MCP API keys

The connections so far give the Investigator somewhere to look. An MCP API key runs the other way: it lets an external agent hand the Investigator an alert and get a case back, over MCP, without anyone opening the console. Use it to wire up an incident tool, a custom agent, or any MCP client that should be able to trigger an investigation.

Create a key

1. In the console, open your project’s settings and choose Client Access under MCP.
2. Click Create key and give it a Name — something that identifies the caller.
3. Choose which connections the key can investigate against: an AWS connection (with a default AWS region), a Kubernetes connection, or both. A key needs at least one. This binding scopes the AWS/Kubernetes context an investigation runs with — the key does not gain a separate grant on the project’s other integrations (Slack, Cloudflare, custom MCP servers), which stay available to any investigation the same way they are in the console.
4. Click Create. The raw key is shown once — copy or download it now. The dialog also shows a ready-to-paste Client config with the endpoint and bearer header already filled in — copy that instead of assembling the request by hand. After you close the dialog, only the key’s prefix is ever shown again.

Use the key

Point your MCP client at the Client config you copied when you created the key. It expects the same shape as any MCP server: an endpoint URL and a Bearer token in the Authorization header.

Two tools are exposed:

• start_investigation — takes an alert (title required; description, service_hint, started_at, severity, labels, source, and source_url optional) and returns an investigation_id immediately. The investigation itself runs asynchronously, typically 3–10 minutes, against the AWS and/or Kubernetes connections bound to the key. Pass an idempotency_key to make retries safe — the same key within 30 minutes returns the original investigation instead of starting a second one.
• get_investigation — takes the investigation_id and returns its status: queued or running while it works, completed with the finished case (root-cause hypothesis, findings, what was ruled out, next moves), needs_input if a step is paused for your approval, or failed/dismissed. Poll every 30–60 seconds. Any key valid for the project can look up any investigation ID in that project — knowing the ID is enough, it doesn’t have to be the key that started it — so don’t rely on a key to keep one caller’s investigations private from another.

A web_url in the response opens the case in the console, so a paused or finished investigation is one click from the agent’s own output.

Limits

Keys are rate-limited per key: 10 start_investigation calls per hour, 120 get_investigation calls per hour. Going over either returns a rate-limit error with how long to wait before retrying.

Revoke

Click Revoke next to a key and confirm. Access stops immediately — there’s no grace period, so make sure nothing still depends on it first.

Next: The Investigator in Slack