Agent access

errorcore exposes incidents and scrubbed failure context to coding agents over the Model Context Protocol. The access is read-only, project-scoped, and separately credentialed from ingestion.

Service-account mode

MCP keys are service-account credentials, not user credentials. A key belongs to a project, carries explicit scopes, and acts on its own behalf; it does not inherit a console user's permissions and it never gains write access.

Key format: ec_mcp_<lookup>_<secret>. Ingest keys (ec_live_) are never accepted by the MCP endpoint; they receive the same generic authentication denial as any invalid key.

Scopes

Scope	Grants
`incidents:read`	List, search, and inspect exposed incidents.
`contexts:read`	Fetch validated, scrubbed failure context for an occurrence.

Grant the minimum the client needs. A key with neither scope cannot be created.

Issue a key

Console → Settings → MCP keys → Create MCP key. Choose scopes and an optional expiry (at most one year). It requires an organization admin and recent identity verification.

The plaintext is shown once. Place it directly in the agent client's secret store.

Keys cover a project across all of its environments. Rotation opens a bounded grace window; revocation is immediate.

Connect a client

The production endpoint is a single Streamable HTTP URL, shown on the MCP keys page. It is not occurrence-specific.

{
  "mcpServers": {
    "errorcore": {
      "type": "streamable-http",
      "url": "https://mcp.example.com/mcp",
      "headers": {
        "Authorization": "Bearer ${ERRORCORE_MCP_TOKEN}"
      }
    }
  }
}

${ERRORCORE_MCP_TOKEN} stands for your client's secret substitution, not a literal value to commit. If a client cannot substitute secrets into headers, do not put the key in its checked-in configuration.

Tools

The service exposes exactly four read-only tools:

list_incidents
get_incident
get_failure_context
search_incidents

There are no write tools. Nothing an agent does through MCP can change a case, a credential, or a plan.

To point an agent at a case you are reading in the console, copy its occurrence id and ask:

Use errorcore get_failure_context with occurrence_id occ_<64-lowercase-hex-characters>.

What an agent can and cannot see

Failure context returned over MCP is the same scrubbed evidence the console shows: redacted values stay redacted, dropped fields stay dropped, and truncation is labeled. Raw encrypted envelopes are never exposed through MCP.

An unknown, hidden, cross-project, quarantined, pending, or deleted identifier all return the same not_found error, so the endpoint does not leak which incidents exist.

Endpoint behavior

GET /mcp and DELETE /mcp intentionally return 405. The endpoint validates the exact HTTP Host and any supplied Origin before authentication, and ignores forwarded-host headers; proxies must preserve the configured authority.