormFieldSelection,listTeams,getCurrentUser,listServices,listSeverities,getAlert,listAlerts,updateAlert,listEscalationPolicies,getEscalationPolicy,listOnCallRoles,listSchedules,getScheduleShifts,get_oncall_handoff_summary,get_shift_incidents,list_endpoints"
 ```
 
 ### 📅 On-Call Management (35 tools)  
@@ -408,7 +462,7 @@ ROOTLY_MCP_ENABLED_TOOLS="getIncident,updateIncident,find_related_incidents,sugg
 *For leadership and metrics teams (read-only focus)*
 
 ```bash
-ROOTLY_MCP_ENABLED_TOOLS="listIncidents,search_incidents,collect_incidents,listTeams,listServices,listSchedules,get_oncall_shift_metrics,get_shift_incidents,listDashboards,getDashboard,listAlerts,listHeartbeats,listPulses,getCurrentUser,list_endpoints"
+ROOTLY_MCP_ENABLED_TOOLS="list_incidents,search_incidents,collect_incidents,listTeams,listServices,listSchedules,get_oncall_shift_metrics,get_shift_incidents,listDashboards,getDashboard,listAlerts,listHeartbeats,listPulses,getCurrentUser,list_endpoints"
 ```
 
 ### Multiple MCP Instances for Different Teams
@@ -422,7 +476,7 @@ You can run multiple MCP instances with different tool subsets:
       "command": "uvx", "args": ["--from", "rootly-mcp-server", "rootly-mcp-server"],
       "env": {
         "ROOTLY_API_TOKEN": "<token>",
-        "ROOTLY_MCP_ENABLED_TOOLS": "listIncidents,getIncident,createIncident,find_related_incidents,suggest_solutions..."
+        "ROOTLY_MCP_ENABLED_TOOLS": "list_incidents,getIncident,createIncident,find_related_incidents,suggest_solutions..."
       }
     },
     "rootly-oncall-management": {
@@ -470,7 +524,10 @@ You can run multiple MCP instances with different tool subsets:
 
 ## Supported Tools
 
-The default server configuration exposes **150+ tools**.
+The default tool surface depends on deployment mode:
+
+- Hosted default: about **56 tools**
+- Self-hosted default: about **218 tools**
 
 ### Custom Agentic Tools
 
@@ -566,7 +623,7 @@ listIncidentActionItems
 listIncidentAlerts
 listIncidentFormFieldSelections
 listIncident_Types
-listIncidents
+listIncidents  (deprecated alias — use `list_incidents`)
 listOnCallRoles
 listOnCallShadows
 listOverrideShifts

{rootly_mcp_server-2.3.8 → rootly_mcp_server-2.3.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rootly-mcp-server"
-version = "2.3.8"
+version = "2.3.9"
 description = "Secure Model Context Protocol server for Rootly APIs with AI SRE capabilities, comprehensive error handling, and input validation"
 readme = "README.md"
 requires-python = ">=3.12"

{rootly_mcp_server-2.3.8 → rootly_mcp_server-2.3.9}/src/rootly_mcp_server/__main__.py

@@ -7,12 +7,13 @@ This module provides the main entry point for the Rootly MCP Server.
 
 import argparse
 import asyncio
+import importlib
 import logging
 import os
 import sys
 from contextlib import AsyncExitStack, asynccontextmanager
 from pathlib import Path
-from typing import Literal, cast
+from typing import Any, Literal, cast
 
 from .code_mode import (
     code_mode_enabled_from_env,
@@ -24,6 +25,7 @@ from .exceptions import RootlyConfigurationError, RootlyMCPError
 from .security import validate_api_token
 from .server import create_rootly_mcp_server, get_hosted_auth_middleware
 from .server_defaults import enabled_tools_from_env, write_tools_enabled_from_env
+from .transport import get_hosted_authenticated_user
 
 TransportName = Literal["stdio", "sse", "streamable-http", "both"]
 TRANSPORT_ALIASES: dict[str, TransportName] = {
@@ -77,6 +79,52 @@ def streamable_http_stateless_enabled(*, hosted: bool, fastmcp_stateless_http: b
     return hosted
 
 
+def maybe_enable_mcpcat_tracking(server, project_id: str | None, logger: logging.Logger) -> None:
+    """Enable MCPcat tracking when configured and available.
+
+    The Python MCPcat package is currently deployed separately from the core
+    server dependency set, so we load it lazily and only when a project ID is
+    configured. This keeps the base server behavior unchanged for self-hosted
+    users and local development environments that do not install MCPcat.
+    """
+    if not project_id:
+        return
+
+    try:
+        mcpcat = importlib.import_module("mcpcat")
+        mcpcat_types = importlib.import_module("mcpcat.types")
+    except ImportError:
+        logger.warning(
+            "ROOTLY_MCPCAT_PROJECT_ID is set but mcpcat is not installed; skipping MCPcat tracking"
+        )
+        return
+
+    try:
+        options = mcpcat_types.MCPCatOptions(
+            identify=build_mcpcat_identify_callback(mcpcat_types.UserIdentity),
+        )
+        mcpcat.track(server, project_id, options)
+    except Exception:
+        logger.warning("MCPcat tracking could not be enabled; skipping", exc_info=True)
+
+
+def build_mcpcat_identify_callback(user_identity_cls: type[Any]):
+    """Build a lightweight MCPcat identify callback from hosted auth context."""
+
+    def identify(_request: dict[str, Any], _context: Any) -> Any:
+        user = get_hosted_authenticated_user()
+        if not user:
+            return None
+
+        return user_identity_cls(
+            user_id=user["id"],
+            user_name=(user.get("full_name_with_team") or user.get("name") or user.get("email")),
+            user_data=None,
+        )
+
+    return identify
+
+
 def parse_args():
     """Parse command-line arguments."""
     parser = argparse.ArgumentParser(description="Start the Rootly MCP server for API integration.")
@@ -217,7 +265,7 @@ def get_server():
     base_url = os.getenv("ROOTLY_BASE_URL")
     transport = normalize_transport_or_default(os.getenv("ROOTLY_TRANSPORT", "stdio"))
     enable_write_tools = write_tools_enabled_from_env(default=True)
-    enabled_tools = enabled_tools_from_env()
+    enabled_tools = enabled_tools_from_env(hosted=hosted)
 
     # Parse allowed paths from environment variable
     allowed_paths = None
@@ -419,7 +467,7 @@ def main():
         enabled_tools = (
             {tool.strip() for tool in args.enabled_tools.split(",") if tool.strip()}
             if args.enabled_tools
-            else enabled_tools_from_env()
+            else enabled_tools_from_env(hosted=hosted_mode)
         )
 
         logger.info(f"Initializing server with name: {args.name}")
@@ -434,6 +482,7 @@ def main():
             if args.code_mode_path
             else code_mode_path_from_env()
         )
+        mcpcat_project_id = os.getenv("ROOTLY_MCPCAT_PROJECT_ID")
         server = create_rootly_mcp_server(
             swagger_path=args.swagger_path,
             name=args.name,
@@ -471,6 +520,10 @@ def main():
                 )
                 logger.info("Code Mode enabled at path: %s", code_mode_path)
 
+        maybe_enable_mcpcat_tracking(server, mcpcat_project_id, logger)
+        if code_mode_server is not None:
+            maybe_enable_mcpcat_tracking(code_mode_server, mcpcat_project_id, logger)
+
         logger.info(f"Running server with transport: {normalized_transport}...")
         direct_streamable_stateless_http = streamable_http_stateless_enabled(
             hosted=hosted_mode,