{
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json",
  "name": "app.firefight/firefight",
  "description": "Investigate, run and configure FireFight incidents, alerts, catalog and runbooks.",
  "version": "1.0.0",
  "websiteUrl": "https://firefight.app/docs/api/mcp-server",
  "repository": {
    "url": "https://github.com/FireFightLabs/firefight",
    "source": "github"
  },
  "remotes": [
    {
      "type": "streamable-http",
      "url": "https://app.firefight.app/mcp",
      "headers": [
        {
          "name": "Authorization",
          "description": "Bearer <FireFight API key>. Only needed for headless clients. Clients that support MCP OAuth should omit this and authorize interactively instead.",
          "isRequired": false,
          "isSecret": true,
          "format": "string"
        }
      ]
    }
  ],
  "_meta": {
    "io.modelcontextprotocol.registry/publisher-provided": {
      "documentation": "https://firefight.app/docs/api/mcp-server",
      "authentication": {
        "oauth": {
          "protectedResourceMetadata": "https://app.firefight.app/.well-known/oauth-protected-resource",
          "authorizationServerMetadata": "https://app.firefight.app/.well-known/oauth-authorization-server",
          "dynamicClientRegistration": true,
          "pkceRequired": true
        },
        "apiKey": {
          "header": "Authorization",
          "scheme": "Bearer",
          "tokenPrefix": "ff_",
          "createdAt": "https://app.firefight.app/app/settings/api-keys"
        }
      },
      "rateLimit": {
        "requestsPerMinute": 1000,
        "scope": "per token"
      },
      "tools": {
        "read": [
          "evaluate_routing",
          "get_form",
          "get_incident",
          "get_incident_transcript",
          "get_postmortem",
          "get_runbook",
          "get_workspace_config",
          "list_abilities",
          "list_agents",
          "list_api_keys",
          "list_principals",
          "search_activity",
          "search_alerts",
          "search_approvals",
          "search_catalog",
          "search_incidents",
          "search_runbooks"
        ],
        "write": [
          "approve_approval",
          "assign_action_item",
          "assign_incident_role",
          "attach_runbook",
          "cancel_incident",
          "claim_runbook_step",
          "complete_action_item",
          "create_action_item",
          "declare_incident",
          "delete_agent",
          "delete_alert_source",
          "delete_api_key",
          "delete_approval_rule",
          "delete_catalog_entry",
          "delete_catalog_type",
          "delete_incident_role",
          "delete_incident_type",
          "delete_permission_set",
          "delete_routing_rule",
          "delete_severity",
          "delete_status",
          "delete_webhook",
          "deny_approval",
          "dismiss_timeline_note",
          "escalate_incident",
          "give_shoutout",
          "grant_ability",
          "invite_responders",
          "link_incident",
          "post_incident_update",
          "reopen_incident",
          "resolve_incident",
          "revoke_agent_token",
          "revoke_grant",
          "rotate_agent_token",
          "set_postmortem_status",
          "start_postmortem",
          "update_postmortem",
          "update_routing_config",
          "upsert_agent",
          "upsert_alert_source",
          "upsert_api_key",
          "upsert_approval_rule",
          "upsert_catalog_entry",
          "upsert_catalog_type",
          "upsert_custom_field",
          "upsert_form_field",
          "upsert_incident_role",
          "upsert_incident_type",
          "upsert_permission_set",
          "upsert_routing_rule",
          "upsert_runbook",
          "upsert_severity",
          "upsert_status",
          "upsert_webhook"
        ]
      },
      "whenToUse": "Use this server to investigate what is happening in a FireFight workspace during or after an incident, to take part in one by raising and picking up work, pulling people in and closing it out, to look up who owns a service or how an alert routed, and to configure the workspace itself. A connection reaches exactly one workspace.",
      "restApi": "https://firefight.app/openapi.json"
    }
  }
}