Developers
FireFight developer resources
FireFight is open-source incident management that runs in Slack, and everything the product does is reachable programmatically. There is a versioned REST API for pipelines and services, an MCP server for AI agents, and outbound webhooks for pushing events into your own systems. This page is the index of all of it, and every link here is a stable URL you can bookmark or hand to an agent.
Machine-readable, at predictable URLs
| Resource | URL |
|---|---|
| OpenAPI description Every REST operation, typed, with a unique operation ID | /openapi.json /openapi.yaml |
| MCP server manifest The Streamable HTTP endpoint and how to authenticate | /.well-known/mcp.json |
| API catalog Both of the above as an RFC 9727 linkset | /.well-known/api-catalog |
| Agent instructions When to reach for FireFight and how to call it | /agents.md |
| Site index for AI clients Every page linked, and every page in full | /llms.txt /llms-full.txt |
The REST API
Every endpoint lives under a versioned path at https://app.firefight.app/api/v1.
You can read and write incidents, read the severities, statuses, types, and custom fields your
workspace has configured, read runbooks, and manage service catalog entries. Breaking changes
ship as a new version, so v1 responses stay stable.
Authentication is a bearer token on every request. Create a key under Settings then API Keys in the app. A service key is a standalone integration identity carrying only the permissions you grant it, and a personal token acts as you.
- API overview, covering keys, permissions, and your first request
- Using the API, covering idempotent incident creation, errors, and pagination
- Permissions, covering what an agent or key is allowed to do
- The OpenAPI description, which loads straight into a client generator or a function-calling tool list
The MCP server
FireFight ships a Model Context Protocol server, so
an AI agent can investigate incidents, inspect alerts and how they routed, look up ownership in
the catalog, dry-run routing rules, and act through the tools you allow. It speaks Streamable
HTTP at https://app.firefight.app/mcp.
Interactive clients authorize over OAuth with dynamic client registration and PKCE. Headless agents pass an API key as a bearer token instead. Everything an agent does is recorded.
- Connect AI agents over MCP, with the full tool list
- Connect an integration, which adds that tool to the same connection
Webhooks
Rather than polling, subscribe to events and have FireFight push them to you. Each delivery is signed with the webhook's own secret, and every webhook keeps a delivery history you can inspect and replay from settings.
- Outbound webhooks, with the event list and the signature scheme
Running it yourself
The whole platform is AGPL-3.0. Self-hosting gives you the same API and the same MCP server on your own host, so the second server entry in the OpenAPI description is a template you fill in with your own domain.
Getting help
Ask in the community Slack, open a GitHub issue, or email hello@firefight.app. The contact page lists which address goes where.