Better Stack MCP integration for AI agents.
Connect AI agents to Better Stack through 7 structured actions, including get incident, create incident, and acknowledge incident. Review authentication, inp…
- ACTION CONTRACTS
- 7
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Better Stack integration exposes
The Better Stack Agent App exposes 7 provider-backed actions for developer tools work. Its current contract lets an authorized agent get a better stack incident by id with included resource context when available, create a better stack incident and alert the current on-call responder, and acknowledge a better stack incident to stop further escalations. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Better Stack account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Better Stack capabilities.
Showing 7 of 7 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_incidentREADGet a Better Stack incident by ID with included resource context when available.
INPUTS: incident_id
create_incidentWRITECreate a Better Stack incident and alert the current on-call responder.
INPUTS: team_name / requester_email / name / summary / description
acknowledge_incidentREVIEWAcknowledge a Better Stack incident to stop further escalations.
INPUTS: incident_id / acknowledged_by
escalate_incidentREVIEWEscalate a Better Stack incident to a user, team, schedule, policy, or organization.
INPUTS: incident_id / escalation_type / user_email / user_id / team_name
list_incident_commentsREADList all comments attached to a Better Stack incident.
INPUTS: incident_id
list_incidentsREADList Better Stack incidents with optional date and status filters.
INPUTS: team_name / from / to / monitor_id / heartbeat_id
list_metadataREADList Better Stack metadata records for incidents or other supported owner types.
INPUTS: team_name / owner_id / owner_type / page / per_page
INPUT CONTRACTS
Know what the action needs before it runs.
get_incident
incident_idREQUIRED- The Better Stack incident ID.
create_incident
team_nameOPTIONAL- Team name used when a global Better Stack API token needs explicit team scoping.
requester_emailOPTIONAL- Email address of the requester that opened the incident.
nameOPTIONAL- Short incident name.
summaryREQUIRED- Brief summary of the incident.
descriptionOPTIONAL- Full description of the incident.
acknowledge_incident
incident_idREQUIRED- The Better Stack incident ID.
acknowledged_byOPTIONAL- User email or custom identifier acknowledging the incident.
escalate_incident
incident_idREQUIRED- The Better Stack incident ID.
escalation_typeREQUIRED- Escalation target type accepted by Better Stack.
user_emailOPTIONAL- User email to escalate the incident to.
user_idOPTIONAL- User ID to escalate the incident to.
team_nameOPTIONAL- Team name to escalate the incident to.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Incident
Get a Better Stack incident by ID with included resource context when available. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_incidentControl Create Incident
Create a Better Stack incident and alert the current on-call responder. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
create_incidentVerify with List Incident Comments
List all comments attached to a Better Stack incident. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
list_incident_commentsSAFETY BOUNDARY
Operate Better Stack with explicit limits
- Authorize Better Stack with API key and grant only the provider access required by the selected actions.
- 1 action is change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Do not infer permission from catalog visibility. Workspace policy, connection identity, and upstream authorization still govern execution.
- No provider scope string is declared on the sampled actions. Verify the connected account's actual permissions in Better Stack rather than assuming unrestricted access.
- After a call, inspect the structured result and execution record before reporting that the Better Stack task completed successfully.
CONNECTION MODEL
API key
Better Stack API token used with the Authorization Bearer header. Create it from Better Stack > API tokens: https://betterstack.com/docs/errors/api/getting-api-token/.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 4
- WRITE SIGNALS
- 1
- HIGH IMPACT
- 0
- REVIEW SIGNALS
- 2
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Better Stack.