# Incident Investigator

> Stateful MCP server for incident investigation: dynamic evidence planning, competing hypotheses, confidence scoring, timelines, blast radius, and postmortems. Works with Cursor, Claude Code, Codex, and any MCP client.

- **Type:** MCP server
- **Install:** `agentstack add mcp-stackrail-io-incident-investigator`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [stackrail-io](https://agentstack.voostack.com/s/stackrail-io)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [stackrail-io](https://github.com/stackrail-io)
- **Source:** https://github.com/stackrail-io/Incident-Investigator
- **Website:** https://stackrail.io/

## Install

```sh
agentstack add mcp-stackrail-io-incident-investigator
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Incident Investigator

**LLMs collect evidence. Incident Investigator conducts investigations.**

```
        Claude / Codex
              │
              ▼
      Collect Evidence
              │
              ▼
   Incident Investigator
   ├── Protocol
   ├── Questions
   ├── Investigation Graph
   ├── Reasoners
   └── Intelligence
              │
              ▼
    Structured Findings
              │
              ▼
        Claude / Codex
```

An open-source **investigation runtime** ([MCP](https://modelcontextprotocol.io) server). Not an AI agent—a stateful engine that turns vendor-neutral evidence into hypotheses, confidence, and explainable conclusions.

The assistant gathers from Datadog, Kubernetes, logs, or anywhere else. The runtime owns the investigation: what to ask next, what you still need, when you can conclude, and why.

**No connectors in core.** Evidence categories in; structured findings out.

## Quick start

```bash
go install github.com/stackrail/incident-investigator/cmd/incident-investigator@latest
```

Wire it as an MCP server in Claude Code, Codex, or Cursor → [plugins/incident-investigator/](plugins/incident-investigator/).

### Persistence (optional)

By default investigations live in memory for the process lifetime. For durable storage across restarts:

```bash
export II_PERSISTENCE_TYPE=sqlite
export II_PERSISTENCE_PATH=~/.incident-investigator/runtime.db
incident-investigator
```

Docker Compose and the plugin Docker launcher configure SQLite automatically. See [docs/persistence.md](docs/persistence.md).

### MCP tools

The server exposes 34 MCP tools over stdio. Run `incident-investigator help` for the full list.

| Category | Tools |
| --- | --- |
| Investigation | `start_investigation`, `submit_evidence`, `get_investigation_status`, `finish_investigation` |
| Protocol | `get_investigation_plan`, `list_open_questions`, `resolve_question`, `explain_investigation` |
| Reasoning | `explain_reasoning`, `get_reasoning_cycles` |
| Graph | `get_graph`, `query_graph`, `get_subgraph`, `explain_path` |
| Intelligence | `find_similar_investigations`, `suggest_patterns`, `calibrate_confidence` |
| Persistence | `list_investigations`, `resume_investigation`, `archive_investigation`, `delete_investigation`, `export_investigation`, `import_investigation` |
| Resolution | `generate_resolution`, `get_resolution`, `export_resolution`, `list_resolutions`, `update_resolution_status`, `get_resolution_metrics` |
| Publishing | `publish_resolution`, `list_publish_history`, `retry_failed_publishes`, `list_dead_letter_publishes`, `retry_dead_letter_publish` |

Persistence and resolution data survive process restarts when `II_PERSISTENCE_TYPE=sqlite` is set. Publish history and dead-letter records use the same SQLite database when publishing is enabled (`II_PUBLISH_ENABLED=true`). With the default in-memory backend, recovery and resolution tools still work for the lifetime of the server process; publish audit state is ephemeral until SQLite persistence is configured. See [docs/persistence.md](docs/persistence.md) and [docs/resolution-engine.md](docs/resolution-engine.md).

Completed investigations are indexed for intelligence similarity on `finish_investigation`, `archive_investigation` (when completed), and server startup (from persisted outcomes).

```bash
git clone https://github.com/stackrail-io/Incident-Investigator.git && cd Incident-Investigator
go test ./...
```

## Documentation

| | |
| --- | --- |
| [docs/README.md](docs/README.md) | **Documentation index** |
| [Philosophy](docs/philosophy.md) | Why the project exists |
| [Architecture](docs/architecture.md) | How it fits together |
| [Development](docs/development.md) | Extend reasoners, archetypes, playbooks |
| [Persistence](docs/persistence.md) | Durable storage, recovery MCP tools, export/import |
| [Resolution Engine](docs/resolution-engine.md) | Action items and lessons from completed investigations |
| [Specification](spec/investigation-v1/SPECIFICATION.md) | Portable protocol contract |
| [Examples](examples/) | Seven replayable investigations |

## Contributing

[CONTRIBUTING.md](CONTRIBUTING.md) · [ROADMAP.md](ROADMAP.md)

## License

MIT — [LICENSE](LICENSE)

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [stackrail-io](https://github.com/stackrail-io)
- **Source:** [stackrail-io/Incident-Investigator](https://github.com/stackrail-io/Incident-Investigator)
- **License:** MIT
- **Homepage:** https://stackrail.io/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-stackrail-io-incident-investigator
- Seller: https://agentstack.voostack.com/s/stackrail-io
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.