Tools to investigate alerts, check recent changes and follow the runbook.
Built for: The engineer holding the pager who has to be useful in the first ten minutes, at two in the morning.
The button opens the checkout, where the 6 servers and 4 skills are listed one by one. Every member is free, so the checkout lists them and asks for no card.
The reason to buy a stack rather than five listings: each line below needs more than one member connected at the same time.
Read the alert and the metric behind it in Datadog or Prometheus, and say what the series looked like before it fired.
Inspect pods, deployments and services on the cluster and name the one that restarted.
Search LogScale for the window around the alert instead of scrolling a console by hand.
Post the state of play into the Discord channel that is already asking, in the format your team writes updates in.
What each part contributes, and why it was picked over the obvious alternative. Prices and permissions are read from the listings, so nothing here can disagree with the catalogue.
The Datadog API where the alert and its dashboards live, so the first question — what is on fire — is answered from the source.
Queries the series directly, which is what you need when the dashboard shows a spike and you want the raw numbers behind it.
Inspects and manages pods, deployments and services — the layer where most pages turn out to have started.
Ties the page to the release: errors, events and the deploy that preceded them, which is the fastest correlation available in an incident.
The channel the incident is already being discussed in, so the update lands where people are looking rather than in a document nobody opens.
Queries CrowdStrike LogScale for the window around the alert, which beats scrolling a log console at two in the morning.
Keeps the runbook in one shape — service, alert table, dashboards, copy-pasteable procedures — so the page is answered from a document rather than from memory.
Writes the incident update in the format your company already uses, which is what stops the status post from becoming its own argument.
The other half of on call: after the incident, the structured logging and metrics that would have made this page shorter.
Keeps the first ten minutes systematic — evidence, hypothesis, test — instead of restarting things until the graph looks better.
Every member is free, so the monthly figure is $0 whatever you do with the stack: nothing here is billed by the call, and only adding a paid member could change it.
| Part | What you are paying for | Monthly, as quoted |
|---|---|---|
| Datadog | Free | — |
| Prometheus | Free | — |
| Kubernetes | Free | — |
| Sentry | Free | — |
| Discord | Free | — |
| Logscale | Free | — |
| Skills | ||
| Engineering Runbook | Free · context cost only | — |
| Internal Comms | Free · context cost only | — |
| Python Observability | Free · context cost only | — |
| Debugging and Error Recovery | Free · context cost only | — |
| Everything above | $0 of servers plus $0 of skills, the same in a quiet month and a busy one | $0/mo |
Subscriptions at their monthly plan price; one-off licences spread over 12 months.
Install only these and the bill is nothing: 6 servers and 4 skills, and all 3 tools.
Nothing in this stack carries a call allowance, so nothing here can run out before the month does. The bill is decided when you install it, not when you use it.
The spend cap is one figure for the whole account, set in your dashboard and checked when an order is placed. On the call path what stops a retry loop is the plan's call allowance and its rate limit, and a refused call is never billed.
The steps below come before the install lines: what to decide and scope before connecting anything, in the order it matters. The lines themselves follow, part by part, for the client you pick.
npx mcprush@latest stack add on-call writes all 6 servers into Claude Code’s config in one go — or run the lines below one by one. The 4 skills are not included — add them with lines 07–10.
DATADOG_API_KEY — Datadog API keyDATADOG_APP_KEY — Datadog application keySENTRY_ACCESS_TOKEN — Your Sentry user authentication tokenDISCORD_TOKEN — Discord bot tokenLOGSCALE_BASE_URL — Base URL of your LogScale (Falcon LogScale) instanceLOGSCALE_API_TOKEN — LogScale API tokenSet them where you start Claude Code — export DATADOG_API_KEY=… in your shell profile on macOS and Linux, setx DATADOG_API_KEY "…" on Windows, then open a new terminal. Claude Code reads them at start; the config keeps only the names.
# 01 · Datadog
claude mcp add --scope user --env 'DATADOG_API_KEY=${DATADOG_API_KEY}' --env 'DATADOG_APP_KEY=${DATADOG_APP_KEY}' --transport stdio datadog-mcp '--' npx -y @winor30/mcp-server-datadog
# 02 · Prometheus
claude mcp add --scope user prometheus-mcp '--' npx -y prometheus-mcp stdio
# 03 · Kubernetes
claude mcp add --scope user kubernetes-mcp '--' npx -y mcp-server-kubernetes
# 04 · Sentry
claude mcp add --scope user --env 'SENTRY_ACCESS_TOKEN=${SENTRY_ACCESS_TOKEN}' --transport stdio getsentry-sentry-mcp '--' npx -y @sentry/mcp-server
# 05 · Discord
claude mcp add --scope user --env 'DISCORD_TOKEN=${DISCORD_TOKEN}' --transport stdio discord-mcp '--' npx -y @pasympa/discord-mcp
# 06 · Logscale
claude mcp add --scope user --env 'LOGSCALE_BASE_URL=${LOGSCALE_BASE_URL}' --env 'LOGSCALE_API_TOKEN=${LOGSCALE_API_TOKEN}' --transport stdio logscale-mcp '--' npx -y logscale-mcp-server
# 07 · Engineering Runbook
npx mcprush@latest skill add nexu-io/engineering-runbook
# 08 · Internal Comms
npx mcprush@latest skill add anthropics/internal-comms
# 09 · Python Observability
npx mcprush@latest skill add wshobson/python-observability
# 10 · Debugging and Error Recovery
npx mcprush@latest skill add addyosmani/debugging-and-error-recoverynpx).Set-ExecutionPolicy -Scope CurrentUser RemoteSigned once, or type npx.cmd instead of npx (codex.cmd, gemini.cmd, grok.cmd likewise). PowerShell 7 needs neither.Nothing is connected until you approve it in Claude Code. mcprush is not in the path and meters nothing here.
Installed together, these tool surfaces add up. It is the first thing a security reviewer asks for, so what has been counted — and what nobody has counted yet — is on the page rather than in a PDF.
| Member | Tool surface | Write tools |
|---|---|---|
| Datadog | not imported | not recorded |
| Discord | not imported | not recorded |
| Kubernetes | not imported | not recorded |
| Prometheus | not imported | not recorded |
| Sentry | not imported | not recorded |
A stack's blast radius is the union of its members, not the worst of them. That union cannot be taken here, because 5 members of 6 have no imported tool surface — so the figure a review asks for is missing rather than low, and a member marked not imported is one nobody has counted rather than one that cannot write.
A stack is a default, not a verdict. These are the substitutions the maintainer would make, and what each one costs or saves.
A shop whose dashboards and logs are in Grafana queries them directly, and the desk stops depending on a paid monitoring account.
The same update, into the workspace where your team actually gets paged, over a user-token Slack server.
Written by the maintainer, kept on the page rather than in a support thread.
It cannot roll back or scale anything on its own account. Kubernetes here inspects and manages what you grant it, and a rollback is a decision the human on call makes.
It does not page anyone. Routing, escalation and acknowledgement stay in the tool that owns your rotation.
Metrics answer what happened, never why. The runbook and the error tracker are in this stack because the graph alone has never closed an incident.
A stack has an owner: whoever keeps it re-checks the combination when a member changes, and the members themselves are published by the people named on each row.
Takes a green branch to a running deployment, and keeps the DNS, the cluster and the access list honest on the way.
Reads the ticket, finds whether it is a bug or a billing question, and drafts the reply in your own voice.
Tools to inspect code changes, run checks and prepare a pull request review.