> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onepatch.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP server

> The OnePatch MCP endpoint, how to authenticate to it, and the tools it exposes.

Your OnePatch workspace exposes an MCP server over streamable HTTP. Everything it returns is scoped to your organization. The only writes are starting a chat and replying to one.

```text theme={null}
Transport:  HTTP (streamable)
URL:        https://app.onepatch.dev/mcp
Auth:       OAuth, or a bearer token minted from an API key
```

To connect a coding agent or editor, see [Coding agents](/connect-your-agent).

## OAuth

The first call from an MCP client opens an OAuth sign-in with your OnePatch account.

## API keys

OAuth needs a browser. For a script, CI job, or unattended agent, use an API key: an org admin creates one on the **Integrations** page under **API keys**. You get a `client_id` / `client_secret` pair, and the secret is shown once. The pair doesn't expire; your code exchanges it for a 1-hour access token and sends that as the MCP bearer:

```sh theme={null}
# 1. Exchange your key for a 1-hour access token
TOKEN=$(curl -s -X POST https://auth.onepatch.dev/oauth2/token \
  -d grant_type=client_credentials \
  -d client_id=$ONEPATCH_CLIENT_ID \
  --data-urlencode "client_secret=$ONEPATCH_CLIENT_SECRET" \
  | jq -r .access_token)

# 2. Call the MCP endpoint with it
curl -s -X POST https://app.onepatch.dev/mcp \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
```

Any MCP client that can send a static `Authorization` header works the same way.

Each key is bound to one organization; its tokens can't read another customer's data. **Rotate** issues a new secret while the old one keeps working. Once the new secret is deployed, **Retire old secret** deletes the old one. **Revoke** deletes the key and every secret on it.

## Tools

| Tool                | What it does                                                                   |
| ------------------- | ------------------------------------------------------------------------------ |
| `query_otel`        | Read-only SQL over your telemetry (`otel.spans`, `otel.metrics`, `otel.logs`). |
| `get_ingest_config` | The OTLP endpoint and token for sending telemetry.                             |
| `list_incidents`    | List incidents, filtered by status, severity, or who they wait on.             |
| `read_incident`     | Read one incident's document and the investigation behind it.                  |
| `list_chats`        | List the chats in your workspace.                                              |
| `read_chat`         | Read one chat's transcript.                                                    |
| `start_chat`        | Ask the OnePatch agent to investigate something.                               |
| `send_chat_reply`   | Post a reply into one of your chats.                                           |