Code Breaks Fix it without leaving Slack
Open-source incident management for Slack. One command opens the channel, pulls in the right people, and captures everything as it happens. When it is over, the postmortem is already drafted.
Sign in with Slack
14 days free, no credit card. Viewers never cost anything.
-
AGPL-3.0, the whole thing
Not an open core with the useful parts held back. Read it, change it, keep the changes.
-
Your servers or ours
Let us run it and never patch or upgrade a thing. Or self-host the identical platform if you would rather.
-
One flat price, not per-seat math
Plans are sized by responders, the people who act on incidents. Everyone else follows along in Slack for free.
-
Integrates with anything
A versioned REST API, outbound webhooks, and an MCP server your AI agents can act through.
Incident management shouldn't be this painful
Your team already lives in Slack.
Incidents come with enough pressure. The process should not add more.
A stack held together with glue
An alerting tool, a chat thread, a doc template, a status page. You stitch them together with a process doc, and it comes apart in the heat of the moment.
The first 20 minutes go to setup
Opening the channel, finding the right people, posting the first update. By the time everyone is in the room, the incident has had a head start.
Answers buried in threads
Critical details are trapped in DMs, threads, and dashboards. Anyone joining late has to wade through hundreds of messages to learn what everyone else already knows.
The fix ships, the write-up waits
Someone still has to rebuild the timeline, chase the follow-ups, and write the postmortem, usually after hours. So it gets skipped, and the same incident comes back two months later.
Built to resolve. Designed for Slack.
FireFight connects your tools, teams, and timelines so every incident is captured, automated, and resolved without leaving your workflow.
Slack-Native Run every incident directly in Slack
FireFight lives where your team already works. Create incidents, assign roles, and post updates without leaving Slack.
Run incidents in SlackCapture incident timelinesAssign clear ownersStakeholders follow along without pinging you Integrations Webhooks & API that keep everything in sync
Subscribe to incident events with webhooks, or manage incidents programmatically through our REST API.
Stream incidents via webhooksSync monitoring and ticketsQuery data with APIKeep Slack always updated Postmortem Postmortems that write themselves
FireFight's AI turns every incident into a clear story you can learn from,
automatically pulling timelines, decisions, and Slack context into
one place.
AI-drafted timelineAssign follow-up ownersFind similar past incidentsPublish in minutes Catalogue Never wonder who owns what
Define your teams, services, and environments once, and attach the runbook each one needs. When an incident starts, the owner, the context, and the steps to take are already in the channel. No asking around, no stale spreadsheet.
Teams, services, and environmentsAn owner on every oneRunbooks attached automaticallyCustom catalog typesBuilt for retries, duplicates, flapping and alert storms
Monitoring tools do not send one clean alert. They send the same one five times, then four hundred at once at 3am. FireFight sorts that out before anyone is notified.
-
One alert, not five
However many times your monitoring resends the same alert, your team sees one and deals with one.
-
Flapping stays quiet
An alert that clears and comes straight back is still one problem. Nobody is notified twice for it.
-
Storms become one incident
When related alerts fire at once they land in one incident, with one channel and one timeline. Not forty channels with nobody in charge.
-
Noise cannot bury a real incident
A misconfigured monitor firing nonstop is held at the door. The alert that matters still gets through.
Give agents real access, without handing over the keys
Agents read the same incident record a responder sees, over MCP and the REST API.
Grant access capability by capability. Nothing runs unless you allowed it, and every attempt is recorded.
When an answer lives in Datadog, Grafana, Sentry or your database, FireFight asks for it there. It is not another place your logs, metrics and traces have to live.
Who is asking
Responders in Slack
/ff commands and dialogs
Your dashboard
Configure, review, approve
AI agents over MCP
Claude Code, Cursor, any MCP client
Scripts over the API
Service keys, webhooks
Ability Gateway
Permission
You granted this person or agent that exact ability
Connection
The tool is connected for that environment
Approval
High risk actions wait for a person to approve
Ledger
Every attempt is recorded, allowed or denied
What they can reach
Firefight discovers what each tool can do. You allowlist it. Nothing is on by default.
Code
- Pull requests merged before the alert
- The deploy that lines up with it
- A file, fetched on demand
Telemetry and errors
- Logs, metrics and traces
- Monitors and dashboards
- Error issues and releases
Issues and knowledge
- Runbooks pulled in as context
- Architecture pages
- Follow-up work opened from the incident
Databases
- Read-only data checks
- Schema and table lookups
- Scoped to one environment
Anything else that speaks MCP connects the same way, with no code from us Operational in minutes, not weeks
The process lives in the tool, not in one person's head.
A new joiner can run their first incident on day one.
Sign in
Create your FireFight account.
Install to Slack
Connect FireFight to Slack
Start responding
Declare your first incident
Set Up Your Team Before Your Next Incident Start Before Your Next Incident Average setup time: under 5 minutes
Don't trust us. Audit us.
Every line of FireFight is open source. Read how it handles your alerts, what it lets agents do, and what it keeps. Nothing we say on this page has to be taken on faith.
Star on GitHub
The things teams ask before they switch
If your question is not here, the answer is probably in the docs, and if it is not, we reply to every message.
-
Does everyone on the team need a paid seat?
No. Plans are flat and sized by responders, the people who act on an incident by declaring one, changing a status or severity, taking a role, or editing a postmortem. Everyone else can join the incident channel, read along, and post in the thread without ever costing anything or counting toward your plan.
See plans and pricing -
Is FireFight really open source, or is it open core?
The whole platform is AGPL-3.0. There is no separate paid edition of the source and no feature held back for the hosted version. If you self-host, you are running the same thing we run.
-
How long does setup actually take?
Sign in, install the Slack app, declare your first incident. There is nothing to configure beforehand, because statuses, severities, roles, and the incident form all ship with working defaults you can change whenever you want.
-
What does the AI do during an incident?
It keeps a running summary of the channel, so anyone joining late can run /ff catchup and be current in a few seconds. Mention it and it answers questions about the incident from that incident’s own record. When the incident closes it drafts the postmortem from the timeline and the discussion, and it will rewrite any passage of that draft when you tell it how.
-
Do you train AI models on our data?
No. We do not use your data to train AI models, and we do not use any provider or setting that would allow anyone else to. FireFight works one incident at a time, from that incident’s own channel and timeline, and nothing else in your workspace is touched. Known credential formats are stripped before anything is saved, and everything saved is encrypted. Self-host and none of it leaves your own infrastructure.
What is stored, what is redacted, and what reaches a model -
Can AI agents change things in our systems?
Only what you have explicitly granted. Every ability is given to a named agent for a named environment, nothing is on by default, and you can take any of it back at any time. Anything high risk waits for a person to approve it. Every attempt is recorded whether it was allowed or refused, so you can always see what an agent did and what it was stopped from doing.
How permissions, approvals and the activity record work -
What happens when the same alert fires ten times?
Your team sees one alert and one incident. An alert that clears and comes back is still that one alert, and a burst of related alerts becomes one incident with one channel. A monitor stuck firing nonstop is held back so a real alert still gets through.
How alerts are grouped and deduplicated -
Does it work with the tools we already run?
FireFight connects to GitHub, GitLab, Datadog, Grafana, New Relic, Sentry, Linear, Notion, Confluence, and Postgres on Neon, Supabase, or PlanetScale. Anything else that speaks MCP can be connected directly, and outbound webhooks plus a versioned REST API cover whatever is left.
-
What happens when the trial ends?
You are asked for a card. If you do not add one the workspace pauses, so no new incidents can be declared, and everything you already have stays exactly where it is until you reactivate.
-
What if we want to leave?
Cancel from your settings at any time. There is no contract and no cancellation fee. Your data is kept for 30 days in case you come back, then permanently deleted. If you would rather keep running FireFight without us, self-hosting is the same software.
Your next incident is already on its way
Install FireFight in your Slack today. Setup takes five minutes.
Sign in with Slack
14 days free, no credit card, cancel whenever you like. Or run it on your own servers.
Get notified when something ships