Faultline

io.fltlnPublished by fltln.ioOfficial publisherv2.0.0Updated Nov 3, 2026

Check infrastructure health, manage incidents, and run runbooks in Faultline.

VerifiedStreamable HTTPWeb executableCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Faultline's hosted MCP server lets an assistant check infrastructure health, triage incidents, look up on-call staff and run approved runbooks.

What you can do
  • List services and read a single service with its recent checks
  • List and read incidents, including timeline, AI summary and post-mortem
  • Acknowledge or resolve incidents, with an optional note
  • Look up who is on call per schedule and list learned-baseline latency anomalies
  • Get a recommended next action and candidate runbooks for an incident
  • Execute a chosen runbook against an incident
When to use it
Useful for DevOps and SRE teams already on Faultline who want an assistant to give health overviews, explain why a service is slow, triage and remediate incidents, and answer on-call questions without switching tools.
Requirements
A remote Streamable HTTP endpoint; nothing to install locally. A Faultline account and an API key created under Settings → API Keys, sent as the X-API-Key header (or as a Bearer token). Tool discovery works without a key; every tool call needs one.
Before you install
The API key grants access to your tenant's monitoring and incident data, so treat it as a secret. run_runbook mutates infrastructure and can restart or scale services; acknowledging and resolving incidents also change state and may appear on your status page. The README says the server does not store the key and proxies it per request, and that mutations should wait for explicit confirmation.

Installation

In SourceWeft

  1. Open Faultline in the dashboard and add it to a workspace.
  2. Connect X-API-Key credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.fltln%2Ffaultline/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "faultline": {
      "type": "http",
      "url": "https://mcp.fltln.io/mcp",
      "headers": {
        "X-API-Key": "<YOUR_API_KEY>"
      }
    }
  }
}

README

Faultline MCP Server

Faultline is infrastructure monitoring and incident management for DevOps/SRE teams. This repo documents faultline-mcp, Faultline's remote MCP server, which lets AI agents (Claude, Claude Code, Claude Desktop, or anything MCP-compatible) operate Faultline: check infrastructure health, inspect and act on incidents, look up who's on call, and run approved runbooks.

This repo is documentation plus an Agent Skill. The server is hosted by Faultline at https://mcp.fltln.io/mcp (Streamable HTTP transport), so there's nothing to install or run yourself.

Setup

  1. Create an API key in Faultline: Settings → API Keys. Keys look like flt_....
  2. Point your MCP client at https://mcp.fltln.io/mcp, sending the key as either X-API-Key: flt_... or Authorization: Bearer flt_....

Claude Code:

bash
claude mcp add --transport http faultline-mcp https://mcp.fltln.io/mcp \  --header "X-API-Key: flt_..."

Clients that take raw JSON config (Claude Desktop, etc.):

json
{  "mcpServers": {    "faultline": {      "type": "http",      "url": "https://mcp.fltln.io/mcp",      "headers": { "X-API-Key": "flt_..." }    }  }}

Discovery without a key

You can browse the toolset before creating a key. The MCP discovery methods initialize, notifications/initialized, and tools/list work without an API key, so connector directories, registry scanners, and curious humans can see every tool's name, description, input schema, and annotations:

bash
curl -s https://mcp.fltln.io/mcp \  -H "Content-Type: application/json" \  -H "Accept: application/json, text/event-stream" \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Anything else, including every tools/call, needs a key and returns 401 without one.

Agent Skill

skills/faultline/SKILL.md is an Agent Skill that teaches Claude how to use these tools well:

  • Workflows: which tools to call for a health overview, "why is X slow?", incident triage and remediation, and on-call lookups.
  • Approval rules: read-only tools run freely; acknowledging, resolving, and running runbooks wait for your explicit go-ahead, and Claude only runs a runbook that diagnose_incident returned for that incident.

Install it alongside the MCP server:

  • Claude Code: copy the skills/faultline folder into ~/.claude/skills/ (all projects) or .claude/skills/ (one project).
  • Claude.ai / Claude Desktop: zip the faultline folder and upload it under Settings → Capabilities → Skills.

Tools

ToolWhat it does
list_servicesMonitor inventory with current status (optional status filter)
get_serviceOne service + its 10 most recent checks (for diagnosis)
list_incidentsOpen incidents (or status: "resolved" for history)
get_incidentFull incident record: timeline, AI summary, post-mortem
acknowledge_incidentAcknowledge an incident, which stops further escalation
resolve_incidentResolve with an optional note (recorded on the timeline and visible on your status page)
who_is_on_callCurrent on-call per schedule, with shift end time
list_anomaliesRecent learned-baseline latency anomalies (observed vs baseline, z-score, hours sustained, auto-opened incident if any)
diagnose_incidentRecommend the next action (run runbook / escalate / resolve / wait) + candidate runbooks. Analysis only; changes nothing
run_runbookExecute one chosen runbook against an incident. Mutates infrastructure (can restart/scale services)

Security

  • Scoped to your API key. The server never stores your key. It's used only for the duration of each request, proxied straight through to Faultline's API.
  • Keyless means read-only metadata. Requests without a key can only list the static tool definitions. They never reach Faultline's API and can't read or change any tenant data.
  • Approval-gated mutation. run_runbook is the only tool that changes infrastructure. Its description, and the Agent Skill, instruct the calling agent to use it only after diagnose_incident recommended it and you've explicitly confirmed.
  • Tenant-isolated. Every request is scoped to the tenant that owns the API key, so one key can never see or affect another tenant's data.

Support

Questions or issues: [email protected] or the Faultline dashboard.

[MCP Badge]

Source: README.md at commit e4eb376

Tools

10

list_services

List Services

List all monitored services with their current status (OK, DEGRADED, DOWN, PAUSED, PENDING). Call this first to get an overview of infrastructure health, or to find a service's ID.

Parametersstatus

get_service

Get Service

Get one service's details including its 10 most recent health checks (status codes, latency, errors). Call this when diagnosing WHY a service is degraded or down.

ParametersserviceIdrequired

list_incidents

List Incidents

List incidents — open ones by default, or recently resolved with status='resolved'. Call this when asked about outages, what's broken, or incident history.

Parametersstatus

get_incident

Get Incident

Get an incident's full record: timeline of every update, escalations, runbook results, AI summary, and post-mortem if drafted. Call this before acting on an incident.

ParametersincidentIdrequired

acknowledge_incident

Acknowledge Incident

Acknowledge an open incident, stopping further escalation. Call this when the user says they are looking into an incident or asks you to take ownership of it.

ParametersincidentIdrequired

resolve_incident

Resolve Incident

Mark an incident as resolved, with an optional note describing the fix. Only call this when the user confirms the underlying issue is fixed — resolving is a status-page-visible action.

ParametersnoteincidentIdrequired

who_is_on_call

Who Is On Call

Get the person currently on call for each on-call schedule, and when their shift ends. Call this when deciding who to contact about an incident.

Takes no parameters.

list_anomalies

List Anomalies

List recent learned-baseline latency anomalies: observed vs baseline response time, the deviation z-score, how many consecutive hours it has been sustained, and the incident it auto-opened (if any). Call this when asked why a service is slow, about latency spikes, or for early degradation signals that have not yet tripped a hard up/down threshold.

Takes no parameters.

diagnose_incident

Diagnose Incident

Analyze an open incident and recommend the next action: run a specific runbook, escalate to a human, resolve, or wait. Returns the recommendation (with rationale and confidence) and the candidate runbooks. This is analysis ONLY — it does not change anything. Call this to decide what to do about an incident; then confirm with the user before calling run_runbook.

ParametersincidentIdrequired

run_runbook

Run Runbook

Execute one specific runbook against an incident. This MUTATES INFRASTRUCTURE (it can restart or scale services). Only call after diagnose_incident recommended it AND the user has confirmed. Pass the runbookId from the diagnosis's recommendation or candidate list.

ParametersrunbookIdrequiredincidentIdrequired

Version history

1
  1. v2.0.0LatestSep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.