Connect your AI

Investigate incidents with your own AI client: one MCP endpoint with metrics, logs, alerts and the topology, called as you.

The MCP server

MCP URL (Streamable HTTP)

https://noc-poc.zebbra.ch/mcp

1

Add the URL to your client

It finds NOC-POC as the authorization server.
2

Sign in

The client opens your browser: sign in with a magic link (the first sign-in creates your account).
3

Approve

The consent page shows the client and the scopes it asks for; approve, and the client gets a token for https://noc-poc.zebbra.ch/mcp.

Scopes

mcp:read Query metrics and logs, read alerts and silences, browse the topology.

mcp:alerts:write Create and expire Alertmanager silences (admins only).

Issuer https://noc-poc.zebbra.ch. Your own tokens never carry more than your account may.

Set up your client

Add the server

Terminal

claude mcp add --transport http noc-poc https://noc-poc.zebbra.ch/mcp

2

Log in

Start claude, type /mcp, pick noc-poc and choose Authenticate. Your browser opens NOC-POC: sign in and approve the access.
3

Ask

Claude Code now calls metrics_*, logs_*, alerts_* and topology_* as you. Try one of the example prompts below.

1
Add a custom connector
Settings → Connectors → Add custom connector, name it NOC-POC and paste the URL:
```
https://noc-poc.zebbra.ch/mcp
```
2

Connect

Choose Connect: NOC-POC opens in your browser, sign in and approve. Claude's connectors reach the server from the internet, so this works with the public URL (production), not with localhost.

Add the server to .vscode/mcp.json

.vscode/mcp.json

{
  "servers": {
    "noc-poc": {
      "type": "http",
      "url": "https://noc-poc.zebbra.ch/mcp"
    }
  }
}

2

Start it and log in

Choose Start above the server in the file (or MCP: List Servers); VS Code asks to sign in with NOC-POC in the browser. Then use Copilot Chat in agent mode.

Add the server to ~/.cursor/mcp.json

~/.cursor/mcp.json

{
  "mcpServers": {
    "noc-poc": {
      "url": "https://noc-poc.zebbra.ch/mcp"
    }
  }
}

2

Log in

In Settings → MCP, NOC-POC shows Needs login: choose it, sign in and approve in the browser.

1

Create a personal access token

For clients without MCP authorization (scripts, older clients): create one below and keep it secret.

Send it with every request

HTTP header

Authorization: Bearer <token>

Check it

curl -s https://noc-poc.zebbra.ch/mcp -H "Authorization: Bearer $NOC_POC_TOKEN" \
  -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}'

Tools

catalogue

metrics_* 15 tools

VictoriaMetrics: MetricsQL over the SNMP, ping and node metrics.

query
query_range
series
labels
label_values
metrics
metrics_metadata
metric_statistics
alerts
rules
explain_query
prettify_query
active_queries
top_queries
tsdb_status

logs_* 13 tools

VictoriaLogs: LogsQL over the devices' syslog and the alert audit log.

query
hits
stats_query
stats_query_range
facets
field_names
field_values
streams
stream_ids
stream_field_names
stream_field_values
flags
documentation

alerts_* 8 tools

Alertmanager: active alerts, groups and silences.

get_alerts
get_alert_groups
get_silences
get_silence
get_status
get_receivers
post_silence
delete_silence

topology_* 8 tools

The CMDB: sites, devices, links, designed paths, services, change calendar (the design, not live state).

list_sites
list_devices
get_device
list_links
get_neighbors
get_design_path
list_services
list_change_calendar

needs mcp:alerts:write (admins); all others mcp:read.

Example prompts

Which devices at GVA are down right now, and what is the most likely root cause?
Summarise the syslog of wan-rtr-brn-1 in the last 15 minutes and point out anything unusual.
Group the active alerts by probable root cause and tell me which one to fix first.
Is the BRN–ZRH WAN link congested? Compare its utilisation with the last hour.
Which services depend on core-brn-1, and is a change planned for it this week?

Personal access tokens

For clients without MCP authorization. A token acts as you with the scopes you pick.