How is this different from connecting Honeycomb MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the Honeycomb MCP API changes?

We track the Honeycomb MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different Honeycomb tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in Honeycomb?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the Honeycomb MCP server myself?

No. TrustGate connects to the Honeycomb MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to Honeycomb directly.

Connect Honeycomb MCP to your AI agents, securely.

Q: Is Honeycomb MCP secure?

The server itself exposes 34 tools, and some of them can write to your Honeycomb account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches Honeycomb.

One secured endpoint for every Honeycomb call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try Honeycomb MCP now

What your agents can ask once Honeycomb MCP is connected.

Select the tools your AI agents can call

34 tools from the Honeycomb MCP schema.

Showing 34 tools

get_workspace_contextreadReturns the team name, current time, and the environments with their slugs and dataset counts. Takes no parameters.
get_environmentreadReturns details for a single environment, including its datasets and calculated fields, up to 100 datasets per call.
get_datasetreadReturns metadata and the full column schema for a dataset, sorted by last write time.
get_dataset_columnsreadReturns the column schema for a dataset, with optional sample values. For metrics datasets, returns metric names by default.
run_queryreadRuns a time-series aggregation query and returns computed results, with support for query math, per-calculation filters, formulas, breakdowns and relational trace prefixes.
get_query_resultsreadRetrieves results and metadata from a previously executed query run, by URL, run primary key or query ID.
find_queriesreadSearches query history and saved queries by intent, returning run primary keys to pair with get_query_results.
find_columnsreadSearches columns and calculated fields by intent across one or all datasets, using natural-language keywords rather than exact names.
run_bubbleupreadRuns a BubbleUp analysis on an existing query result to identify what makes a subset of data different from the baseline.
get_tracereadRetrieves all spans for a trace ID and renders them as a waterfall, with parameters to zoom into subtrees.
list_spansreadLists span names in trace data ranked by count, with how often each is a trace root.
get_span_detailsreadReturns a summary of the attributes and common values observed on spans with a specific name.
get_service_mapreadReturns a snapshot of service-to-service call dependencies for a time range. Enterprise only.
get_anomaly_service_profilesreadReturns anomaly detection service profiles for the team. Requires anomaly detection to be enabled.
search_semconvreadSearches the semantic convention registry for attributes matching a query.
get_semconv_attributereadReturns the full definitions of one or more semantic convention attributes by exact name.
list_semconv_namespacesreadLists the top-level semantic convention namespaces in the team's registry, including team-specific customizations.
list_boardsreadLists Boards in an environment, or returns the full contents of a single Board by ID.
create_boardwriteCreates a Board with query, SLO and Markdown panels, plus preset filters that become dropdowns. Requires mcp:write.
update_boardwriteUpdates a Board: renaming, adding, removing, updating and reordering panels, and replacing preset filters and tags. Requires mcp:write.
get_triggersreadLists Triggers for the team, or returns the detailed configuration of one, including its recipients.
create_triggerwriteCreates a Trigger that fires alerts when query results cross a threshold. Requires mcp:write.
update_triggerwriteUpdates an existing Trigger. Requires mcp:write.
get_slosreadLists SLOs for the team, or returns detailed status and graphs for a single SLO.
create_slowriteCreates an SLO with an auto-created SLI derived column, validating the expression first. Requires mcp:write.
update_slowriteUpdates an existing SLO with partial-update semantics. Dataset associations are fixed at creation time. Requires mcp:write.
list_recipientsreadLists the pre-registered notification recipients for the team, including email, Slack, PagerDuty and webhooks, with their IDs.
create_recipienthigh riskCreates a notification recipient that Triggers and SLO burn alerts can route to. Adds a new outbound destination for alert data. Requires mcp:write.
canvas_agent_poll_responsereadPolls for the result of a previously issued canvas_agent_invoke call.
canvas_agent_invokehigh riskSends a message to the Canvas agent, routing it to an existing investigation or starting a new one. Requires mcp:write.
list_aiconversationsreadLists recent AI agent conversations in an environment with a breakdown of agents, services, event counts, errors and token usage.
get_aiconversationreadReturns the full event timeline for one AI conversation: every LLM call, tool call and related agent event, plus an aggregate summary.
refinery_docsreadReads from the Honeycomb Refinery documentation to answer configuration questions in-conversation.
feedbackwriteSubmits feedback about the Honeycomb MCP server to the team that maintains it. Requires mcp:write.

What Honeycomb MCP exposes

Honeycomb MCP groups its 34 tools into 12 categories, each with a suggested starting policy.

All 34 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
Workspace Discovery	Team context, environments, datasets and column schemas	Read	Agents call get_workspace_context first to orient themselves; allow broadly
Query & Analysis	Time-series aggregation queries, prior query results, query and column search, and BubbleUp outlier analysis	Read	run_query is rate-limited to 100 calls a minute; watch query cost
Traces & Spans	Full traces as a waterfall, span names ranked by count, and span attribute summaries	Read	Span attributes can carry request payloads; treat as sensitive
Service Map & Anomalies	Service-to-service call dependencies and anomaly detection profiles	Read	Service map is Enterprise only and limited to 10 calls a minute
Semantic Conventions	OpenTelemetry semantic convention attributes and team-specific extensions from the Weaver registry	Read	Reference lookups; safe to allow broadly
Boards	Listing Boards and creating or updating them with query, SLO and Markdown panels	Read / Write	Boards are shared with the team; review before creating
Triggers	Triggers that fire alerts when query results cross a threshold	Read / Write	A Trigger pages real people; approve creation and updates
SLOs	Service Level Objectives, their burn status and the SLI derived columns behind them	Read / Write	Dataset associations are fixed at creation; a new SLO is needed to change them
Notification Recipients	The email, Slack, PagerDuty and webhook destinations that Triggers and SLO burn alerts route to	Read / Write	A new recipient is a new outbound destination for alert data; approve it
Canvas Investigations	Sending messages to the Canvas agent and polling for its results	Read / Write	Invoking Canvas starts an autonomous investigation; approve and bound it
AI Conversation Analysis	Telemetry from other AI agents emitting OpenTelemetry gen_ai attributes: conversations, errors and token usage	Read	Conversation timelines can contain prompt content; restrict access
Other	Refinery documentation lookup and product feedback	Read / Write	Allow documentation lookups

Connect Honeycomb MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect Honeycomb
Find Honeycomb in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow Honeycomb MCP or block it. You allow the exact tools each agent can call, one by one.

Honeycomb MCP	34 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 34 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is Honeycomb MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	Honeycomb MCP34 documented tools: 25 read and 9 write.
Coding assistants	Connection & credentialsper user	Query & Analysis5 tools
Internal copilots	Tool access policiesdeny by default	Workspace Discovery4 tools
Workflow automations	Request & response inspectioninline	Traces & Spans3 tools
Compatible MCP clients	Activity monitoringalerts and logs	All other tools22 tools