Which agents can I use?

Any agent that supports MCP, including Claude Code, Cursor, Codex and VS Code; Claude Desktop connects through the mcp-remote bridge. Anything else can use the REST API.

Should my agent get a read or a read_write key?

Start with read: it is enough to find the root cause of any incident. Use read_write only if you want it to acknowledge, resolve or pause alerts for you.

Revoke it in Cloud and your other keys keep working. Even a leaked key only exposes monitoring data, never your servers.

Can an agent change my servers?

No. Your agent only works with DockTail Cloud, and the DockTail agent on your hosts has no way to receive commands. Details at docktail.org/security.

MCP server · REST API

Agentic root cause analysis, end to end.

When something goes down, hand the incident to Claude Code, Cursor or Codex. It reads the evidence DockTail captured, finds what broke and why, and tells you how to fix it.

Connect an agent About DockTail Cloud

Claude Code · mcp: docktail

> grafana was down last night. Why?

● list_incidents(query: "grafana")

└ prod-01 · service_down · resolved
● get_incident(incident_id: 9f3c2a…)

└ exit 137 · oom · tailnet advertised, approved
● get_incident_logs(incident_id: 9f3c2a…)

└ 40 lines · fatal: runtime: out of memory

cause: Docker killed grafana on prod-01 at 14:22 because it ran out of memory (exit 137).
trigger: A failing Prometheus query blew up its memory; the log ends in "runtime: out of memory".
ruled out: The network: the service stayed advertised and approved on the tailnet.
fix: Raise grafana's memory limit or fix that dashboard query. It recovered on its own at 14:26.

MCP server

Your agent investigates outages on its own, from the coding agent you already use.

REST API

Pull the same incidents and evidence into your own scripts, CI or dashboards.

Copy Evidence for Agent

Every incident page copies the full evidence in one click, ready to paste into any agent.

Connect

Connect your agent once.

After that, every incident is one question away from its root cause.

1

Create an API key

A read-only key in Cloud is all your agent needs to investigate.
2

Add DockTail to your agent

Paste the snippet for your client, shown here.
3

Ask

Ask in plain words, like "What broke overnight, and why?"

terminal

claude mcp add --transport http docktail https://cloud.docktail.org/api/mcp \
  --header "Authorization: Bearer dtk_…"

claude_desktop_config.json

{
  "mcpServers": {
    "docktail": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://cloud.docktail.org/api/mcp",
        "--header",
        "Authorization:${DOCKTAIL_AUTH}"
      ],
      "env": {
        "DOCKTAIL_AUTH": "Bearer dtk_…"
      }
    }
  }
}

Claude Desktop connects through the mcp-remote bridge, which needs Node.js. Restart the app after saving.

~/.cursor/mcp.json

{
  "mcpServers": {
    "docktail": {
      "url": "https://cloud.docktail.org/api/mcp",
      "headers": {
        "Authorization": "Bearer dtk_…"
      }
    }
  }
}

~/.codex/config.toml

[mcp_servers.docktail]
url = "https://cloud.docktail.org/api/mcp"
bearer_token_env_var = "DOCKTAIL_API_KEY"

Set DOCKTAIL_API_KEY in the shell you start Codex from.

.vscode/mcp.json

{
  "servers": {
    "docktail": {
      "type": "http",
      "url": "https://cloud.docktail.org/api/mcp",
      "headers": {
        "Authorization": "Bearer ${input:docktail-key}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "docktail-key",
      "description": "DockTail Cloud API key",
      "password": true
    }
  ]
}

VS Code asks for your key the first time the server starts.

Or paste this prompt and let your agent set itself up.

Connect to my DockTail Cloud monitoring through its MCP server, then check on my fleet.

If the `docktail` MCP server isn't connected yet, add it (or tell me exactly what to add):
- URL: https://cloud.docktail.org/api/mcp (Streamable HTTP)
- Header: Authorization: Bearer <my DockTail API key, ask me for it>

Then:
1. Call get_workspace for the summary.
2. Call list_incidents with status=open and list_services with status=problems.
3. For anything broken, dig in with get_incident, get_incident_logs, get_host and list_events.
4. Tell me what's wrong, the most likely cause, and what to check or fix. Or that everything is healthy.

Only read: don't acknowledge or resolve incidents or start maintenance unless I ask.

Tools

Everything it needs to find the cause.

Your agent sees what you would see on the incident page: which checks failed, what Docker did, the logs from the moment it broke, and how the host was doing.

Fleet read

get_workspace

Gives the agent an overview of your workspace and fleet.
list_hosts

Lists your hosts and how each one is doing.
get_host

Shows a host's services, containers and recent incidents.
list_services

Finds the services that are failing, and from where.
get_service

Shows how one service has behaved over time.

Incidents read

list_incidents

Finds incidents by status, host, service or date.
get_incident

Returns everything DockTail saw when the incident opened.
get_incident_logs

Returns the container logs from the moment it failed.
list_events

Shows what changed on a host or service, and when.
list_maintenance_windows

Shows planned maintenance, so it isn't mistaken for an outage.

Actions read_write

acknowledge_incident

Tells your team someone is on it.
resolve_incident

Closes an incident once it's fixed.
start_maintenance

Pauses alerts while you work on a host or service.
stop_maintenance

Ends maintenance early and turns alerts back on.

Your agent only gets these with a read_write key.

REST API

Use the evidence in your own tools.

The REST API returns the same incidents and evidence, so your scripts, CI and dashboards can react to outages too.

terminal

curl https://cloud.docktail.org/api/v1/incidents \
  -H "Authorization: Bearer $DOCKTAIL_API_KEY"

{ "incidents": [{
    "id": "9f3c2a…",
    "kind": "service_down", "status": "resolved",
    "summary": "Container was OOM-killed by Docker (exit 137).",
    "serviceName": "grafana", "hostName": "prod-01",
    "exitCode": 137, …
}], …}

Endpoints /api/v1

GET /workspace read
GET /hosts · /hosts/{id} read
GET /services · /services/{id} read
GET /incidents · /incidents/{id} · /incidents/{id}/logs read
GET /events · /maintenance read
POST /incidents/{id}/ack · /incidents/{id}/resolve read_write
POST /maintenance/start · /maintenance/stop read_write

Boundaries

Your agent can look, not touch.

An API key shows your agent what your dashboard shows you, and nothing else.

It sees what Cloud sees

Hosts, services, incidents and the logs captured when something broke.

It can't run anything on your servers

Neither the API nor the DockTail agent on your hosts has any way to run commands or deploy.

Changes need your permission

Only a read_write key can acknowledge, resolve or pause alerts, and every change is logged under that key.

What the DockTail agent sends →

Pricing

Included on every plan.

Your agent can start finding root causes during the 30-day trial, and you never pay per call.

Start 30-day trial Compare plans →

Questions

Before you hand over a key.

Which agents can I use?: Any agent that supports MCP, including Claude Code, Cursor, Codex and VS Code; Claude Desktop connects through the mcp-remote bridge. Anything else can use the REST API.
Should my agent get a read or a read_write key?: Start with read: it is enough to find the root cause of any incident. Use read_write only if you want it to acknowledge, resolve or pause alerts for you.
What if a key leaks?: Revoke it in Cloud and your other keys keep working. Even a leaked key only exposes monitoring data, never your servers.
Can an agent change my servers?: No. Your agent only works with DockTail Cloud, and the DockTail agent on your hosts has no way to receive commands. What it sends →

Let your agent take the next outage.

Start a trial, connect your hosts, and next time something breaks, ask your agent why.

Start 30-day trial What Cloud watches

Agentic root cause analysis, end to end.

MCP server

REST API

Copy Evidence for Agent

Connect your agent once.

Create an API key

Add DockTail to your agent

Ask

Everything it needs to find the cause.

Use the evidence in your own tools.

Your agent can look, not touch.

Included on every plan.

Before you hand over a key.

Let your agent take the next outage.