Pagerduty MCP integration

PagerDuty MCP

DevRev's PagerDuty MCP snap-in registers PagerDuty's remote MCP server in DevRev, allowing agents and users to look up incidents, check on-call schedules, and resolve escalation policies, services, teams, and users through natural language — directly from DevRev. This connector is scoped to read/query tools only.

Field	Value
Server name	PagerDuty MCP
Slug	`pagerduty-mcp`
Server type	Remote
Auth	OAuth 2.0 (client credentials, App OAuth Token)

This connector exposes read-only tools. manage_incidents and manage_schedules are visible in the MCP tool list but are not usable — the connection's token carries no write scopes, so any write/manage call fails with an insufficient-permission error. Some tools also depend on the PagerDuty plan and role of the account the App OAuth Token belongs to.

Key Capabilities

PagerDuty MCP exposes tools covering incident visibility and on-call awareness. Read tools let agents list and inspect incidents (status, urgency, assignees, service, timestamps), look up on-call schedules and layers, and resolve the services, escalation policies, teams, and users referenced by an incident. Write tools for creating, acknowledging, or resolving incidents and editing schedules exist on PagerDuty's MCP server but are intentionally not enabled by this connector — the App OAuth Token backing it carries only *.read scopes. All tools operate under the token's account-level PagerDuty permissions, not a specific user's permissions.

Supported Tools

Incidents

Tool	Scope / Access	Description
`browse_incidents`	`incidents.read`	List and read incidents (status, urgency, assignees, service, timestamps).

Schedules and on-call

Tool	Scope / Access	Description
`browse_schedules`	`schedules.read` (on-call entries also need `oncalls.read`)	List schedules, get schedule detail, list schedule users, and list on-call entries for a schedule.

Reference lookups

Tool	Scope / Access	Description
`browse_escalation_policies`	`escalation_policies.read`	List and read escalation policies.
`browse_services`	`services.read`	List and read services referenced by incidents and escalation policies.
`browse_teams`	`teams.read`	List and read teams, for team-scoped filtering of incidents/schedules.
`browse_users`	`users.read`	List and read users, to resolve assignee/schedule-member references.

Not enabled in this connector

Tool	Scope / Access	Description
`manage_incidents`	Requires `incidents.write` (not granted)	Create, update, acknowledge, and resolve incidents.
`manage_schedules`	Requires `schedules.write` (not granted)	Create and update schedules and overrides.

Query Safety Rules

The connection's App OAuth Token carries only *.read scopes — no incidents.write or schedules.write — so manage_incidents and manage_schedules cannot mutate PagerDuty data through this connector, even though the tools appear in the MCP tool list.
PagerDuty's MCP server does not filter its own tool list by scope; access control happens entirely at the API call, which fails closed with an insufficient-permission error if the token lacks the required scope.
The token is account-level (an App OAuth Token), not user-level — tool filters that scope results to "my teams" or the calling user's own assignments are not available through this connector.
The account selector scope (as_account-{region}.{subdomain}) binds every call to a single PagerDuty account; the token cannot read or act across multiple PagerDuty tenants.
Add *.write scopes and re-register the OAuth app only when a specific, approved write use case requires it.

OAuth Scopes

Scope	Purpose
`as_account-{region}.{subdomain}`	Mandatory account selector. Not a real permission — binds every token to one PagerDuty account (built from the connection's PagerDuty Region and PagerDuty Subdomain fields).
`incidents.read`	List and read incidents.
`oncalls.read`	Read on-call assignments (who is on call, when).
`schedules.read`	List and read on-call schedules, including layers and overrides.
`services.read`	Read service metadata referenced by incidents and escalation policies.
`escalation_policies.read`	Read escalation policies referenced by services and schedules.
`users.read`	Resolve user references (assignees, schedule members) to names/emails.
`teams.read`	Resolve team references and support team-scoped filtering.
`abilities.read`	Read account feature/ability flags; used by some MCP tools to gate behavior.

Permissions and Access

OAuth app registration required — an admin registers a Scoped OAuth app in the target PagerDuty account before the snap-in can be activated; there is no per-user consent flow.
Client credentials grant, not user OAuth — the connection authenticates as the PagerDuty account itself (an App OAuth Token), not as an individual PagerDuty user.
Account-level, not user-level — every DevRev user and agent that queries this connector sees the same PagerDuty data, scoped to what the App OAuth Token's account and read scopes allow.
Registering the app requires a PagerDuty Manager, Global Admin, or Account Owner base role.
Write scope is deliberately excluded — this connector's token requests only *.read scopes; no *.write scope is ever requested during setup.
No OAuth consent/redirect step — this is a secret_short_lived keyring. DevRev fetches and refreshes the access token itself via client credentials using the Client ID and Client Secret entered at setup.

Rate Limits

960 requests/minute per App OAuth Token, in a rate-limit pool separate from user API keys/tokens on the same PagerDuty account.
429 responses include ratelimit-limit, ratelimit-remaining, and ratelimit-reset headers.
Underlying PagerDuty REST API limits apply per endpoint, independent of MCP-specific throttling.

Transport

Protocol: Streamable HTTP (MCP spec).
Auth: OAuth 2.0 Bearer token, fetched and refreshed by the DevRev platform via client credentials (no manifest edit or per-tenant re-render needed).
US endpoint: https://mcp.pagerduty.com/mcp
EU endpoint: https://mcp.eu.pagerduty.com/mcp
Access tokens expire in 24 hours and are re-requested rather than refreshed — PagerDuty's client credentials flow does not issue a refresh_token.

Setup: creating the PagerDuty OAuth app and configuring the connection

This connector requires a PagerDuty OAuth app to be registered manually before activation — PagerDuty does not support Dynamic Client Registration (DCR), so there is no automatic per-org app provisioning.

Step 1: Register a Scoped OAuth app in PagerDuty

Log into the target PagerDuty account with a Manager, Global Admin, or Account Owner base role — App Registration requires one of these roles.
Go to Integrations > Developer Tools > App Registration (the My Apps page), then click New App.
Name the app (for example, "DevRev MCP") and add a short description.
In the Functionality section, click Add on the OAuth card.
On the Configure OAuth 2.0 screen, choose Scoped OAuth — not Classic User OAuth. Classic OAuth issues blanket read/write, cross-account tokens that cannot be scoped down; Scoped OAuth lets you grant only the specific read scopes this connector needs.
Select the following scopes:
- incidents.read
- oncalls.read
- schedules.read
- services.read
- escalation_policies.read
- users.read
- teams.read
- abilities.read
- Do not add any *.write scope — this connector only uses read tools.
Click Save.
Open the app's Client tab and copy the Client ID and Client Secret. The Client Secret is shown only once — store it somewhere safe until you enter it into DevRev in Step 2.

PagerDuty apps are bound to the subdomain and user that registered them and cannot be moved. If you need this connector in more than one PagerDuty tenant (for example, separate QA and production accounts), register a separate app in each tenant.

Step 2: Configure the DevRev connection

After the snap-in is installed and active in your DevRev org, open the PagerDuty MCP connection and enter these four fields:

Field	What to enter
Client ID	The Client ID copied from the app's Client tab in Step 1.
Client Secret	The Client Secret copied from the app's Client tab in Step 1.
PagerDuty Region	`us` or `eu` — the PagerDuty service region your account is hosted in.
PagerDuty Subdomain	Your PagerDuty tenant's subdomain, visible in your PagerDuty URL: `https://<subdomain>.pagerduty.com`.

DevRev uses the Region and Subdomain fields to build the mandatory as_account-{region}.{subdomain} scope on every token request, and uses the Client ID/Secret to fetch and automatically refresh the access token via the client credentials grant. There is no OAuth consent screen or redirect step to complete — once these four fields are saved, the connection is ready to use.

If your PagerDuty tenant is EU-hosted (PagerDuty Region = eu), the connector automatically targets PagerDuty's EU MCP endpoint (https://mcp.eu.pagerduty.com/mcp); no additional configuration is needed beyond setting the Region field correctly.

Resources

Was this article helpful?