How is this different from connecting Rootly MCP directly?

Connected directly, an agent sees every tool the server exposes and holds the credential itself. Through TrustGate you choose which tools each agent gets, and every call is logged against the agent that made it.

What if the Rootly MCP API changes?

We track the Rootly MCP schema, so the tool catalogue stays current. Tools you have already allowed keep working, and anything new stays denied until you enable it.

Can I give different agents different Rootly tools?

Yes. Access is set per agent: one can get a handful of read tools, another the full set. You grant the whole MCP or single tools within it.

Where can I see what my agents did in Rootly?

Every call is logged against the agent that made it, with the tool it used. Activity can be sent on to your own monitoring.

Do I need to run the Rootly MCP server myself?

No. TrustGate connects to the Rootly MCP server and sits in front of it. Your agent only talks to your TrustGate URL, never to Rootly directly.

Connect Rootly MCP to your AI agents, securely.

Q: Is Rootly MCP secure?

The server itself exposes 261 tools, and some of them can write to your Rootly account. Behind TrustGate an agent only sees the tools you allow, requests and responses are inspected, and every call is logged. Anything outside the allowlist is denied before it reaches Rootly.

One secured endpoint for every Rootly call your AI agents make, scoped per user, inspected, and logged.

Get started for free

Get a demo

Try Rootly MCP now

What your agents can ask once Rootly MCP is connected.

Select the tools your AI agents can call

261 tools from the Rootly MCP schema.

Showing 261 tools

list_incidentsreadLists incidents with bounded pagination and compact responses to avoid context overflow.
get_incidentreadRetrieves a single incident for direct verification, including post-incident-review fields.
search_incidentsreadSearches incidents.
collect_incidentsreadCollects incidents in bulk for analysis and reporting.
find_related_incidentsreadUses TF-IDF similarity analysis to find historically similar incidents.
suggest_solutionsreadMines past incident resolutions to recommend actionable solutions.
list_incident_typesreadLists the configured incident types.
get_incident_typereadRetrieves one incident type.
list_causesreadLists the configured causes.
get_causereadRetrieves one cause.
list_all_incident_action_itemsreadLists action items across all incidents.
list_incident_action_itemsreadLists the action items on one incident.
get_incident_action_itemsreadRetrieves incident action item detail.
list_incident_form_field_selectionsreadLists the form field selections on an incident.
get_incident_form_field_selectionreadRetrieves one incident form field selection.
create_incident_action_itemwriteCreates an action item on an incident.
create_incident_form_field_selectionwriteCreates a form field selection on an incident.
update_incident_form_field_selectionwriteUpdates an existing incident form field selection.
update_incident_typewriteUpdates an incident type definition.
update_causewriteUpdates a cause definition.
create_incidenthigh riskCreates a new incident with a scoped set of fields for agent workflows, which starts the real response process.
update_incidenthigh riskScoped incident update covering summary and retrospective progress status only.
create_incident_eventwriteCreates a new event.
create_sub_statuswriteCreates a new Sub-Status.
get_incident_sub_statusreadRetrieves a specific incident_sub_status by id.
get_sub_statusreadRetrieves a specific Sub-Status by id.
list_incident_eventsreadLists incident events.
list_incident_rolesreadLists role assignments for an incident (who is Commander, Scribe, etc.).
list_sub_statusesreadLists Sub-Statuses.
update_incident_action_itemwriteUpdates a specific incident action item by id.
update_incident_sub_statuswriteUpdates a specific incident_sub_status by id.
update_sub_statuswriteUpdates a specific Sub-Status by id.
list_schedulesreadLists the on-call schedules.
get_schedulereadRetrieves one schedule.
get_schedule_shiftsreadReturns the shifts on a schedule.
list_shiftsreadLists shifts across schedules.
list_schedule_rotationsreadLists the rotations on a schedule.
get_schedule_rotationreadRetrieves one schedule rotation.
list_schedule_rotation_usersreadLists the users in a rotation.
list_schedule_rotation_active_daysreadLists the active days configured on a rotation.
list_on_call_shadowsreadLists on-call shadows, where someone shadows a shift.
get_on_call_shadowreadRetrieves one on-call shadow.
list_override_shiftsreadLists the override shifts on a schedule.
get_override_shiftreadRetrieves one override shift.
list_on_call_rolesreadLists the on-call roles, such as primary and secondary.
get_on_call_rolereadRetrieves one on-call role.
get_oncall_schedule_summaryreadSummarises a schedule's current and upcoming coverage.
get_oncall_shift_metricsreadOn-call shift metrics for a period, grouped by user, team or schedule, with primary and secondary role tracking, shift counts, hours and days on call.
get_oncall_handoff_summaryreadA complete handoff: current and next on-call plus the incidents that happened during their shifts, optionally filtered to one timezone's business hours.
get_shift_incidentsreadThe incidents in a time period with optional severity, status and tag filters, plus counts and average resolution time.
check_responder_availabilityreadChecks whether a responder is available to take a shift.
check_oncall_health_riskreadDetects workload health risk in scheduled responders, returning at-risk users, recommended safe replacements and action summaries. Self-hosted only: it is not registered on the hosted service at all, so no allowlist can enable it there.
create_schedule_rotationhigh riskCreates a rotation on a schedule, which determines who is on call and when.
update_schedule_rotationhigh riskUpdates an existing schedule rotation.
update_schedulehigh riskUpdates a schedule's configuration.
create_on_call_shadowhigh riskAdds someone to shadow an on-call shift.
update_on_call_shadowhigh riskUpdates an existing on-call shadow.
create_override_shifthigh riskCreates an override shift, putting a different person on call for a period.
update_override_shifthigh riskUpdates an existing override shift.
update_on_call_rolehigh riskUpdates an on-call role definition.
create_override_recommendationhigh riskCreates a recommendation that someone's shift be covered by another responder.
create_on_call_rolehigh riskCreates a new On-Call Role.
create_schedulewriteCreates a new schedule.
create_schedule_rotation_active_daywriteCreates a new schedule rotation active day.
create_schedule_rotation_userwriteCreates a new schedule rotation user.
get_shift_coverage_requestreadRetrieves a specific shift coverage request.
list_shift_coverage_requestsreadLists active shift coverage requests for a schedule.
list_catalogsreadLists the catalogs.
get_catalogreadRetrieves one catalog.
list_catalog_entitiesreadLists the entities in a catalog.
get_catalog_entityreadRetrieves one catalog entity.
list_servicesreadLists the services.
get_servicereadRetrieves one service.
get_service_incidents_chartreadReturns the incidents chart for a service.
get_service_uptime_chartreadReturns the uptime chart for a service.
list_functionalitiesreadLists the functionalities.
get_functionalityreadRetrieves one functionality.
get_functionality_incidents_chartreadReturns the incidents chart for a functionality.
get_functionality_uptime_chartreadReturns the uptime chart for a functionality.
list_environmentsreadLists the environments.
get_environmentreadRetrieves one environment.
list_severitiesreadLists the severity levels.
get_severityreadRetrieves one severity.
update_servicehigh riskUpdates a service definition, which routing and reporting depend on.
update_functionalityhigh riskUpdates a functionality definition.
update_environmenthigh riskUpdates an environment definition.
update_severityhigh riskUpdates a severity definition, which changes how future incidents are classified and paged.
create_catalogwriteCreates a new catalog.
create_catalog_entitywriteCreates a new Catalog Entity.
create_causewriteCreates a new cause.
create_environmentwriteCreates a new environment.
create_functionalitywriteCreates a new functionality.
create_incident_typewriteCreates a new incident type.
create_servicewriteCreates a new service.
create_severitywriteCreates a new severity.
update_catalogwriteUpdates a specific catalog by id.
update_catalog_entitywriteUpdates a specific Catalog Entity by id.
list_alertsreadLists alerts.
get_alertreadRetrieves one alert.
get_alert_by_short_idreadRetrieves an alert by its short ID, the form that appears in chat and paging messages.
list_alert_eventsreadLists alert events.
get_alert_eventreadRetrieves one alert event.
list_alert_groupsreadLists the alert groups.
get_alert_groupreadRetrieves one alert group.
list_alert_routing_rulesreadLists the alert routing rules.
get_alert_routing_rulereadRetrieves one alert routing rule.
list_alert_urgenciesreadLists the alert urgency levels.
get_alert_urgencyreadRetrieves one alert urgency.
list_incident_alertsreadLists the alerts linked to an incident.
create_alert_groupwriteCreates an alert group, which bundles related alerts together.
update_alert_groupwriteUpdates an existing alert group.
update_alert_eventwriteUpdates an alert event.
create_alert_routing_rulehigh riskCreates a routing rule that decides which alerts reach which people.
update_alert_routing_rulehigh riskUpdates a routing rule, which silently redirects paging without creating any incident.
attach_alertwriteAttaches alerts to an incident.
create_alertwriteCreates a new alert.
create_alert_eventwriteCreates a new alert event.
create_alert_routewriteCreates a new alert route.
create_alert_urgencywriteCreates a new alert urgency.
create_alerts_sourcewriteCreates a new alert source.
get_alert_routereadGets a specific alert route by id.
get_alerts_sourcereadRetrieves a specific alert source by id.
list_alert_routesreadLists all alert routes for the current team with filtering and pagination.
list_alerts_sourcesreadLists alert sources.
patch_alert_routewriteUpdates an alert route.
update_alertwriteUpdates an alert.
update_alert_routewriteUpdates a specific alert route by id.
update_alert_urgencywriteUpdates a specific alert urgency by id.
update_alerts_sourcewriteUpdates a specific alert source by id.
list_retrospective_processesreadLists the retrospective processes.
list_playbooksreadLists the playbooks.
get_playbookreadRetrieves one playbook.
update_retrospective_stepwriteUpdates an existing retrospective step.
create_retrospective_processwriteCreates a retrospective process, the template a retrospective follows.
update_retrospective_processwriteUpdates an existing retrospective process.
create_playbookwriteCreates a playbook.
update_playbookwriteUpdates an existing playbook.
update_playbook_taskwriteUpdates an existing playbook task.
get_incident_meeting_transcriptsreadReads what was said on an incident's calls (Rootly Meeting Scribe).
get_incident_retrospectivereadFetches the written retrospective for one incident.
get_incident_retrospective_stepreadRetrieves a specific incident retrospective step by id.
get_meeting_recordingreadRetrieves a single meeting recording session including its status, duration, speaker count, word count, and transcript summary.
get_retrospective_processreadRetrieves a specific retrospective process by id.
get_retrospective_process_groupreadRetrieves a specific Retrospective Process Group by id.
get_retrospective_stepreadRetrieves a specific retrospective step by id.
list_all_meeting_recordingsreadLists meeting recordings across the organization.
list_incident_post_mortemsreadBrowses retrospectives across incidents.
list_meeting_recordingsreadLists all meeting recording sessions for an incident.
update_incident_retrospective_stepwriteUpdates a specific incident retrospective step by id.
update_retrospective_process_groupwriteUpdates a specific Retrospective Process Group by id.
list_heartbeatsreadLists the heartbeats.
get_heartbeatreadRetrieves one heartbeat.
list_pulsesreadLists the pulses, the lightweight events Rootly records alongside incidents.
get_pulsereadRetrieves one pulse.
list_dashboardsreadLists the dashboards.
get_dashboardreadRetrieves one dashboard.
create_heartbeatwriteCreates a heartbeat that alerts when something stops reporting.
update_heartbeatwriteUpdates an existing heartbeat.
create_pulsewriteRecords a pulse event.
update_pulsewriteUpdates an existing pulse.
create_dashboardwriteCreates a dashboard.
update_dashboardwriteUpdates an existing dashboard.
update_dashboard_panelwriteUpdates an existing dashboard panel.
count_observability_logsreadCounts logs matching a Logs explorer query, grouped by service, index, severity or an attribute key (@http.status_code).
get_dashboard_panelreadRetrieves a specific dashboard panel by id.
get_live_call_routerreadRetrieves a specific Live Call Router by id.
list_live_call_routersreadLists Live Call Routers.
list_observability_logsreadSearches Rootly Observability logs with the Logs explorer query syntax (service:, severity:, index:, trace_id:, @attribute:value, OR inside field groups, - negation, * prefix, free text).
list_observability_patternsreadLists log patterns (clustered log templates) with counts against the previous window of the same length.
list_workflowsreadLists the workflows.
get_workflowreadRetrieves one workflow.
list_workflow_groupsreadLists the workflow groups.
get_workflow_groupreadRetrieves one workflow group.
list_workflow_tasksreadLists the tasks on a workflow.
get_workflow_taskreadRetrieves one workflow task.
list_workflow_runsreadLists workflow runs, which show what the automation has actually done.
list_workflow_form_field_conditionsreadLists the form field conditions that gate a workflow.
get_workflow_form_field_conditionreadRetrieves one workflow form field condition.
create_workflow_taskhigh riskAdds a task to a workflow, changing what the automation does when it fires.
update_workflow_taskhigh riskUpdates an existing workflow task.
update_workflowhigh riskUpdates a workflow, which runs automatically on real events with no human in the loop.
create_workflowwriteCreates a new workflow.
create_workflow_form_field_conditionwriteCreates a new workflow form field condition.
create_workflow_groupwriteCreates a new workflow group.
create_workflow_runwriteCreates a new workflow run.
get_playbook_taskreadRetrieves a specific playbook_task by id.
update_workflow_form_field_conditionwriteUpdates a specific workflow form field condition by id.
update_workflow_groupwriteUpdates a specific workflow group by id.
list_escalation_policiesreadLists the escalation policies.
get_escalation_policyreadRetrieves one escalation policy.
list_escalation_pathsreadLists the escalation paths.
get_escalation_pathreadRetrieves one escalation path.
list_escalation_levelsreadLists the escalation levels.
get_escalation_levelreadRetrieves one escalation level.
list_escalation_levels_pathsreadLists the paths behind a set of escalation levels.
update_escalation_policyhigh riskUpdates an escalation policy, which decides who gets paged.
update_escalation_pathhigh riskUpdates an escalation path.
update_escalation_levelhigh riskUpdates an escalation level, which can quietly remove the last person in a paging chain.
create_escalation_levelwriteCreates a new escalation level.
create_escalation_level_pathswriteCreates a new escalation level.
create_escalation_pathwriteCreates a new escalation path.
create_escalation_policywriteCreates a new escalation policy.
list_status_pagesreadLists the status pages.
get_status_pagereadRetrieves one status page.
list_status_page_templatesreadLists the status page templates.
get_status_page_templatereadRetrieves one status page template.
update_status_pagehigh riskUpdates a status page, which is public customer-facing content.
create_live_call_routerhigh riskCreates a live call router, which decides where an inbound call lands.
update_live_call_routerhigh riskUpdates an existing live call router.
create_status_pagewriteCreates a new status page.
create_status_page_templatewriteCreates a new template.
update_status_page_templatewriteUpdates a specific template event by id.
list_teamsreadLists the teams.
get_teamreadRetrieves one team.
get_team_incidents_chartreadReturns the incidents chart for a team.
list_usersreadLists the users.
get_userreadRetrieves one user.
get_current_userreadReturns the identity the connection is acting as, which is the quickest check on whether a global, team or personal token is in play.
update_teamhigh riskUpdates a team. User creation, deletion and role management are deliberately excluded from this surface.
create_teamwriteCreates a new team.
create_user_email_addresswriteCreates a new user email address.
create_user_notification_rulewriteCreates a new user notification rule.
create_user_phone_numberwriteCreates a new user phone number.
get_user_email_addressesreadRetrieves all email addresses for the specified user.
get_user_phone_numbersreadRetrieves all phone numbers for the specified user.
list_user_notification_rulesreadLists user notification rules.
list_custom_formsreadLists the custom forms.
get_custom_formreadRetrieves one custom form.
list_form_fieldsreadLists the form fields.
get_form_fieldreadRetrieves one form field.
list_form_field_optionsreadLists the options available on a form field.
get_form_field_optionreadRetrieves one form field option.
create_custom_fieldwriteCreates a new custom field (deprecated; use the form field tools instead).
create_custom_formwriteCreates a new custom form.
create_form_fieldwriteCreates a new form field.
create_form_field_optionwriteCreates a new form field option.
create_form_setwriteCreates a new form set.
create_incident_custom_field_selectionwriteCreates a new incident custom field selection (deprecated; use the form field tools instead).
get_custom_fieldreadRetrieves a specific custom_field by id.
get_custom_field_optionreadRetrieves a specific custom field option by id (deprecated; use the form field tools instead).
get_form_field_placementreadRetrieves a specific form_field_placement by id.
get_form_field_placement_conditionreadRetrieves a specific form_field_placement_condition by id.
get_form_setreadRetrieves a specific form set by id.
get_form_set_conditionreadRetrieves a specific form_set_condition by id.
get_incident_custom_field_selectionreadRetrieves a specific incident custom field selection by id (deprecated; use the form field tools instead).
list_custom_fieldsreadLists Custom fields (deprecated; use the form field tools instead).
list_form_setsreadLists form_sets.
list_incident_custom_field_selectionsreadLists incident custom field selections (deprecated; use the form field tools instead).
update_custom_fieldwriteUpdates a specific custom field by id (deprecated; use the form field tools instead).
update_custom_field_optionwriteUpdates a specific custom field option by id (deprecated; use the form field tools instead).
update_custom_formwriteUpdates a specific custom form by id.
update_form_fieldwriteUpdates a specific form field by id.
update_form_field_optionwriteUpdates a specific form field option by id.
update_form_field_placementwriteUpdates a specific form_field_placement by id.
update_form_field_placement_conditionwriteUpdates a specific form_field_placement_condition by id.
update_form_setwriteUpdates a specific form set by id.
update_form_set_conditionwriteUpdates a specific form_set_condition by id.
update_incident_custom_field_selectionwriteUpdates a specific incident custom field selection by id (deprecated; use the form field tools instead).
get_server_versionreadReturns the running Rootly MCP server version.
list_endpointsreadLists the endpoints the current configuration exposes, after any tool profile and allowlist have been applied.
list_auditsreadReads the Rootly audit log: who changed which configuration object, when, and what changed.

What Rootly MCP exposes

Rootly MCP groups its 261 tools into 12 categories, each with a suggested starting policy.

All 261 tools as JSON, ready to paste.

Category	Covers	Access	Suggested policy
On-call & Schedules	Schedules and their shifts, rotations with their users and active days, on-call shadows, override shifts, on-call roles, shift metrics, handoff summaries, responder availability checks, override recommendations and workload health risk	Read / Write	Override and rotation writes decide who gets paged. check_oncall_health_risk is self-hosted only and analyses named responders' workload, which is employee data: Rootly puts disclosure on the operator
Incidents	Listing, searching, collecting, creating and updating incidents, incident types, causes, action items, form field selections, plus TF-IDF similarity matching against historical incidents and solution mining from past resolutions	Read / Write	create_incident starts the real response process. update_incident is scoped to summary and retrospective progress only, which is narrower than the API and worth preserving
Catalog & Services	Catalogs and their entities, services and functionalities with incident and uptime charts, environments and severities	Read / Write	Mostly read. The update tools change the definitions that routing and reporting depend on, so a severity or service rename propagates everywhere
Alerts	Alerts and alert events, groups, routing rules, sources and urgencies, the alerts linked to an incident, and lookup by short ID	Read / Write	Routing rules decide which alerts reach which people. Creating or changing one silently redirects paging without any incident being created
Post-Incident	Post-incident reviews, retrospective steps and processes, and playbooks with their tasks	Read / Write	Writes here shape the organization's record of what happened and the process the next responder follows. Low operational risk, high documentary weight
Monitoring	Heartbeats, pulses, dashboards and dashboard panels, each with create, update and read tools	Read / Write	Heartbeats alert when a job stops reporting. There is no delete in the default surface, so an agent can add monitoring here but cannot remove it
Workflows	Workflows and their groups, workflow tasks, workflow runs and form field conditions	Read / Write	A workflow is automation that fires on real events. update_workflow and the task writes change what runs without a human in the loop afterwards
Escalation	Escalation policies, escalation paths, escalation levels and the paths behind a set of levels	Read / Write	These decide who gets paged at each step. Read them before changing them: a level update can quietly remove the last person in a chain
Status Pages & Comms	Status pages and their templates, communications templates, and live call routers	Read / Write	Status pages are public and live call routers decide where an inbound call lands. Both are customer-facing surfaces, so require approval on every write
Teams & Users	Teams with their incident charts, users, and the identity the connection is acting as	Read / Write	User creation, deletion and role management are deliberately excluded from this surface, so only update_team writes here. get_current_user confirms which token scope is actually in play
Forms	Custom forms, form fields and form field options	Read / Write	Read-only. Useful as the prerequisite for writing incident form field selections correctly
Meta	The running server version and the list of endpoints the current configuration exposes	Read	list_endpoints is the quickest way to confirm which tool profile and allowlist a connection actually ended up with

Connect Rootly MCP to your AI agent

Four steps, under ten minutes.

01
Sign in to NeuralTrust
Open the NeuralTrust platform, sign in and go to Getting started, then Connect your tools.
02
Choose your agent
When asked which agent you use, pick Claude Code, Codex, Cursor, Windsurf, Copilot or your own code.
03
Connect Rootly
Find Rootly in the tool list and connect it.
04
Connect your agent
Follow the steps on screen to add the config to your agent, then send the test prompt.

Permissions down to the single tool

You do not allow Rootly MCP or block it. You allow the exact tools each agent can call, one by one.

Rootly MCP	261 TOOLS AVAILABLE
Code review agent	4 tools, read only
Issue triage bot	9 tools
Platform team assistant	all 261 tools

Tool by toolConnecting the server is not the unit of access. Each tool is granted on its own.
Default denyA tool you have not enabled is never exposed to the agent.
Approval on writesTools that change or delete things can require a human to confirm.

Is Rootly MCP secure?

One endpoint instead of raw credentials. Every call is checked against policy and logged.

AI agentsConnect through your MCP client configuration.	NeuralTrustApply controls based on your configuration.	Rootly MCP261 tools generated by Rootly's MCP server in its default configuration (260 on the hosted service, where check_oncall_health_risk is unavailable), and a slim profile of about 70 high-usage tools is available with ?tool_profile=slim. Delete operations are disabled in the default surface, and API key management, user creation and deletion, role management and webhook configuration are excluded by design.
Coding assistants	Connection & credentialsper user	On-call & Schedules35 tools
Internal copilots	Tool access policiesdeny by default	Incidents32 tools
Workflow automations	Request & response inspectioninline	Alerts32 tools
Compatible MCP clients	Activity monitoringalerts and logs	All other tools162 tools