# FireFight

> Open-source incident management for Slack. One command opens the channel and starts the timeline. The AI drafts postmortems and finds similar past incidents.

FireFight is Slack-native incident management: declare incidents from Slack, assign roles, capture timelines automatically, and generate postmortems with AI. Self-host it or use the hosted version.

## When to use FireFight

Reach for FireFight when the job is one of these.

- Declare an incident out of an alert, a monitoring pipeline, CI, or a user report, and have the Slack channel, roles, and timeline set up in one call.
- Answer what is broken right now, at what severity, since when, and who is leading the response.
- Reconstruct what happened during a past incident, including its timeline, the alerts attached to it, and the postmortem.
- Find out who owns a service, or what it depends on, from the service catalog.
- Explain why an alert did or did not open an incident, by dry-running the routing rules without notifying anyone.
- Fetch the runbook for a failure mode and post its steps into the incident.
- Keep the service catalog in sync with the infrastructure you already describe elsewhere.
- Update an incident in flight, changing severity or status, assigning the lead, and resolving it when the response is over.

FireFight holds no on-call rotation and sends no phone pages, it is not a public status page, and it is Slack-native, so a team that does not use Slack gets little from it.

How to call it, shortest path first.

- MCP server (Streamable HTTP): POST https://app.firefight.app/mcp, manifest at https://firefight.app/.well-known/mcp.json
- REST API: https://app.firefight.app/api/v1, described by https://firefight.app/openapi.json
- Full agent instructions, including the rules of engagement: https://firefight.app/agents.md

## Core pages

- [Home](https://firefight.app/index.md): Product overview, pain points, features, and how it works
- [Pricing](https://firefight.app/pricing.md): flat plans at $99, $299, and $599 per month sized by responders, plus enterprise, every feature on every plan, AI credits included at 5 cents a credit, unlimited free viewers, self-hosting option
- [About](https://firefight.app/about.md): who builds FireFight, why the whole platform is AGPL-3.0, and what you can verify for yourself
- [Contact](https://firefight.app/contact.md): which email address covers sales, support, privacy, legal, and security reports
- [Developer resources](https://firefight.app/developers.md): the REST API, its OpenAPI description, the MCP server, webhooks, and API keys

## Blog

- [Introducing FireFight, Open-source incident management, built for Slack](https://firefight.app/blog/introducing-firefight.md): Declare an incident and FireFight handles everything around it, from creating the Slack channel to drafting the postmortem, so you can focus on the outage.

## Documentation

- [What is Firefight?](https://firefight.app/docs.md): Firefight is incident management that runs where your team already works, Slack.
- [AI data handling](https://firefight.app/docs/ai/data-handling.md): What conversation data Firefight stores for AI features, what is redacted before storage, and what is sent to AI models.
- [The incident responder](https://firefight.app/docs/ai/incident-responder.md): Mention @Firefight in an incident channel to get answers grounded in the incident's own record.
- [AI in Firefight](https://firefight.app/docs/ai/overview.md): The map of Firefight's AI features, from catch-up summaries and the incident responder to postmortem drafting.
- [Summaries & catch-up](https://firefight.app/docs/ai/summaries-and-catchup.md): How /ff catchup works, how the live summary stays current as the channel moves, and what both are built from.
- [The generic webhook source](https://firefight.app/docs/alerts/generic-webhook.md): Send alerts to Firefight from Datadog, Grafana, Prometheus Alertmanager, or any tool that can POST JSON.
- [Grouping & deduplication](https://firefight.app/docs/alerts/grouping-and-deduplication.md): How Firefight collapses repeat firings, flapping alerts, and alert storms into one alert and one incident.
- [How alerts work](https://firefight.app/docs/alerts/how-alerts-work.md): The pipeline that turns a webhook from your monitoring tool into a routed, deduplicated incident in Firefight.
- [Connect Northflank](https://firefight.app/docs/alerts/northflank.md): Route Northflank platform events like container crashes into Firefight with the dedicated integration.
- [Routing rules](https://firefight.app/docs/alerts/routing-rules.md): Conditions, outcomes, severity, and notification targets that decide what each incoming alert becomes.
- [Testing your routing](https://firefight.app/docs/alerts/testing-routing.md): Dry-run routing rules against sample alerts from the settings UI or a connected AI agent, without creating anything.
- [Connect an integration](https://firefight.app/docs/api/integrations.md): Connect GitHub, Linear, PlanetScale and other tools to Firefight, and choose exactly what each one is allowed to do.
- [Connect AI agents (MCP)](https://firefight.app/docs/api/mcp-server.md): Let AI agents investigate your incidents, alerts and catalog through Firefight's MCP server, and act through the tools you allow.
- [API overview](https://firefight.app/docs/api/overview.md): Authenticate with the Firefight REST API, understand the two key kinds, and make your first request.
- [Using the API](https://firefight.app/docs/api/using-the-api.md): Idempotent incident creation, error handling, pagination, and a worked create-then-update example.
- [Outbound webhooks](https://firefight.app/docs/api/webhooks.md): Push incident events to your own systems with signed webhook deliveries.
- [Entries, attributes & relationships](https://firefight.app/docs/catalog/entries-and-attributes.md): How to define catalog types and their attributes, add entries, link entries to each other, and sync entries from external tools.
- [Service catalog](https://firefight.app/docs/catalog/overview.md): A structured map of what you run, who owns it, and where to find them, so incidents route to the right people automatically.
- [Putting the catalog to work](https://firefight.app/docs/catalog/using-catalog.md): What a filled-in catalog buys you, from owning-team alert routing to catalog-backed incident fields and agent-readable ownership data.
- [Custom fields](https://firefight.app/docs/customization/custom-fields.md): Define reusable incident fields, choose where their options come from, and attach them to lifecycle forms.
- [Incident forms](https://firefight.app/docs/customization/incident-forms.md): Shape the dialogs responders see when they declare, accept, update, and resolve incidents.
- [Activity](https://firefight.app/docs/gateway/activity.md): The workspace audit log. Every configuration change and every action taken through a connected tool, who did it, from where, and whether it was allowed.
- [Agents](https://firefight.app/docs/gateway/agents.md): Give an AI agent its own name, its own token and its own abilities, so what it does in an incident is recorded as its work rather than a person's.
- [Approvals](https://firefight.app/docs/gateway/approvals.md): Some actions wait for a person to say yes before they run. See what is waiting, decide it from Slack or the dashboard, and keep a record of every decision.
- [The gateway](https://firefight.app/docs/gateway/overview.md): Every action that reaches a connected tool or changes your workspace passes through one gate, where you decide who may act, what needs a second pair of eyes, and see what happened.
- [Permissions](https://firefight.app/docs/gateway/permissions.md): Control what people and service keys are allowed to do in your connected tools, and in which environments.
- [Your first incident](https://firefight.app/docs/getting-started/your-first-incident.md): Declare, coordinate, and resolve an incident in Slack, end to end.
- [Statuses, severities & types](https://firefight.app/docs/incidents/concepts.md): The four concepts Firefight uses to describe every incident.
- [Incident roles](https://firefight.app/docs/incidents/incident-roles.md): Define the roles people take during an incident, like Incident Lead, and assign them from Slack.
- [Runbooks](https://firefight.app/docs/incidents/runbooks.md): Documented response procedures that attach themselves to matching incidents, turn into trackable action items, and feed AI agents the context they need.
- [Running an incident from the dashboard](https://firefight.app/docs/incidents/running-from-the-dashboard.md): Declare an incident, change its status, severity and roles, and resolve it, without switching to Slack.
- [Slack command reference](https://firefight.app/docs/incidents/slack-commands.md): Every /ff command and reaction shortcut in one place.
- [Editing & revisions](https://firefight.app/docs/postmortems/editing-and-revisions.md): Work in the rich text editor, change status, and browse or restore earlier revisions.
- [Generating with AI](https://firefight.app/docs/postmortems/generating-with-ai.md): Let AI draft the postmortem from the incident record, then refine it section by section.
- [Postmortems](https://firefight.app/docs/postmortems/overview.md): What a Firefight postmortem is, how it is structured, and how it moves from draft to completed.
- [Incident channels](https://firefight.app/docs/workspace/incident-channels.md): Choose when Firefight archives an incident's Slack channel after the incident ends, or keep channels open for good.
- [Incident conversations](https://firefight.app/docs/workspace/incident-conversations.md): Control whether AI agents can read what was said in an incident channel, and how long Firefight keeps those messages.
- [Members & access](https://firefight.app/docs/workspace/members-and-access.md): How people join your Firefight workspace and what owner, admin, and member access each allow.

## Changelog

- [Choose when incident channels are archived](https://firefight.app/changelog/2026-09-09-channel-archiving-delay.md): Set how long an incident channel stays open after the incident ends, from immediately to 30 days, or keep channels open for good.
- [Dashboard polish](https://firefight.app/changelog/2026-08-28-dashboard-polish.md): One card surface for every table, redesigned sign-in pages, and a clear way back when Slack disconnects.
- [The full timeline in Slack](https://firefight.app/changelog/2026-08-28-full-timeline-in-slack.md): /ff timeline pages through an incident's whole history, however long it ran.
- [Alert routing follows attribute roles](https://firefight.app/changelog/2026-08-28-routing-attribute-roles.md): Mark an attribute as Members, Manager or Notification channel, and routing targets the role rather than the name.
- [Postmortem edits no longer overwrite each other](https://firefight.app/changelog/2026-08-28-postmortem-conflicts.md): An agent saving a postmortem must name the version it edited, so a person's change is never lost.
- [Configure the whole workspace over the API and MCP](https://firefight.app/changelog/2026-08-28-configure-over-api-and-mcp.md): Everything you can set up in the dashboard, a script or an agent can now set up too.
- [Agents as first-class members](https://firefight.app/changelog/2026-08-28-agents-first-class.md): Create agents with their own tokens, let them work the incident, and choose whether they may read the transcript.
- [Approval rules you define](https://firefight.app/changelog/2026-08-28-approval-rules.md): Decide which abilities wait for a human, who decides, and where they are asked. The same rules now govern Slack and the dashboard.
- [AI notes on the timeline](https://firefight.app/changelog/2026-08-28-ai-timeline-notes.md): When an incident ends, Firefight AI notes what the team worked out, quoted and placed at the moment it was said.
- [Run an incident from the dashboard](https://firefight.app/changelog/2026-08-28-run-incidents-from-dashboard.md): Resolve, update, assign roles, escalate and invite from the incident page, with the same questions Slack asks.
- [GitHub, connected natively](https://firefight.app/changelog/2026-08-28-github-native.md): Install the Firefight GitHub App, pick your repositories, and give agents read-only code tools.
- [The Ability Gateway](https://firefight.app/changelog/2026-08-10-ability-gateway.md): Grant abilities person by person, hold risky actions for a human verdict, and see every attempt recorded.
- [AI agents can act, not just read](https://firefight.app/changelog/2026-08-10-agents-can-act.md): Connected agents can now maintain your catalogue, runbooks, routing and forms, with every change permitted and recorded.
- [Integrations, connected in one click](https://firefight.app/changelog/2026-08-10-integrations.md): Connect GitHub, Datadog, Linear, PlanetScale and more over OAuth, and choose exactly what each one is allowed to do.
- [Forms that ask only what applies](https://firefight.app/changelog/2026-08-10-conditional-forms.md): Fields can appear only when they are relevant, and new workspaces start with lean default forms.
- [Every role, assignable](https://firefight.app/changelog/2026-08-10-every-role-assignable.md): Assign your whole roster from one dialog in Slack, not just the Incident Lead.
- [Runbooks, worked step by step](https://firefight.app/changelog/2026-08-10-runbooks-step-by-step.md): Take a step, mark it done, and hand steps out from the full procedure, all from the channel.
- [Alerts, routed into incidents](https://firefight.app/changelog/2026-08-10-alerts.md): Point your monitoring at Firefight, and a noisy night becomes one incident and one conversation.
- [Runbooks](https://firefight.app/changelog/2026-07-22-runbooks.md): Documented response procedures that attach themselves to matching incidents and turn into trackable actions.
- [Declare and run incidents in Slack](https://firefight.app/changelog/2026-07-10-incident-response-in-slack.md): Declare, triage, and resolve incidents without leaving the channel you're already in.
- [AI postmortems, catch-up and live summaries](https://firefight.app/changelog/2026-07-10-ai-postmortems-and-summaries.md): Generated from the timeline you're already building, so you edit instead of writing from scratch.
- [Turn reactions into actions, follow-ups and shoutouts](https://firefight.app/changelog/2026-07-10-reactions-to-actions.md): React to a message and it becomes part of the record, no context-switching.
- [Incidents dashboard](https://firefight.app/changelog/2026-07-10-incidents-dashboard.md): A filterable view of every incident, with stats and MTTR.
- [Service catalogue, custom fields and forms](https://firefight.app/changelog/2026-07-10-service-catalogue.md): Model your services and shape incidents to your team's process.
- [Public REST API](https://firefight.app/changelog/2026-07-10-public-api.md): Create and manage incidents programmatically, with token auth and idempotency.
- [Outbound webhooks](https://firefight.app/changelog/2026-07-10-outbound-webhooks.md): Send incident events to your own systems, with signing and automatic retries.
- [Incident details page](https://firefight.app/changelog/2026-07-10-incident-details-page.md): A full web view of a single incident: timeline, actions and postmortem.
- [File attachments in the timeline](https://firefight.app/changelog/2026-07-10-timeline-attachments.md): Screenshots and files shared during an incident are captured in the timeline.
- [Multi-workspace switcher](https://firefight.app/changelog/2026-07-10-multi-workspace.md): Switch between the Slack workspaces you belong to from one account.
- [Open source and self-hostable](https://firefight.app/changelog/2026-07-10-open-source-self-host.md): FireFight is AGPL-3.0. Run it on your own infrastructure and bring your own model.

## Machine-readable

- [agents.md](https://firefight.app/agents.md): when to use FireFight, how to call it, and the rules of engagement
- [openapi.json](https://firefight.app/openapi.json): the REST API, every operation typed and named
- [openapi.yaml](https://firefight.app/openapi.yaml): the same document in YAML
- [mcp.json](https://firefight.app/.well-known/mcp.json): the MCP server manifest, Streamable HTTP
- [api-catalog](https://firefight.app/.well-known/api-catalog): both of the above as an RFC 9727 linkset
- [llms-full.txt](https://firefight.app/llms-full.txt): the full text of every page on this site
- [sitemap-index.xml](https://firefight.app/sitemap-index.xml): every URL on this site

## Optional

- [Blog index](https://firefight.app/blog/index.md)
- [Changelog index](https://firefight.app/changelog/index.md)
- [GitHub repo](https://github.com/FireFightLabs/firefight)
- [Hosted app](https://app.firefight.app/)