RootlyBLOCK
Rootly MCP server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://pypi.org/project/rootly-mcp-server/) [](https://pypi.org/project/rootly-mcp-server/) [](https://pypi.org/project/rootly-mcp-server/)
An MCP server for the Rootly API for Cursor, Windsurf, Claude, and other MCP clients.
Quick Start
Use the hosted MCP server. No local installation required.
Hosted Transport Options
- Streamable HTTP (recommended):
https://mcp.rootly.com/mcp - SSE (stable alternative):
https://mcp.rootly.com/sse - Code Mode:
https://mcp.rootly.com/mcp-codemode
Hosted tool profiles:
- Full (default): use the URLs above as-is
- Slim (~70 tools): add
?tool_profile=slimto the hosted URL, for examplehttps://mcp.rootly.com/mcp?tool_profile=slim - Header alternative: send
X-Rootly-Tool-Profile: slim - Server-wide default: set
ROOTLY_MCP_HOSTED_TOOL_PROFILE=full|slim - Exact custom override: set
ROOTLY_MCP_ENABLED_TOOLS=...
General Remote Setup
With OAuth2 (recommended):
{
"mcpServers": {
"rootly": {
"url": "https://mcp.rootly.com/mcp"
}
}
}Your MCP client handles OAuth2 login automatically — a browser window opens for you to authenticate with Rootly. No API token needed.
With API Token:
{
"mcpServers": {
"rootly": {
"url": "https://mcp.rootly.com/mcp",
"headers": {
"Authorization": "Bearer YOUR_ROOTLY_API_TOKEN"
}
}
}
}SSE (alternative):
{
"mcpServers": {
"rootly": {
"url": "https://mcp.rootly.com/sse"
}
}
}Code Mode:
``
829427cf8b02OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add rootly-mcp-server --env ROOTLY_API_TOKEN=${ROOTLY_API_TOKEN} -- None rootly-mcp-server==2.2.9Trust audit
BLOCKgrade F · trust 58/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
# postgres://user:pw@host -- the host stays, since it is usually the point
"postgres://svc:hunter2@db/x",
("postgres://svc:[email protected]:5432/rootly", "hunter2"),token = "valid_token_12345678901234567890"
token = "test_token_12345678901234567890"
secret = "eyJhbGciOiJIUzI1NiJ9supersecrettoken"
"$exception_list": [{"value": "token=ghp_abcdefghijklmnopqrstuvwxyz0123456789"}],"-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKC\n-----END RSA PRIVATE KEY-----",
"xoxb-1234567890-abcdef",
.plugin-scanner.toml
print(f"✅ API token found: {token[:10]}...")["../../v1/users", "foo/bar", "a b", "with\\slash", "..", "seg/../seg"],
result = await tools["get_incident"](incident_id="../../v1/users")
result = await tools["get_incident_meeting_transcripts"](incident_id="../../etc")
-e POSTHOG_HOST=http://127.0.0.1:9 \
Then connect an MCP client to `http://127.0.0.1:8000/mcp` and verify `tools/list` returns only:
base_url = f"http://127.0.0.1:{port}"- **Global API Key**: Full access across the Rootly instance. Best for organization-wide visibility.
- **Upstream Token Validation**: Validated Bearer tokens against the upstream Rootly API before granting MCP access, surfacing malformed or expired credentials at the edge with clearer errors
curl -LsSf https://astral.sh/uv/install.sh | sh
- **No `session_id` parameter in hosted tool schemas**: AgentCat session correlation now runs in the SDK's hook mode (`resolve_session_id`). The server derives the session from the request (always sco
**Major Expansion**: This version includes 50+ new endpoints covering communications, dashboards, playbooks, post-incident reviews, monitoring, and advanced form management - while carefully excluding
rootly-mcp-server-demo.gif
rootly_openapi.json
Gates applied: no_behavioural_pass.
829427cf8b02full audit observations/trust-audit/mcp-server/rootly-ai-labs__rootly.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 829427cf8b02 | BLOCK | F | 58 | first audit |
Questions
What is the Rootly MCP server?
Rootly MCP server
Is Rootly safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (58/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Rootly need?
It reads ONCALLHEALTH_API_KEY, POSTHOG_PROJECT_TOKEN, ROOTLY_API_TOKEN and ROOTLY_OPENAI_APPS_CHALLENGE_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Rootly run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as rootly-mcp-server.
How current is this page?
The grade is for one exact copy of the source (829427cf8b02), read on 2026-10-08. The repository is watched and re-audited when it changes.