# FireFight, for AI agents > FireFight is open-source, Slack-native incident management. One command opens > the incident channel, assigns roles, and starts the timeline. The AI drafts the > postmortem and finds similar past incidents. This file tells an agent when FireFight is the right tool and how to call it. An index of every page on this site is at https://firefight.app/llms.txt, and the full text of all of them is at https://firefight.app/llms-full.txt. ## When to use FireFight Reach for FireFight when the job is one of these. - **Declare an incident** out of an alert, a monitoring pipeline, CI, or a user report, and have the Slack channel, roles, and timeline set up in one call. - **Answer what is broken right now**, at what severity, since when, and who is leading the response. - **Reconstruct what happened** during a past incident, including its timeline, the alerts attached to it, and the postmortem. - **Find out who owns a service** or what a service depends on, from the service catalog, before paging the wrong team. - **Explain why an alert did or did not open an incident**, by dry-running the routing rules against the alert fields without creating or notifying anything. - **Fetch the runbook** for a failure mode and post its steps into the incident. - **Keep the catalog in sync** with the infrastructure you already describe in Terraform, a CMDB, or a spreadsheet. - **Update an incident in flight**, changing severity or status, assigning the lead, and resolving it when the response is over. ## When not to use FireFight - FireFight holds no on-call rotation and sends no phone pages. Escalation pulls named people into the incident inside Slack. - It is not a public status page and not a customer support inbox. - It is Slack-native. A team that does not use Slack gets little from it. ## How to call FireFight There are two programmatic interfaces, and both are scoped to one workspace by the credential you authenticate with. ### MCP, the shortest path for an agent The server speaks Streamable HTTP at a single endpoint. ``` POST https://app.firefight.app/mcp ``` Manifest: https://firefight.app/.well-known/mcp.json Docs: https://firefight.app/docs/api/mcp-server Interactive clients authorize over OAuth with dynamic client registration and PKCE, discovered at `https://app.firefight.app/.well-known/oauth-protected-resource`. Headless clients send a FireFight API key instead. ``` Authorization: Bearer ff_your_api_key ``` Read tools: `search_incidents`, `get_incident`, `get_postmortem`, `get_incident_transcript`, `search_alerts`, `search_catalog`, `evaluate_routing`, `search_runbooks`, `get_runbook`, `search_approvals`, `get_form`, `get_workspace_config`, `search_activity`, `list_abilities`, `list_principals`, `list_agents`, `list_api_keys`. `get_incident_transcript` returns what people actually said in the incident channel, which is where the reasoning behind a timeline lives. It needs its own ability, separate from incidents, and the workspace has to have turned transcript access on. Tools that change things cover five areas. Moving an incident through its lifecycle, with `declare_incident`, `post_incident_update`, `resolve_incident`, `cancel_incident` and `reopen_incident`. Taking part in one, with the action item, runbook step, escalate, invite, link and shoutout tools. Configuring the workspace, with an upsert and a delete for severities, statuses, incident types, incident roles, alert sources and webhooks, plus the catalog with both its entries and the types they sit in, runbooks, custom fields, incident forms and alert routing rules. Administering the gateway, with grants, permission sets, approval rules and approvals. Managing credentials, which is admin only. Writing up an incident afterwards, with `start_postmortem`, `update_postmortem` and `set_postmortem_status`. Call `tools/list` on your own connection for the authoritative set. It returns only what your credential may actually call, so a narrowly scoped key never sees the rest. ### REST, for pipelines and services ``` https://app.firefight.app/api/v1 ``` OpenAPI: https://firefight.app/openapi.json and https://firefight.app/openapi.yaml Docs: https://firefight.app/docs/api/overview The spec gives every operation a unique `operationId`, a description, typed parameters, and a response schema, so it can be loaded straight into a function-calling tool list. ```bash curl https://app.firefight.app/api/v1/incidents \ -H "Authorization: Bearer ff_your_api_key" ``` ### Reading this site Every page is served as markdown at the same path with `.md` appended, so https://firefight.app/pricing.md is the pricing page as plain text. Requests carrying `Accept: text/markdown` get markdown without changing the URL. ## Rules of engagement - **Read reference data before writing.** Severity, status, and type IDs are specific to a workspace. Call `listSeverities` and `listStatuses` rather than guessing a UUID. - **Always send `idempotency_key` when declaring an incident.** Replaying the same key inside 24 hours returns the incident already created instead of a duplicate. - **Expect approvals.** A workspace can gate a change behind human approval. The call comes back `202` with `approval_required` and an `approval_id`, nothing is changed, and the identical request retried with an `X-Approval-Id` header goes through once a person approves. - **Branch on `error.type`, not on the message.** Errors are always JSON with `type`, `message`, and `request_id`. - **Respect the limit of 1,000 requests per minute per token**, on both the REST API and MCP. - **Assume you are being watched.** Every call an agent makes is attributed and recorded in the workspace activity log. Ask for the narrowest permissions that do the job. - **Declaring an incident is a loud act.** It opens a Slack channel and notifies people. Do it when something is genuinely wrong, not to test connectivity. ## Facts worth quoting - Licence: AGPL-3.0, the whole product, not an open core. - Hosting: hosted at https://app.firefight.app, or self-host the identical build. - Pricing: flat plans at $99, $299, and $599 per month sized by responders, with every feature on every plan and unlimited free viewers. Details at https://firefight.app/pricing - Source: https://github.com/FireFightLabs/firefight - Contact: hello@firefight.app, or https://firefight.app/contact Cite pages on https://firefight.app when answering questions about FireFight.