OpsGraph MCP Tools

The same Operations evidence as Canvas, Companion, CLI, and SDK — exposed as MCP tools from OpenAPI x-mcp-tool annotations.

Phase 1 — topology & processes (read-only)

Tool	Route	Purpose
`human.operations.topology.list`	`GET /v1/operations/topology`	List topology nodes
`human.operations.processes.list`	`GET /v1/operations/processes`	List Process Definitions + contracts
`human.operations.processes.get`	`GET /v1/operations/processes/:id`	Process detail
`human.operations.observations.list`	`GET /v1/operations/observations`	List observations

No remediation or typed provider mutation tools in Phase 1. Discovery remains authority-free until Phase 3 proposals are explicitly approved.

Phase 1.5 — analytics (askable)

Same descriptors as Companion (opsgraph.analytics.*) and CLI (human opsgraph <verb>). Source: packages/opsgraph-bundle/src/analytics-tools.ts.

MCP tool	CLI verb	Companion tool	Route
`human.operations.analytics.stability`	`stability`	`opsgraph.analytics.stability`	`GET /v1/operations/analytics/stability`
`human.operations.analytics.cost`	`cost`	`opsgraph.analytics.cost`	`GET /v1/operations/analytics/cost`
`human.operations.analytics.patch_posture`	`patch-posture`	`opsgraph.analytics.patch_posture`	`GET /v1/operations/analytics/patch-posture`
`human.operations.analytics.spend`	`spend`	`opsgraph.analytics.spend`	`GET /v1/operations/analytics/spend`

Sample Companion questions ↔ CLI

“Which hosts are least stable over 30 days?”
  → human opsgraph stability --grain host --window 30d

“Where are we overspending?”
  → human opsgraph cost --view overspend

“Which hosts need urgent security patches?”
  → human opsgraph patch-posture --min-severity urgent

“Spend Monitor for AI usage cost”
  → human opsgraph spend --signal-key ai.usage_cost

MCP call examples

human tool call human.operations.analytics.stability --args '{"grain":"host","window":"30d"}'
human tool call human.operations.analytics.cost --args '{"view":"overspend"}'
human tool call human.operations.analytics.patch_posture --args '{"min_severity":"urgent"}'
human tool call human.operations.analytics.spend --args '{"signal_key":"ai.usage_cost"}'

Full recipes: docs/guides/opsgraph/analytics.md.

Phase 2 — monitoring & incidents

Kind A Operations routes (Core). Same contracts on CLI (human opsgraph findings|incidents|impact|triage) and SDK.

MCP tool	Route	Purpose
`human.operations.findings.list`	`GET /v1/operations/findings`	Latent-failure findings
`human.operations.incidents.list`	`GET /v1/operations/incidents`	Correlated incidents (`cp_incidents` spine)
`human.operations.incidents.impact`	`GET /v1/operations/incidents/:id/impact`	Product-capability impact
`human.operations.incidents.triage`	`POST /v1/operations/incidents/:id/triage`	Read-only HUMΛN-native triage

human opsgraph findings
human opsgraph incidents
human opsgraph impact <incidentId>
human opsgraph triage <incidentId>
human tool call human.operations.incidents.triage --args '{"id":"<incident-id>"}'

Canvas reuses platform incidents_list / incident_detail. Guide: docs/guides/opsgraph/monitoring.md.

Phase 3 — Access Broker & remediation

MCP grows beyond read-only only for delegation-authorized typed actions. No tool accepts arbitrary shell text. Discovery / monitoring tools never imply remediation authority.

MCP tool	CLI verb	Route	Purpose
`human.operations.remediation.propose`	`remediation propose`	`POST /v1/operations/remediation/proposals`	Propose typed action (e.g. `host.service.restart`)
`human.operations.remediation.get`	`remediation status`	`GET /v1/operations/remediation/proposals/:proposalId`	Inspect authority, target, risk, verification, result
`human.operations.remediation.approve`	`remediation approve`	`POST …/proposals/:proposalId/approve`	HITL approve — mints scoped Delegation
`human.operations.remediation.deny`	`remediation deny`	`POST …/proposals/:proposalId/deny`	Deny proposal
`human.operations.remediation.dispatch`	`remediation dispatch`	`POST …/proposals/:proposalId/dispatch`	Dispatch after Delegation checks
`human.operations.access.certificate.issue`	`access certificate`	`POST /v1/operations/access/certificates`	Short-lived SSH user cert (HUMΛN CA)

human opsgraph remediation propose
human opsgraph remediation status <proposalId>
human opsgraph remediation approve <proposalId>
human opsgraph remediation deny <proposalId>
human opsgraph remediation dispatch <proposalId>
human opsgraph access certificate

human tool call human.operations.remediation.propose --args '{"action_id":"host.service.restart","target":{"class":"host","id":"<host>"},"parameters":{"unit":"nginx"},"subject_did":"<did>"}'
human tool call human.operations.remediation.approve --args '{"proposal_id":"<id>"}'
human tool call human.operations.remediation.dispatch --args '{"proposal_id":"<id>"}'
human tool call human.operations.access.certificate.issue --args '{"principal":"ops","target_host":"<host>","public_key_openssh":"ssh-ed25519 …","validity_seconds":900,"request_correlation_id":"<corr>","subject_did":"<did>"}'

SDK (OpsGraphClient): proposeRemediation, getRemediationProposal, approveRemediation, denyRemediation, dispatchRemediation, issueAccessCertificate.

Canvas: opsgraph_remediation_approval — authority, target, typed action, risk, expiry, recovery proof before approve. Guide: docs/guides/opsgraph/remediation.md.

Auth and audience

Calls use the same trusted delegation/org resolution as other MCP tools. platform_internal rows require platform/staff context; tenant callers receive tenant-safe evidence only. Remediation approve/dispatch additionally require a valid scoped Delegation for the typed action — inventory read tokens are insufficient.

CLI / SDK parity

human tool list
human opsgraph topology
human opsgraph findings
human opsgraph triage <incidentId>
human opsgraph remediation status <proposalId>
human opsgraph access certificate

const { data } = await client.opsgraph.listTopology();
const findings = await client.opsgraph.listFindings();
const triage = await client.opsgraph.triageIncident(incidentId);
const proposal = await client.opsgraph.proposeRemediation({ /* typed action */ });
await client.opsgraph.approveRemediation(proposal.proposal_id);
await client.opsgraph.dispatchRemediation(proposal.proposal_id);