The Honeycomb MCP connector routes your AI agent's tool calls to Honeycomb's own MCP server through Scalekit. Each user signs in to Honeycomb once, and Scalekit stores and refreshes their tokens, so your agent never handles credentials. It comes with 31 tools.
- Tools
- 31
- What they doRead · write · destructive
- 23 · 6 · 223 read6 write2 destructive
- Users sign in with
- OAuth
- OAuth app
- Your own Honeycomb MCP server app
Setup
Install the SDK
Terminal window npm install @scalekit-sdk/node dotenvTerminal window pip install scalekit-sdk-python python-dotenvSet your credentials
Add your Scalekit credentials to your
.envfile. Find values in app.scalekit.com > Developers > API Credentials..env SCALEKIT_ENVIRONMENT_URL=<your-environment-url>SCALEKIT_CLIENT_ID=<your-client-id>SCALEKIT_CLIENT_SECRET=<your-client-secret>Create the Honeycomb MCP connection
In AgentKit > Connections, create a Honeycomb MCP connection and copy its redirect URI. The name you give it is the
connection_nameyour code passes. See Configure connections.Register an OAuth app
Honeycomb MCP server connections use your own OAuth app. Register one with Honeycomb MCP server and add the redirect URI you copied.
Then enter the app's Client ID and Client Secret on the Honeycomb MCP connection.
Authorize a user and make your first call
quickstart.mts import { ScalekitClient } from '@scalekit-sdk/node'import 'dotenv/config'import { createInterface } from 'node:readline/promises'const scalekit = new ScalekitClient(process.env.SCALEKIT_ENVIRONMENT_URL,process.env.SCALEKIT_CLIENT_ID,process.env.SCALEKIT_CLIENT_SECRET,)const actions = scalekit.actionsconst connector = 'honeycombmcp'const identifier = 'user_123'// Generate an authorization link for the userconst { link } = await actions.getAuthorizationLink({ connectionName: connector, identifier })console.log('Authorize Honeycomb MCP:', link)const rl = createInterface({ input: process.stdin, output: process.stdout })await rl.question('Press Enter after authorizing...')rl.close()// Make your first callconst result = await actions.executeTool({connector,identifier,toolName: 'honeycombmcp_get_query_results',toolInput: {},})console.log(result)Terminal window npx tsx quickstart.mtsquickstart.py import osfrom scalekit import ScalekitClientfrom dotenv import load_dotenvload_dotenv()scalekit_client = ScalekitClient(env_url=os.getenv("SCALEKIT_ENVIRONMENT_URL"),client_id=os.getenv("SCALEKIT_CLIENT_ID"),client_secret=os.getenv("SCALEKIT_CLIENT_SECRET"),)actions = scalekit_client.actionsconnection_name = "honeycombmcp"identifier = "user_123"# Generate an authorization link for the userlink_response = actions.get_authorization_link(connection_name=connection_name,identifier=identifier,)print("Authorize Honeycomb MCP:", link_response.link)input("Press Enter after authorizing...")# Make your first callresult = actions.execute_tool(tool_input={},tool_name="honeycombmcp_get_query_results",connection_name=connection_name,identifier=identifier,)print(result)Terminal window python quickstart.pyEach user signs in once. See Authorize a user for the full flow and statuses.
Tools
Pass the exact name toexecute_toolhoneycombmcp_canvas_agent_poll_responsePoll for the result of a previously-issued canvas_agent_invoke call.Read-onlyCanvas Agent Poll Response
Poll for the result of a previously-issued canvas_agent_invoke call. Pass the investigation_id and session_id returned from canvas_agent_invoke. Each call waits up to wait_seconds (default 30, max 50) for a terminal event, then returns either status='completed' with the agent's chat reply, status='error' with a message, status='busy' if another invocation is contending for the same agent (retry canvas_agent_invoke), or status='running' if the agent is still working — in which case call this tool again with the same parameters. Cap on wait_seconds is intentional: longer single waits get killed by network infrastructure.
Inputs
investigation_idstringrequired- ID of the investigation passed to canvas_agent_invoke (e.g. 'hcciv_…').
session_idstringrequired- session_id returned from canvas_agent_invoke. Identifies which invocation to wait on.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
wait_secondsinteger- Maximum whole seconds to wait for a terminal event before returning a 'running' response. Default 30, max 50.
honeycombmcp_find_columnsSearch for columns and calculated fields by intent across one or all datasets in an environment.Read-onlyFind Columns
Search for columns and calculated fields by intent across one or all datasets in an environment. When to use: - "What column has the error rate?" / "Find columns related to duration or latency" — intent-based discovery. - Before composing a run_query, to confirm that columns with the right names exist. - When you are not sure which dataset contains the column you need (omit dataset_slug to search all). - After get_dataset_columns returns too many results to scan, use this to narrow by semantic relevance. Difference from get_dataset_columns: this tool ranks results by relevance to your search input across all datasets; get_dataset_columns returns the complete schema for one specific dataset. Pairs with: get_dataset_columns (full schema once you know the right dataset); run_query (use validated column names here); get_dataset (confirm dataset exists before scoping search).
Inputs
environment_slugstringrequired- Environment slug to search within.
inputstringrequired- Natural language or keywords describing the column you are looking for (e.g. 'http status code', 'request duration', 'user identifier').
dataset_slugstring- Scope search to this dataset slug. Omit to search all datasets in the environment. Only specify when you are confident about the correct dataset.
include_expressionsboolean- When true, includes the expression for calculated fields in the response. Defaults to false.
items_per_pagenumber- Number of items per page. Defaults to 50.
pagenumber- Page number for paginated results. Defaults to 1.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_find_queriesSearch query history and saved queries by intent; returns matching queries with their run PKs.Read-onlyFind Queries
Search query history and saved queries by intent; returns matching queries with their run PKs. When to use: - "Has anyone queried the error rate for checkout?" — check existing work before composing a new query. - Before calling run_query, verify a semantically similar query does not already exist. - "Show me recent queries for service X" — surface what the team has been investigating. - When the user pastes a query name or description and wants to find the underlying spec. Returns query specifications and run_pks. Pass a run_pk to get_query_results to retrieve the full results from that specific execution. Pairs with: get_query_results (fetch results from a returned run_pk); run_query (run a new query once you've confirmed no similar one exists); create_board (add a found query_id as a panel).
Inputs
environment_slugstringrequired- Environment slug to search within.
inputstringrequired- Natural language or keywords describing the queries you are looking for.
dataset_slugstring- Scope search to this dataset slug. Omit to search all datasets in the environment.
max_queriesinteger- Maximum number of queries to return (1-50). Defaults to 25.
recency_daysinteger- Consider queries executed within the last N days (1-365). Defaults to 30. Lower values surface more recent work.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_get_aiconversationFetch the full event timeline for a single AI conversation, identified by its OpenTelemetry gen_ai.conversation.id attribute value.Read-onlyGet AI Conversation
Fetch the full event timeline for a single AI conversation, identified by its OpenTelemetry gen_ai.conversation.id attribute value. Prefer this over ad-hoc run_query filtered by conversation ID — it returns every LLM call, tool call, and related agent/task event (with span name, operation/category, agent name, model, tool name, duration, and error detail per event) plus an aggregate summary (LLM call count, tool call count, failure count, total tokens, total duration) in one call. Use it to debug or analyze one specific AI conversation end-to-end. PERFORMANCE: If you know a timestamp for any event, pass event_timestamp. It anchors the retention-capped lookup window ending at that timestamp and skips the backwards probe scan.
Inputs
conversation_idstringrequired- The gen_ai.conversation.id value identifying the conversation. Pass it as-is when the user or a prior tool result already supplied one; otherwise find conversations with list_aiconversations (its Conversation ID column).
environment_slugstringrequired- Environment slug to query. Source from get_workspace_context or a prior tool result rather than guessing.
event_timestampstring- Optional timestamp of an event in the conversation. When provided, it anchors the retention-capped lookup window ending at that timestamp and skips the backwards probe scan. It must not be in the future. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_get_datasetGet dataset metadata and its full column schema (columns + calculated fields), sorted by most recent write activity.Read-onlyGet Dataset
Get dataset metadata and its full column schema (columns + calculated fields), sorted by most recent write activity. When to use: - "What columns does the api-service dataset have?" — retrieve the schema for one dataset. - Before run_query, to verify column names and types exist in the target dataset. - "When was this dataset last updated?" — dataset metadata includes oldest queryable event time. Difference from get_dataset_columns: this tool returns dataset-level metadata (description, granularity, oldest event) alongside the column list. get_dataset_columns additionally supports fetching sample values for specific columns and has metrics-dataset support via metric_name. Pairs with: get_environment (upstream — confirms the dataset slug); get_dataset_columns (fetch sample values for columns or explore metrics datasets); find_columns (search across all datasets when the right dataset is unknown).
Inputs
dataset_slugstringrequired- Name or slug of the dataset to retrieve. Get valid slugs from get_environment.
environment_slugstringrequired- Environment slug the dataset belongs to.
column_pagenumber- Page number for column pagination. Defaults to 1.
columns_per_pagenumber- Number of columns per page. Defaults to 100, max 500.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_get_dataset_columnsGet the full column schema for one dataset, with optional sample values for specific columns.Read-onlyGet Dataset Columns
Get the full column schema for one dataset, with optional sample values for specific columns. When to use: - Validating column names before composing a run_query (check the column exists and note its type). - "What values does the status column hold?" — pass the column name in 'columns' to fetch sample values. - Exploring a metrics dataset: list metric names first, then pass metric_name to discover filterable attributes. - When find_columns returns too many results and you want the authoritative schema for one dataset. Pairs with: find_columns (intent-based search when you do not know the dataset); get_dataset (dataset metadata alongside schema); run_query (use validated column names here).
Inputs
dataset_slugstringrequired- Slug of the dataset to get columns for.
environment_slugstringrequired- Environment slug the dataset belongs to.
columnsarray- Specific column names to fetch recent sample values for (max 20). Omit to get schema metadata only, which is faster.
items_per_pagenumber- Number of items per page. Defaults to 1000.
metric_namestring- For metrics datasets only: discover which resource and data-point attributes co-occur with this metric by sampling recent data. Returns attributes available for filtering and grouping.
pagenumber- Page number for paginated results. Defaults to 1.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_get_environmentGet details for a specific environment, including its dataset list sorted by most recent activity.Read-onlyGet Environment
Get details for a specific environment, including its dataset list sorted by most recent activity. When to use: - After get_workspace_context returns environment slugs, drill into one to see which datasets it contains. - "What datasets exist in staging?" — list mode for dataset discovery. - Before calling get_dataset or get_dataset_columns, confirm the dataset slug by checking environment contents. Returns up to 100 datasets per page by default, sorted by most recent write activity. Pairs with: get_workspace_context (upstream — provides environment slugs); get_dataset (drill into a specific dataset's schema); get_dataset_columns (full column schema once you know the dataset slug); find_columns (search across all datasets in this environment by intent).
Inputs
environment_slugstringrequired- Slug of the environment to retrieve. Get valid slugs from get_workspace_context.
items_per_pagenumber- Number of datasets per page. Defaults to 100, max 500.
pagenumber- Page number for dataset pagination. Defaults to 1.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_get_query_resultsRetrieve results and metadata from an existing query execution.Read-onlyGet Query Results
Retrieve results and metadata from an existing query execution. Accepts a Honeycomb URL, a run_pk, or a query_id (returns most recent run). Provide exactly one of these three inputs. When to use: - After find_queries returns a run_pk and you want the actual result rows. - The user pastes a Honeycomb query URL from the browser — extract results without re-running. - After run_query executes a new query and returns a run_pk, use this to fetch the structured output. - You have a query_id and want the latest available result without triggering a new execution. Pairs with: find_queries (source of run_pks); run_query (source of fresh run_pks); list_boards (board detail mode returns query_ids per panel — pass them as query_id here to get the most recent run).
Inputs
dataset_slugstring- Dataset slug. Derived automatically from the query run when omitted.
environment_slugstring- Environment slug. Derived automatically from the query run when omitted.
include_markersboolean- Include the table of markers overlapping the query window. Defaults to true. Set to false once you have read the markers to avoid re-fetching them on later calls. Markers are also suppressed when include_results is false.
include_resultsboolean- Include query result rows in the response. Defaults to true. Set to false to retrieve only metadata (query spec, run time, URLs) without fetching the data rows. Also suppresses the markers table.
query_idstring- Saved query ID. Returns results from the most recent execution of this query. Provide this OR url OR query_run_pk.
query_run_pkstring- Query run primary key, as returned by run_query or find_queries. Provide this OR url OR query_id.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
urlstring- Full Honeycomb query result URL (e.g. https://ui.honeycomb.io/team/environments/env/datasets/ds/result/run-pk). Provide this OR query_run_pk OR query_id — not multiple.
wait_for_completionboolean- Wait for an in-progress query run to finish before reading persisted results. Defaults to true. Set to false to return immediately with the run's current state.
wait_timeout_secondsinteger- Maximum whole seconds to wait when wait_for_completion is true. Defaults to 120. Values <= 0 use the default; values above 300 are clamped to 300.
honeycombmcp_get_signalsReturns Anomaly Signals for the current team.Read-onlyGet Signals
Returns Anomaly Signals for the current team. An Anomaly Signal tracks a service in a dataset and detects when its behavior deviates from its historical baseline. Use this tool to investigate a specific Anomaly Signal or to find relevant Anomaly Signals with the allowed filters. Supports: - Detail: pass signal_hcid (other filters ignored). Returns the full Anomaly Signal + query hints + (optional) historical anomalies. - List: pass environment_slug (required) plus any combination of optional filters (service_name, dataset_slug, measured_signal, status). Returns a table of Anomaly Signals. Use this to find a signal_hcid to pass back in detail mode. Defaults to active Anomaly Signals. When has_next_page is true, pass next_cursor as cursor with the same filters to fetch the next page.
Inputs
cursorstring- List mode only. Opaque next_cursor from the previous page, used with the same filters. Omit for the first page.
dataset_slugstring- Optional: match Anomaly Signals by dataset slug. Only applies to list view.
environment_slugstring- Environment slug. Required when signal_hcid is not provided.
historical_anomaliesobject- Detail mode only: include resolved historical anomalies when signal_hcid is non-empty. List mode rejects this field, including null.
items_per_pageinteger- List mode only. Items per page. Defaults to 50; maximum 100.
measured_signalstring- Optional: match Anomaly Signals by the kind of measurement they track. Only applies to list view.one of
error_ratepresence service_namestring- Optional: match Anomaly Signals by service name. Only applies to list view.
signal_hcidstring- Anomaly Signal HCID. When provided, returns detailed information for the matching Anomaly Signal and other filters are ignored.
statusstring- Optional: filter by Anomaly Signal lifecycle status. Defaults to 'normal'. Only applies to list view.one of
onboardingnormalanomalousoffineligible teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_get_span_detailsSummarize attributes and their common values observed on spans with a specific name.Read-onlyGet Span Details
Summarize attributes and their common values observed on spans with a specific name. USE THIS AFTER list_spans (or whenever you already know a span_name) and BEFORE run_query. It tells you which attributes are populated on that operation, how many distinct values each has, and the top observed values — enough to answer most "what does X look like / what fields does X have / what status codes does X return / which users hit X" questions directly, without composing a custom query. Only escalate to run_query when you need: exhaustive value distributions beyond the sample cap, custom calculations (P95/P99, HEATMAP, math across columns), per-attribute COUNT/SUM aggregates over the full time range, or comparison/baseline analysis. Results are paginated with page and items_per_page after applying the sample cap. Paging is a presentation control, not an exhaustive cursor. Values are based on matching span samples, capped at 1000 rows across the selected time range.
Inputs
environment_slugstringrequired- Environment slug.
span_namestringrequired- Span name to inspect.
dataset_slugstring- Optional dataset slug. When omitted, scans trace-aware datasets in the environment.
fromstring- Start of the time range. Omit to use the default 2-hour lookback anchored to to. Relative from values anchor to an absolute to. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
items_per_pageinteger- Number of rows per page. Defaults to 100, maximum 500.default
100 pageinteger- Page number for paginated results. Defaults to 1.default
1 teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
tostring- End of the time range. Omit to use the current time; it must not be in the future. from must be before to. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
honeycombmcp_get_traceRetrieve all spans for a specific trace ID and render them as a waterfall.Read-onlyGet Trace
Retrieve all spans for a specific trace ID and render them as a waterfall. When to use: - User pastes a trace ID from logs, a Slack alert, or the Honeycomb UI — fetch it here. - Drilling into a specific trace from a run_query result (trace.trace_id column). - Comparing parent/child span timing for a known trace to diagnose latency attribution. Pairs with: - run_query — filter where trace.trace_id = <value> to find traces matching a pattern, then drill in here. - list_spans / get_span_details — use first to discover span names so you can focus this view with focus_span_id. - run_bubbleup — if a query surfaces an anomalous cluster, BubbleUp identifies why; get_trace lets you verify with individual examples. <sampling> Span counts are actual stored spans, not sample-rate-adjusted. When sampling is active, the output includes a mean sample rate. Do not compare corrected query COUNTs (which are sample-rate-adjusted) directly to trace span counts. </sampling>
Inputs
environment_slugstringrequired- Environment slug.
trace_idstringrequired- The trace ID to search for.
depth_limitinteger- Maximum depth to traverse from root (inclusive, omit for unlimited). Only applies in focused mode or when specified.
focus_span_idstring- Optional span ID to focus on. Shows this span and its descendants with proper context.
fromstring- Start of the time range. Omit to use the default 7-day lookback anchored to to. Relative from values anchor to an absolute to. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
show_eventsboolean- Whether to include span events in the output (default: false for performance).default
false teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
tostring- End of the time range. Omit to use the current time; it must not be in the future. from must be before to. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
view_modestring- View mode: 'auto' (default, smart collapsing), 'compact' (aggressive collapsing), 'full' (show everything), 'focused' (requires focus_span_id).one of
autocompactfullfocuseddefaultauto
honeycombmcp_get_triggersList triggers (alert rules) for the team, or fetch full configuration for a single trigger.Read-onlyGet Triggers
List triggers (alert rules) for the team, or fetch full configuration for a single trigger. When to use: - "What alerts are firing?" / "What triggers do we have?" — list mode (no trigger_id). - "Show me the config for trigger X" / "Who gets paged for this alert?" — detail mode by trigger_id. - Auditing trigger configurations before creating or updating triggers. - Investigating an active alert to understand its threshold, query, and recipients. Modes: - List mode (no trigger_id): paginated table with name, status, threshold, frequency, recipients, and tags. - Detail mode (trigger_id provided): full query spec (calculations, filters, group-by, formulas), threshold, schedule, and recipient list. Recipients are shown as: type (name/target) [id:ID] — e.g. 'pagerduty (Platform Rotation) [id:abc123]'. Dynamic baseline vs static threshold: triggers with a populated 'baseline' column (list view) or 'Baseline' row (detail view) use a dynamic baseline — the threshold value is a delta (e.g. 50% higher than 1 hour prior), not an absolute count. The detail view formats Threshold as plain-English when baseline is in use. Pairs with: - create_trigger / update_trigger — list first to avoid duplicates; detail view shows current config to inform updates. - list_recipients — to resolve recipient IDs to human-readable names before creating or updating a trigger. - find_queries — to inspect the underlying saved query for a saved-query-backed trigger. - get_slos — SLO burn alerts are not triggers and do not appear here; get_slos detail mode lists an SLO's burn alerts.
Inputs
environment_slugstring- Optional: Environment slug to filter triggers by (ignored when trigger_id is provided)
include_env_wideboolean- Whether to include environment-wide triggers. Defaults to true. Only applies to list view.
items_per_pagenumber- Number of items per page. Defaults to 50. Only applies to list view.
pagenumber- Page number for paginated results. Defaults to 1. Only applies to list view.
tagsarray- Optional: Filter triggers by tags. Each tag should be in 'key:value' format. When multiple tags are specified, only triggers matching ALL tags are returned (AND semantics).
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
trigger_idstring- Optional: Trigger ID (PK) to get detailed view. When provided, returns detailed information for a single trigger instead of the list view.
honeycombmcp_get_workspace_contextCall this tool first to orient yourself in a Honeycomb workspace.Read-onlyGet Workspace Context
Call this tool first to orient yourself in a Honeycomb workspace. Takes no parameters. Returns the team name and slug, the current time, and a list of available environments with their slugs and dataset counts. Use the returned environment slugs with 'get_environment' to get dataset details for a specific environment.
Inputs
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_list_aiconversationsDiscover recent AI agent conversations (gen_ai.conversation.id values) in an environment, ordered by total event count (most active first) with per-agent activity.Read-onlyList AI Conversations
Discover recent AI agent conversations (gen_ai.conversation.id values) in an environment, ordered by total event count (most active first) with per-agent activity. Use this tool as the starting point for any investigation of a dataset containing OpenTelemetry GenAI telemetry (attributes like gen_ai.conversation.id, gen_ai.agent.name, gen_ai.operation.name, gen_ai.request.model, or gen_ai.usage.*) — including service-level agent health, latency, failure, or token-usage questions. Prefer it over ad-hoc run_query to first identify the conversations worth drilling into. Output is a table with one row per conversation; see the tool result for the exact columns. Event Count, Error Count, and Total Tokens are conversation-wide totals over every event, including events with no gen_ai.agent.name — those never appear in the Agents column, so its per-agent counts don't sum to the totals. This holds unless agent_name is supplied (see its property description for how that narrows the totals). Total Tokens is SUM(gen_ai.usage.input_tokens) + SUM(gen_ai.usage.output_tokens); events lacking token attributes contribute 0. The Agents column lists "<gen_ai.agent.name>=<events>/<errors>" per agent — parse it to answer questions like "which conversations had the most errors for agent X". Pass a returned gen_ai.conversation.id into get_aiconversation as conversation_id to load that conversation's full timeline. Default window is the last 24 hours, matching the Honeycomb UI behavior. Optional agent_name and service_name filters restrict results to conversations with at least one matching event (exact, case-sensitive; combined with AND when both are supplied). Time parameters use the shared flexible timestamp grammar documented on from and to below.
Inputs
environment_slugstringrequired- Environment slug to query. Source from get_workspace_context or a prior tool result rather than guessing.
agent_namestring- Optional filter: only include conversations that have at least one event with this gen_ai.agent.name (exact, case-sensitive). Combined with service_name (when provided) using AND. When supplied, the filter is applied at query time, so the Event Count, Error Count, and Total Tokens columns reflect only this agent's activity within each conversation, not conversation-wide totals.
fromstring- Start of the conversation window. Omit to use a 24-hour lookback anchored to to. Relative from values anchor to an absolute to. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
limitinteger- Maximum number of conversations to return. Default: 200. Maximum: 500.
service_namestring- Optional filter: only include conversations that have at least one event with this service.name (exact, case-sensitive). Combined with agent_name (when provided) using AND.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
tostring- End of the conversation window. Omit to use the current time; it must not be in the future. from must be before to. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
honeycombmcp_list_boardsList boards (saved dashboards) in an environment, or fetch one board's full contents by ID.Read-onlyList Boards
List boards (saved dashboards) in an environment, or fetch one board's full contents by ID. When to use: - "What dashboards do we have for service X" / "is there an existing board for Y" — list mode with tag filters. - "Show me the contents of board Z" — detail mode by board_id, returns every panel (queries, SLOs, text) with descriptions. - Before calling create_board, to check whether a similar board already exists. Modes: - List mode (default): pass environment_slug, optionally filter by tags (AND semantics across multiple tags). Returns paginated board metadata only. - Detail mode: pass board_id (environment_slug still required). Returns the single board with all panels and their underlying queries/SLOs resolved. Each query panel also reports chart_type, display_style, and thresholds in the exact forms create_board / update_board accept, so you can round-trip a panel's configuration. Pairs with: create_board (this tool's output reveals existing tags and naming conventions to follow); get_query_results (panel query_ids from detail mode can be passed as query_id to fetch the most recent run's results).
Inputs
environment_slugstringrequired- Environment slug to filter by. Required.
board_idstring- Switches to detail mode. When provided, returns one board with every panel (queries, SLOs, text) resolved. Get IDs from list mode, or from create_board's response.
items_per_pagenumber- Page size. Defaults to 25. List mode only.
pagenumber- Page number (1-indexed). Defaults to 1. List mode only.
tagsarray- Filter to boards matching ALL of these tags (AND semantics). Format: ['key:value', ...]. List mode only. To discover existing tag values for a team, list once without tags and inspect the responses.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_list_recipientsList all pre-registered notification recipients (email, Slack, PagerDuty, webhook) for the team.Read-onlyList Recipients
List all pre-registered notification recipients (email, Slack, PagerDuty, webhook) for the team. When to use: - Before create_trigger or update_trigger, to find the recipient IDs to attach. - "What Slack channels are configured for alerts?" — audit existing notification targets. - When a user asks which notification channels are available for a new alert. Returns each recipient's ID, type, and routing details. Pass recipient IDs directly to create_trigger, update_trigger, create_burn_alert, or update_burn_alert. Pairs with: create_recipient (register a new notification target); create_trigger (attach recipients by ID); update_trigger (update which recipients a trigger notifies); create_burn_alert (attach recipients by ID); update_burn_alert (update which recipients a burn alert notifies).
Inputs
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_list_spansList span names in trace data, ranked by count, with how often each is a trace root and which dataset the count came from.Read-onlyList Spans
List span names in trace data, ranked by count, with how often each is a trace root and which dataset the count came from. USE THIS FIRST for any question about what's happening in the system: "what's slow", "what's erroring", "what does service X do", "which endpoints exist", "what jobs run here", "show me the operations on Y". It is faster, cheaper, and more diagnostic than composing an equivalent run_query by hand, and it works across all trace-aware datasets in the environment without you having to know which dataset to target. Workflow: 1. Call list_spans (this tool) to see the span-name landscape and pick a candidate. 2. Call get_span_details with that span_name (and its dataset_slug from the row) to learn which attributes and values are present. 3. ONLY if you need a custom calculation, exhaustive value distribution, percentile/heatmap, or per-attribute aggregate that get_span_details cannot express — fall through to run_query, scoped to the dataset_slug from the row. To find which span carries a specific attribute instead of ranking by volume, use populates_attribute (see its property description). Each row is a (span_name, dataset_slug) pair — the same span_name can appear in multiple datasets, so use the row's dataset_slug (not just span_name) in follow-up calls. root_count is the subset of count with no parent (trace roots): root_count == count means always a root (HTTP handler, root job); 0 < root_count < count means it appears as both root and child (often a name shared across services); root_count == 0 means always a child (DB call, internal helper). Results are paginated with page and items_per_page after applying the query cap; narrow the time range or dataset for deeper coverage rather than paging exhaustively.
Inputs
environment_slugstringrequired- Environment slug.
dataset_slugstring- Optional dataset slug. When omitted, scans trace-aware datasets in the environment.
fromstring- Start of the time range. Omit to use the default 2-hour lookback anchored to to. Relative from values anchor to an absolute to. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
items_per_pageinteger- Number of rows per page. Defaults to 100, maximum 500.default
100 pageinteger- Page number for paginated results. Defaults to 1.default
1 populates_attributestring- Optional. Restrict results to span names that POPULATE this attribute, still ranked by count. Use this to answer 'which span carries attribute X' — e.g. find the span that emits mcp.tool.name.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
tostring- End of the time range. Omit to use the current time; it must not be in the future. from must be before to. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
usage_modeboolean- Return raw span counts without sampling rate correction. By default counts are sample-rate-weighted estimates; set true to see the literal number of spans ingested, e.g. when analyzing telemetry volume or pacing.default
false
honeycombmcp_migration_guideVendor-specific guidance for migrating existing telemetry to Honeycomb without disrupting the vendor setup.Read-onlyMigration Guide
Vendor-specific guidance for migrating existing telemetry to Honeycomb without disrupting the vendor setup. The onboarding flow's migration branch calls this when it detects a supported vendor.
Inputs
vendorstringrequired- The vendor the user's existing telemetry currently flows to.one of
datadognew-relic teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_record_onboarding_stateRecord the current onboarding step.Read-onlyRecord Onboarding State
Record the current onboarding step. The onboarding flow calls this at each step so the session's MCP activity is attributed to the step it happened in.
Inputs
statestringrequired- The current onboarding step name from the flow's state machine.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
vendorstring- For an unsupported migration vendor, the vendor the user is coming from (for example new-relic). Omit otherwise.
honeycombmcp_refinery_docsRead Honeycomb Refinery documentation.Read-onlyRefinery Docs
Read Honeycomb Refinery documentation. Refinery is Honeycomb's trace-aware tail-based sampling proxy. Available topics: - overview: Refinery overview and key concepts - architecture: Architecture, deployment patterns, and how it works - sampling-types: Sampling strategies (deterministic, dynamic, rules-based, throughput) - stress-relief: How stress relief works and how to respond when it activates - troubleshooting: Common Refinery issues, diagnostic queries, and solutions - metrics: Complete reference of all Refinery metrics with descriptions - configuration: Configuration reference for all Refinery settings - rules: Guide to writing sampling rules for the rules-based sampler Use this tool when you need detailed technical information about Honeycomb Refinery to answer user questions.
Inputs
topicstringrequired- The documentation topic to readone of
overviewarchitecturesampling-typesstress-relieftroubleshootingmetricsconfigurationrules teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_run_bubbleupRun BubbleUp analysis to find what makes a selected data subset different from the baseline.Read-onlyRun Bubbleup
Run BubbleUp analysis to find what makes a selected data subset different from the baseline. BubbleUp compares value distributions across all schema columns between a "foreground" selection (the interesting region) and the remaining data (the baseline). Columns where the foreground and baseline distributions diverge most are ranked highest. When to use: - User asks "why did latency spike at 14:00?" — pick a heatmap region and BubbleUp it. - Investigating a heatmap selection returned by run_query; you already have a query_pk. - "Compare this known-bad subset to baseline" — user wants to know what's different. - After a run_query heatmap shows an interesting region, surface the root-cause attributes. Pairs with: - run_query — must run first to obtain a query_pk; that query's time range becomes the baseline. - get_trace — drill into specific traces that fall inside the anomalous selection. - find_columns / get_dataset_columns — if you need to know what columns exist before starting analysis. Modes: - New analysis: provide query_pk + selection (heatmap or group selection). For a 2D selection, use either absolute or wall-clock-relative from/to, or source-query-relative time_start/time_end; do not combine them. - Paginate existing results: provide bubbleup_result_id (query_pk and selection are ignored).
Inputs
bubbleup_result_idstring- Primary key of an existing BubbleUp result to fetch additional pages from
clause_namestring- Optional name of a specific calculation or formula from the source query to run BubbleUp against. When specified, only the calculation filters relevant to that clause are used. For formulas, filters from all calculations referenced in the formula expression are included.
items_per_pageinteger- Number of columns per pagedefault
20 max_columnsinteger- Maximum number of columns to return in resultsdefault
20 pageinteger- Page number for paginated results (1-based)default
1 query_pkstring- Primary key of the existing query to use as the baseline for BubbleUp analysis
selectionobject- Selection criteria that defines the subset to analyze
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_run_queryRun an aggregate query or return a scoped set of raw rows from a Honeycomb dataset.Read-onlyRun Query
Run an aggregate query or return a scoped set of raw rows from a Honeycomb dataset. When to use this tool: - "Reconstruct the events for one session" — filter to the session and request the needed raw_row_columns. - "Compute a percentile / histogram of X" — use P50/P99/HEATMAP calculations. - "Show me error rate before and after deploy" — use two named calcs + a formula, scoped by time. - "Rank services by p99 latency" — use P99 with a breakdown + order. - "See distinct values of X and their frequency" — COUNT with a breakdown on X. - "Compare request volume across services" — COUNT breakdown on service.name. - "Find endpoints where tail latency exceeds 1s" — P99 + having clause. - "Generate a heatmap of request duration" — HEATMAP calculation. When NOT to use this tool: - Discovering what spans or operations exist → use list_spans instead. - Looking at a specific trace → use get_trace instead. - Finding existing saved queries → use find_queries instead. - Exploring which columns a dataset has → use get_dataset_columns or find_columns first. Pairs with: list_spans, get_span_details, find_columns, get_dataset_columns, get_trace, run_bubbleup. <examples> Basic COUNT over the last 24 hours: ```json {"environment_slug": "production", "dataset_slug": "api", "query_spec": {"calculations": [{"op": "COUNT"}], "from": "-24h"}} ``` Raw rows for one session, limited to ten selected columns and up to 100 matching events: ```json {"environment_slug": "production", "dataset_slug": "agent-events", "query_spec": { "filters": [{"column": "session.id", "op": "=", "value": "session-123"}], "from": "-2h"}, "raw_row_columns": [ "session.id", "gen_ai.operation.name", "gen_ai.agent.name", "gen_ai.tool.name", "gen_ai.tool.call.id", "gen_ai.tool.call.arguments", "gen_ai.tool.call.result", "error", "duration_ms", "trace.trace_id"], "results_limit": 100} ``` When a raw-row response includes next_cursor, fetch the next page by repeating the request with the same scope, replace the prior time fields in query_spec with the response Metadata's absolute from and to, and pass next_cursor as cursor. Continue until next_cursor is omitted. Error rate formula: two named calcs combined with a formula, ordered by the formula name (the correct ordering style when formulas are present). The passthrough formula "volume" surfaces a raw calc value alongside formulas: ```json {"environment_slug": "production", "dataset_slug": "api", "query_spec": { "calculations": [ {"op": "COUNT", "name": "total"}, {"op": "COUNT", "name": "errors", "filters": [{"column": "error", "op": "=", "value": true}]}], "formulas": [ {"name": "error_rate", "expression": "$errors / $total * 100"}, {"name": "volume", "expression": "$total"}], "breakdowns": ["service.name"], "orders": [{"column": "error_rate", "order": "descending"}], "from": "-1h", "limit": 20}} ``` Relational fields: any.X in a breakdown requires a matching WHERE filter on the same any.X column: ```json {"environment_slug": "production", "dataset_slug": "traces", "query_spec": { "calculations": [{"op": "COUNT"}, {"op": "P99", "column": "duration_ms"}], "filters": [{"column": "any.http.route", "op": "exists"}], "breakdowns": ["any.http.route"], "from": "-2h"}} ``` </examples> <interpreting_results> The response is rendered as Markdown with these sections (each is omitted if empty): - "# Results" — a Markdown table of aggregate rows. Headers are breakdown columns followed by calculation columns. When formulas are present, the table contains ONLY breakdown columns and formula columns — raw calculation columns (including percentiles like P50/P95, and even named COUNTs) are NOT rendered. To surface a raw calculation's value alongside formulas, add a passthrough formula such as {"name": "p95", "expression": "$p95_latency"}. If a breakdown's cardinality exceeded the spec's limit, an "OTHER" row collapses the remainder; a "TOTAL" row may also appear summing across groups. A "Truncated: shown N / total M" footer indicates more rows than the table displays. - 1D heatmaps render inline within Results when a HEATMAP calculation has no breakdown. - "# Raw Rows" — present when raw_row_columns is provided. Contains matching events restricted to those columns, plus timestamp. The row and column counts share a 1000-value budget. Metadata includes the effective absolute from and to. A full page also includes next_cursor; pass it as cursor in an otherwise equivalent request with those absolute time bounds to fetch more rows. Pagination is not a snapshot. - "# Time Series" — ASCII line graphs per group when the spec has a granularity (time-bucketed series). Width 120, height 12. - "# Heatmaps" — 2D time-series heatmaps when a HEATMAP calculation is paired with breakdowns or granularity. - "# Markers" — deploy/incident markers overlapping the time range, when present. Includes both dataset-scoped and environment-wide markers; the Scope column labels each row "dataset" or "environment". - "# Query Spec" — the canonicalized JSON spec the server actually executed. Useful when comparing what you sent to what ran. - "Metadata:" YAML block at the bottom — contains query_run_pk (passable to get_query_results), query_url (Honeycomb permalink to share with humans), query_result_json / query_result_image (download URLs), elapsed_str, granularity, total (result count), rows_examined. When the requested or auto-selected granularity was adjusted (clamped to the valid window, or raised to the metrics-dataset floor), granularity_note explains the change and granularity_requested echoes an explicit request. When data is sampled, a sampling banner appears above Results listing the mean sample rate and which calculations are sample-rate-weighted vs. raw. If mean_sample_rate > 10x and usage_mode is off, an extra warning notes that COUNT values are corrected estimates and won't match raw trace span counts. When results contain a trace.trace_id column (grouped-by or in raw rows), a "Trace links" block above Results lists ready-to-use UI URLs for those traces. These are already scoped to this query's time range — pass them through verbatim. Do NOT hand-build a trace URL from a trace ID: a link without the query's time scope resolves against a default 2h window and fails to load older traces. </interpreting_results> Important: filter operators use symbols (=, >=, !=). Expression functions inside calculated_fields use words (GTE, EQUALS). Never use GTE/LTE as filter operators.
Inputs
environment_slugstringrequired- Environment identifier.
query_specobjectrequired- Core query parameters. Time fields: use from/to. When omitted, the default 2-hour lookback is queried. <relational_fields> Each result row is a span. Prefix a column with one of these to read or test it on a related span in the same trace: - root.X — X taken from the trace's root span (the span whose parent_id is empty). - parent.X — X taken from this span's immediate parent (joined on parent_id = span_id). - child.X — X taken from a direct child span (joined on span_id = child's parent_id). Direct children only — does not reach grandchildren. - any.X — matches when at least one span in the trace populates X. - none.X — matches when no span in the trace populates X (excludes the whole trace if any span matches). - any2.X / any3.X — additional independent any-matchers. Use these when two or three filters must each be satisfied, but possibly by different spans. Filters that share a single any. prefix must all hold on the same span; switching to any2./any3. lets each filter land on a different span. Constraints: - Relational prefixes are not allowed inside calculations or per-calculation filters. - "any" in breakdowns requires a matching WHERE filter on the same prefixed column. - "none" is valid only in filters, not in breakdowns. - Relational filters compose with AND only — express OR by issuing two queries or via a calculated_field. Note: To filter to root spans without joining, use a does-not-exist filter on the dataset's parent-id column. There is no "is_root" column in the query API. </relational_fields> <metrics_datasets> On metrics datasets, temporal aggregation (LAST, SUMMARIZE, INCREASE) is applied automatically based on metric type. Do not use these as calculated_field expressions. Operators not allowed on metrics datasets: RATE_SUM, RATE_AVG, RATE_MAX, CONCURRENCY, bare COUNT (without column). Use SUM, AVG, MAX, or percentiles on metric fields instead. COUNT_DISTINCT is not allowed on a metric column, since it would count distinct datapoint values. It is allowed on attribute columns, including alongside an aggregate over a metric column: COUNT_DISTINCT(host.name) with SUM(system.cpu.time) counts the hosts reporting. COUNT_DATAPOINTS(column) counts how many raw metric datapoints (samples) were reported for a metric column. HISTOGRAM_COUNT(column) returns the total number of observations recorded across a Metrics 2.0 histogram or summary column — the sum of its per-bucket counts. Reach for it when asked for the "sum of counts from a histogram", "total observations", "how many observations/samples are in this histogram", or "total request count from a latency histogram". COUNT_DATAPOINTS and HISTOGRAM_COUNT are only allowed on metrics datasets. For histogram metrics, use AVG/P50/P99/MAX/HEATMAP directly on the histogram column name. </metrics_datasets> <sampling> When data is sampled, results include sampling metadata. COUNT, SUM, AVG, percentiles, HEATMAP, CONCURRENCY, RATE_SUM, and RATE_AVG are weighted by sample rate. COUNT_DISTINCT, MIN, MAX, and RATE_MAX are not corrected. Set usage_mode=true to disable all sample rate correction and see raw event counts. </sampling>
cursorstring- Continue a raw-row query from the previous page. Copy the previous response's next_cursor value and repeat the same environment, dataset, filters, calculated fields, and selected columns. Replace all prior time fields with the absolute from and to values from the previous response's Metadata. Only valid with raw_row_columns.
dataset_slugstring- Dataset identifier. Required unless environment_wide_query is true.
environment_wide_querystring- Query all datasets in the environment. When true, dataset_slug is not required. Not compatible with legacy environments. Default: false.
include_markersstring- Include the table of deploy/incident markers overlapping the query window. Default: true. Set to false to skip markers you do not need, which avoids a wall of repeated deploy markers on every call.
raw_row_columnsstring- Return raw matching events with only these columns. A non-empty list selects raw-row mode; omit calculations and other aggregate-only query fields. The event timestamp is always returned and does not need to be listed. Rows are returned in storage order, not time order; sort by the returned timestamp column before interpreting a sequence. Between 1 and 100 unique column names.
results_limitstring- Maximum raw rows to return. Raw-row results are limited to 1000 returned values, including the timestamp column, so results_limit × (number of raw_row_columns + 1) must be at most 1000. If omitted, returns the largest number of rows that fits that budget. For aggregate queries, this legacy argument is accepted and ignored.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
usage_modestring- Return raw event counts without sampling rate correction. Applies only to aggregate queries. Default: false.
honeycombmcp_semconvQuery the semantic convention registry: the latest embedded OTel semconv release merged with Honeycomb's overlay, plus the team's custom schema when one exists.Read-onlySemconv
Query the semantic convention registry: the latest embedded OTel semconv release merged with Honeycomb's overlay, plus the team's custom schema when one exists. Actions: - search: substring match on names/briefs; requires query; concise results. - get: exact ids; full definitions; unknown ids appear in not_found. - list_namespaces: top-level namespaces; optional signal_type filter. Use returned canonical names in queries; Honeycomb normalises names at ingest.
Inputs
actionstringrequired- Operation to performone of
searchgetlist_namespaces idsarray- get only: exact attribute names, e.g. ["http.response.status_code", "db.system"]
include_deprecatedboolean- search and get: include deprecated attributes; defaults to current attributes only
include_enumboolean- get only: include the full enum member list; default returns a count and sample
limitinteger- search only: maximum results (default 20, max 50)
querystring- search only: term matched against attribute names and descriptions, e.g. "http status"
signal_typestring- search and list_namespaces: restrict to attributes of one signal typeone of
spanmetricattribute_groupevententity teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_canvas_agent_invokeKick off a single-turn run of the Honeycomb Canvas agent.WriteCanvas Agent Invoke
Kick off a single-turn run of the Honeycomb Canvas agent. Pass investigation_id to extend an existing investigation visible to the caller's team. Omit investigation_id to create a new investigation for this prompt; the new ID is returned in the response so the caller can reuse it on follow-up calls. Returns one of: status='running' with a session_id (call canvas_agent_poll_response next); status='busy' with a message (the user is mid-turn — wait at least 30 seconds, then retry, do NOT loop). Both responses also include investigation_url, a direct browser link to the canvas. On 'running', poll repeatedly until poll returns status='completed' or 'error'. Each poll waits up to 50 seconds. Best for asking the agent to summarize findings, run additional analysis, or kick off a new investigation.
Inputs
promptstringrequired- Prompt to send to the canvas agent. Will be wrapped in <instructions> tags before delivery.
investigation_idstring- ID of an existing investigation (e.g. 'hcciv_…'). Omit to create a new investigation for this prompt.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
titlestring- Optional title for a newly-created investigation. Ignored when investigation_id is provided. Defaults to an auto-generated title.
honeycombmcp_create_boardCreate a board (dashboard) with query, SLO, and text panels.WriteCreate Board
Create a board (dashboard) with query, SLO, and text panels. When to use: - "Create a dashboard for service X" / "build a board with latency and error queries" — primary creation path. - After running queries and collecting their run IDs, assembling them into a board for sharing. - When a user wants an overview with both SLOs and queries side by side. - Before creating, call list_boards to check whether a similar board already exists. Pairs with: list_boards (discover existing boards and tag conventions), get_slos (get SLO IDs for panels), find_queries (locate saved query IDs). Board quality: pick each panel's chart_type from the query's shape (see the chart_type field docs). If most query panels come out 'line', revisit them. Prefer one calculation per query panel. Aim for 6-12 query panels, context (text, SLOs) before detail. Board queries re-run on every view, so keep time ranges narrow and GROUP BY cardinality bounded. Panel type discriminator: each panel's "type" field determines which other fields are required. - type="query": id (query run PK) is required; name/description/chart_type/display_style/thresholds are optional. - type="slo": id (SLO PK) is required. - type="text": content (Markdown string, max 10 000 chars) is required; id is unused. Panels render in the order you specify in the array. Size is optional (width 1-12, height in rows); omit size for auto-layout. Thresholds (max 5 per chart) draw horizontal lines on query panel charts; each needs value + operation (gt/lt) + color + line_style, and optionally label and chart_index. Supported for chart_type 'default'/'line'/'stacked'/'bar'/'stat'; not for 'categorical_bar'/'pie'. Preset filters (max 5) add filterable column dropdowns to the board — each needs column + alias.
Inputs
environment_slugstringrequired- Environment slug where the board will be created.
namestringrequired- Board name. Maximum 255 characters.
panelsarrayrequired- Ordered array of panels. Each panel has a required 'type' discriminator ('query', 'slo', or 'text') that determines which other fields are required. Panels render in array order. Prefer query runs with a single calculation: every calculation renders as its own mini-chart stacked inside one panel. Duplicate queries on a board are rejected; to show the same data twice (e.g. a stat and a trend), re-run one with a trivially-true filter such as 'service.name exists' and the same time range.
descriptionstring- Board description (optional). Maximum 1023 characters.
preset_filtersarray- Up to 5 preset filter dropdowns for the board. Each creates a column-filter widget visible to all board viewers. Both column and alias are required per filter (max 5).
privateboolean- When true the board is only visible to its creator. Defaults to false.
tagsarray- Tags in 'key:value' format (e.g. ['team:platform', 'tier:critical']). Keys: lowercase letters only, max 32 chars. Values: start with lowercase letter, alphanumeric plus '/' and '-', max 128 chars.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_create_markerCreates a marker (a vertical annotation on charts) to mark a point or window in time, such as a deploy, incident, or config change.WriteCreate Marker
Creates a marker (a vertical annotation on charts) to mark a point or window in time, such as a deploy, incident, or config change. Scope it to one dataset or, with dataset_slug='__all__', the whole environment.
Inputs
dataset_slugstringrequired- Dataset slug (required). Use '__all__' for an environment-wide marker that appears on every dataset.
environment_slugstringrequired- Environment slug where the marker will be created.
messagestringrequired- Marker label shown on the chart (required).
fromstring- Marker start time. Defaults to now when omitted. Unlike read-tool ranges, future marker times are allowed for scheduled events. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
tostring- Optional marker end time. Omit for a point marker; when present, it may equal from and must not be before from. Future marker times are allowed for scheduled events. Accepted timestamps are positive epoch seconds (at most 10 digits), RFC3339/ISO datetimes, or date-only values. Tool schemas require timestamps as strings, so quote epoch seconds (for example, "1723593600"). Zone-less datetimes and dates are UTC; dates mean midnight UTC (for an in-progress UTC day, use to: "now"). Relative values are "now" or explicitly signed durations such as "-2h" using lower-case s, m, h, d, or w.
typestring- Optional marker type (e.g. 'deploy', 'incident'). Markers of the same type share a color.
urlstring- Optional URL to link from the marker (max 8000 characters).
honeycombmcp_create_recipientCreate a notification recipient (email, Slack, PagerDuty, or webhook) so it can be attached to triggers, SLO burn alerts, and Anomaly Detection.WriteCreate Recipient
Create a notification recipient (email, Slack, PagerDuty, or webhook) so it can be attached to triggers, SLO burn alerts, and Anomaly Detection. When to use: - "Alert the on-call channel when this trigger fires" — create a Slack recipient first, then pass its ID to create_trigger. - "Page the on-call team via PagerDuty" — create a pagerduty recipient with the integration key. - "Send a webhook when an SLO burns" — create a webhook recipient with optional custom headers and payload templates. - Before calling create_trigger or update_trigger when no suitable recipient exists in list_recipients. Required fields per type: - type="email": email_address - type="slack": slack_channel (team must have Slack OAuth configured) - type="pagerduty": pagerduty_integration_key - type="webhook": webhook_url + webhook_name Pairs with: create_trigger, update_trigger, create_burn_alert, update_burn_alert (consume the returned recipient ID), list_recipients (check existing recipients before creating). <gotchas> - Slack recipients require your Honeycomb team to have Slack OAuth already configured; the call will fail with an error if it is not. - Webhook custom headers cannot override Content-Type, User-Agent, or X-Honeycomb-Webhook-Token (max 5 headers). - Webhook payload template variables: names must start with a lowercase letter; subsequent characters can be letters (upper or lower) or digits (max 10 variables, max 64 chars per name). </gotchas>
Inputs
typestringrequired- Recipient type. Determines which additional fields are required.one of
emailslackpagerdutywebhook email_addressstring- Email address. Required when type=email.
pagerduty_integration_keystring- PagerDuty Events API v2 integration key. Required when type=pagerduty.
pagerduty_integration_namestring- Display name for the PagerDuty integration (optional).
slack_channelstring- Slack channel name or ID (e.g. '#alerts-prod'). Required when type=slack. Team must have Slack OAuth configured.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
webhook_headersarray- Custom HTTP headers for webhook requests (optional, max 5). Cannot override Content-Type, User-Agent, or X-Honeycomb-Webhook-Token.
webhook_namestring- Display name for the webhook. Required when type=webhook.
webhook_payloadsobject- Custom payload templates (optional). Lets you control the JSON body sent for each notification event type. Template variables use {{variable_name}} syntax.
webhook_secretstring- Secret sent as the X-Honeycomb-Webhook-Token header (optional). Lets the receiving server verify the request origin.
webhook_urlstring- Webhook endpoint URL. Required when type=webhook.
honeycombmcp_create_triggerCreate a trigger that fires alerts when a query result crosses a threshold.WriteCreate Trigger
Create a trigger that fires alerts when a query result crosses a threshold. When to use: - "Alert me when error rate exceeds 5%" / "page on-call when request count drops below 100" — primary alerting path. - "Create a trigger that only fires during business hours" — use evaluation_schedule with type=window. - "Alert when traffic is 50% above last week's baseline" — use baseline_details. - To alert on SLO error budget burn, use create_burn_alert, not a trigger. Pairs with: list_recipients / create_recipient (obtain recipient IDs before creating the trigger), find_queries (locate a saved query to reference by query_id), get_triggers (verify after creation). Query source — mutually exclusive, exactly one required: - query: inline query spec (calculations required; filters, breakdowns, formulas optional). - query_id: ID of a saved query (from find_queries). Cannot provide both. Frequency encoding: frequency is in seconds (e.g. 900 = 15 min evaluation cycle). <gotchas> - query and query_id are mutually exclusive. Providing both returns an error. - Baseline triggers: threshold.op must be '>=' or '<=' (not '>' or '<'). The comparison is at the boundary because the baseline value is a ratio, and strict inequality against a ratio wouldn't resolve reliably. - Evaluation window vs frequency: when evaluation_schedule.type='window', the window duration must be at least 2x the trigger frequency. - formula passthrough pattern: when your inline query has formulas, add a passthrough formula (not calculation) — e.g. {"name":"volume","expression":"$all_requests"} — that aliases an existing calculation by name so it is directly addressable in ordering or threshold expressions. - frequency must be 60-86400 seconds and a multiple of 60. </gotchas>
Inputs
dataset_slugstringrequired- Dataset slug (required). Use '__all__' for environment-wide triggers that span all datasets.
environment_slugstringrequired- Environment slug (required).
namestringrequired- Trigger name (required).
thresholdobjectrequired- Threshold configuration (required). Defines the condition that fires the trigger.
alert_typestring- Alert behavior (optional, default 'on_change'). 'on_change' fires only when state transitions (firing→resolved or vice versa); 'on_true' fires on every cycle the condition is met.one of
on_changeon_true baseline_detailsobject- Compare current query values against a historical baseline (optional). When provided, threshold.op must be '>=' or '<=' — the comparison is at the boundary because the value is a ratio.
descriptionstring- Trigger description (optional).
disabledboolean- Create the trigger in a disabled state (optional, default false).
evaluation_scheduleobject- Restrict evaluation to specific time windows (optional). When type='window', the trigger only evaluates during the specified hours and days. The window duration must be at least 2x the trigger frequency.
frequencyinteger- Evaluation interval in whole seconds (optional, default 900). Must be 60-86400 and a multiple of 60.
queryobject- Inline query spec. Mutually exclusive with 'query_id' — provide exactly one.
query_idstring- Saved query ID. Mutually exclusive with 'query' — provide exactly one. Obtain IDs from find_queries.
recipientsarray- Recipient IDs to notify when the trigger fires (optional). Obtain IDs from list_recipients or create_recipient.
tagsarray- Tags in 'key:value' format (optional, e.g. ['team:platform', 'service:api']).
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_feedbackSubmit feedback about Honeycomb's MCP server to the agentic-intelligence team.WriteFeedback
Submit feedback about Honeycomb's MCP server to the agentic-intelligence team. When to use: - A tool returned unexpected, wrong, or confusing data. - You wanted a capability that no tool in this server provides. - A workflow felt unnecessarily clunky or required too many tool calls. - A tool description was misleading and caused you to use the wrong tool. Be specific: name the tool you used, what you tried, what you expected, and what you observed. Vague feedback is hard to act on. Pairs with: any tool — call this after completing (or failing) a task to report quality issues.
Inputs
feedback_bodystring- Specific, human-readable description of the issue or suggestion. Include: which tool you used, what you tried, what you expected, what you observed.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
honeycombmcp_update_boardEdit an existing board (dashboard) in place.DestructiveUpdate Board
Edit an existing board (dashboard) in place. Add, remove, update, or reorder panels; rename; and replace preset filters or tags. When to use: - "Add the new error-rate query to the API board" — append panels. - "Remove the deprecated SLO panel from this dashboard" — drop a panel by id. - "Rename the panel" / "switch this query to a table view" — modify a panel's name, description, chart_type, display_style, thresholds, or size. - "Add a 500ms threshold line to the latency panel" — set thresholds via update_panels or add_panels. - "Reorder the board so SLOs come first" — reorder panels via panel_order. - "Update the preset filters / tags" — replace the full set. - Always run list_boards with board_id first so you have the current type+id of each panel. Pairs with: list_boards (per-panel ids), find_queries (query run PKs for new query panels), get_slos (SLO PKs for new SLO panels), create_board (create instead of update). Operations apply in this order: remove_panels -> update_panels -> add_panels -> panel_order. Within a single call: removed panels can be referenced in remove_panels but not anywhere else; newly added text panels can not be referenced in panel_order or update_panels because they have no stable id until saved (added text panels are appended after any ordered panels). Replacement-set semantics: tags and preset_filters replace the full set when provided. To add one tag, read the current tags from list_boards, append, and pass the full updated list. Pass an empty array to clear. Omit entirely to leave unchanged. Per-panel thresholds also replace the full set: pass [] to clear, omit to leave unchanged. Panels added via add_panels follow the same design guidance as create_board (chart_type from query shape, one calculation per panel).
- Idempotent
Inputs
board_idstringrequired- Board ID to update. Obtain from list_boards.
environment_slugstringrequired- Environment slug where the board exists.
add_panelsarray- Panels to add to the board (optional). Same shape as create_board panels: each has a type discriminator ('query', 'slo', or 'text'). For queries, provide the query run PK as id. For SLOs, provide the SLO PK as id. For text, provide content. Query panels accept the same thresholds field as create_board. New panels are appended after existing panels in the order listed here. If size is omitted, MCP auto-sizes new panels (queries by complexity; SLO/text use defaults). Newly added text panels cannot be referenced in panel_order (they have no ID until saved). A query already on the board cannot be added again (same trivially-true-filter workaround as create_board).
auto_size_updated_panelsboolean- Optional. When true, query panels listed in update_panels are auto-sized by MCP when size is omitted, using query complexity and display style. When false or omitted, existing panel size is preserved unless size is explicitly provided.
descriptionstring- New description for the board (optional). Maximum 1023 characters.
namestring- New name for the board (optional). Maximum 255 characters.
panel_orderarray- Desired order of existing panels (optional). Array of panel references (type + id). Panels listed here are arranged in this exact order; any unlisted existing panels are appended after. Cannot reference newly added text panels (they have no id until saved). Duplicate entries are rejected.
preset_filtersarray- Replacement preset filters. When provided, replaces all existing preset filters. Pass empty array to clear filters. Omit to keep current filters (max 5).
remove_panelsarray- Panels to remove from the board (optional). Reference each panel by its type and id from list_boards detail view. Duplicate entries are rejected.
tagsarray- Replacement tags in 'key:value' format (optional). When provided, replaces all existing tags. Pass empty array [] to clear tags. Omit entirely to leave tags unchanged. Keys: lowercase letters only, max 32 chars. Values: start with lowercase letter, alphanumeric plus '/' and '-', max 128 chars.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
update_panelsarray- Existing panels to modify (optional). Reference each by type and id from list_boards, then supply only the fields to change. Per-type fields: queries accept name, description, chart_type, display_style, thresholds, size; text panels accept content, size; SLO panels accept size. Updating a text panel's content preserves its BoardTextID. For queries, supplying chart_type alone replaces visualization settings but preserves existing thresholds; supplying display_style alone preserves both.
honeycombmcp_update_triggerUpdate an existing trigger.DestructiveUpdate Trigger
Update an existing trigger. Partial update — only the fields you supply change; omitted fields keep their current values. When to use: - "Disable this trigger temporarily" — set disabled=true without touching other fields. - "Add a Slack channel to the trigger's recipients" — replace recipients with the full updated list (note: replaces, does not merge). - "Lower the threshold from 5% to 3%" — update threshold.value. - "Slow down the evaluation frequency" — change frequency. Pairs with: get_triggers (retrieve trigger_id and current state), list_recipients / create_recipient (get recipient IDs before updating). Recipients replacement semantics: when recipients is provided, it replaces the entire recipients list. To add one recipient, read current recipients from get_triggers, append the new ID, then pass the full list here. Pass an empty array [] to remove all recipients.
- Idempotent
Inputs
trigger_idstringrequired- Trigger ID to update. Obtain from get_triggers.
alert_typestring- Alert behavior: 'on_change' (fire on state transition) or 'on_true' (fire every cycle condition is met). Optional.one of
on_changeon_true baseline_detailsobject- Baseline comparison configuration (optional). When provided, threshold.op must be '>=' or '<='.
descriptionstring- New trigger description (optional).
disabledboolean- Enable or disable the trigger (optional). true = paused, false = active.
evaluation_scheduleobject- Evaluation schedule (optional). When type='window', the window must be at least 2x the trigger frequency.
frequencyinteger- Evaluation interval in whole seconds (60-86400, multiple of 60, optional).
namestring- New trigger name (optional).
queryobject- Inline query spec to replace the current query (optional). Mutually exclusive with 'query_id'.
query_idstring- Saved query ID to switch to (optional). Mutually exclusive with 'query'.
recipientsarray- Full replacement list of recipient IDs (optional). Replaces all existing recipients. Pass [] to remove all. Omit to leave recipients unchanged.
tagsarray- Replace all existing tags (optional). Pass [] to clear. Omit to leave unchanged.
teamstring- Team to run this tool against; only needed when your authorization covers multiple teams
thresholdobject- Threshold configuration (optional). When using baseline_details, threshold.op must be '>=' or '<='.
No tools match.
