$ loading_
Query and manage Rootly incidents, alerts, and on-call data with a local SQLite mirror.
This Rootly MCP comes from an official registry and is open source, which improves auditability. However, it requires Rootly credentials, can execute code, and states it maintains a local SQLite mirror, so the overall posture is caution rather than high risk.
It requires ROOTLY_API_KEY and ROOTLY_API_TOKEN, both of which are sensitive credentials that can access Rootly incident, alert, and on-call objects. Misconfiguration or logging leakage could enable misuse, but the materials do not show clear signs of overbroad permission requests.
Although no remote host is listed, its stated functionality and required Rootly credentials reasonably imply communication with Rootly services and transfer of related object data. No concrete red flag is shown for exfiltration to unknown or unrelated endpoints.
The system checks explicitly indicate that this tool executes code/spawns processes, which is a common MCP capability. The available materials do not reveal extra dangerous system privileges or execution behavior unrelated to its stated purpose, so this remains a caution item.
The description states there is a 'local SQLite mirror,' indicating local persistence of Rootly-related data. This creates local data residue and access-control considerations, but the materials do not show broad reads of unrelated local files or requests for excessive permissions.
The source is an official registry entry with an auditable open-source repository and updates within the past year. While the project has low star count and no declared license, there are no high-risk supply-chain red flags such as closed source, abandonment, or suspicious distribution channels.
Copy the install command and let the AI configure it · recommended for beginners
No copy-paste install info for "Rootly MCP" yet — see the docs or source repo.
Query and update ThreatLocker Portal data to automate security operations.
Manage SaaS backups, status checks, and bulk operations through Afi CLI.
Access Level RMM data with local fleet storage and offline rollup analysis.
Sync your Datto BCDR fleet into SQLite for per-appliance analysis.
Query all Domotz endpoints with a local fleet mirror for cross-site ops insights.
Manage Datto RMM operations and analyze fleet data with local SQLite.
Connect Rootly to manage incidents, alerts, escalations, and postmortems.
Automate Rootly tasks through Rube MCP to streamline incident response workflows.
Triage RocketCyber alerts, track MTTR, and analyze security posture.
Turn raw log query results into structured incident reports linked to commits and tickets.
Diagnose incidents with audited read-only access to ops tools and RCA.
Use typed Tactical RMM commands for offline queries and bulk endpoint operations.