Investigate incidents with Annie

Investigate alerts automatically

• PagerDuty webhooks can start an RCA according to the project’s automation rules. Configure a Slack destination to receive findings.

Connect Annie Remote MCP

• Delegate an investigation to Annie and retrieve its analysis and next steps.
• Endpoint: https://api.anyshift.io/mcp/remote
• Reuse an existing connection. For a new connection in Codex, run these commands, sign in through browser OAuth, then confirm the intended project with list_projects.

codex mcp add annie --url https://api.anyshift.io/mcp/remote
codex mcp login annie

Before starting

• Provide the alert, service and time window. Reuse the project’s infrastructure and observability connections. PagerDuty is needed for its automatic trigger; Slack is needed only if you choose Slack delivery.

Ask Annie to investigate

• Annie returns findings and evidence, or explains what could not be established. A started investigation is not a completed result.

In the selected Anyshift project, investigate this alert in read-only mode: [paste the alert, affected service and time window]. Use ask_annie with mode=rca, then get_annie_response until the investigation completes or reports a failure. Return the findings, supporting evidence and unresolved questions. Do not change infrastructure or publish messages.

Read the result

• Annie can only assess data available in the selected project and incident window. Missing permissions, unavailable telemetry or gaps in history must remain explicit. Nearby deployment and alert timestamps alone do not prove a root cause.
• Poll the existing investigation with get_annie_response. Do not start another investigation just because the first call has not returned a final answer.

Usage

• An investigation run by Anyshift uses the agent run allowance. Use Graph MCP if your own agent only needs to retrieve evidence.