---
title: "Connect Better Stack to Claude: Coordinate On-Call & Escalations"
slug: connect-better-stack-to-claude-coordinate-on-call-escalations
date: 2026-06-09
author: Uday Gajavalli
categories: ["AI & Agents"]
excerpt: "Learn how to connect Better Stack to Claude using a managed MCP server to automate incident triage, manage on-call schedules, and coordinate escalations."
tldr: "Connect Better Stack to Claude using Truto's managed MCP server. This guide covers how to generate an MCP endpoint, configure Claude, and automate incident response and on-call routing without building custom API integrations."
canonical: https://truto.one/blog/connect-better-stack-to-claude-coordinate-on-call-escalations/
---

# Connect Better Stack to Claude: Coordinate On-Call & Escalations


If you need to connect Better Stack to Claude to automate incident response, coordinate on-call schedules, or handle critical system escalations, you need a [Model Context Protocol (MCP) server](https://truto.one/what-is-mcp-and-mcp-servers-and-how-do-they-work/). This server acts as the translation layer between Claude's tool-calling capabilities and Better Stack's REST API. You can either [build, host, and maintain this infrastructure yourself](https://truto.one/the-hands-on-guide-to-building-mcp-servers-for-ai-agents-2026/), or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL. If your team uses ChatGPT, check out our guide on [connecting Better Stack to ChatGPT](https://truto.one/connect-better-stack-to-chatgpt-manage-incidents-status-pages/) or explore our broader architectural overview on [connecting Better Stack to AI Agents](https://truto.one/connect-better-stack-to-ai-agents-monitor-performance-slas-uptime/).

Giving a Large Language Model (LLM) read and write access to your critical observability and incident management infrastructure is a serious engineering challenge. You must handle strictly typed JSON payloads, manage token lifecycles, and carefully navigate Better Stack's specific rate limits. Every time an endpoint changes or you need to expose a new metric, you have to update your server code, redeploy, and test the integration. This guide breaks down exactly how to use Truto to generate a [secure, managed MCP server](https://truto.one/managed-mcp-for-claude-full-saas-api-access-without-security-headaches/) for Better Stack, connect it natively to Claude, and execute complex on-call workflows using natural language.

## The Engineering Reality of the Better Stack API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools using JSON-RPC 2.0, the reality of implementing it against vendor APIs is painful. You are not just integrating "Better Stack" - you are integrating an entire incident management lifecycle, uptime monitoring system, and on-call routing matrix.

If you decide to build a custom MCP server for Better Stack, you own the entire API lifecycle. Here are the specific challenges you will face:

**Complex Incident Timeline Pagination**
Better Stack maintains deeply granular timelines for incidents, tracking everything from automated alerts to human acknowledgments and comments. Extracting this data requires handling paginated API responses accurately. If you expose raw pagination cursors to Claude, the model will frequently hallucinate token values or misunderstand how to iterate through pages. Truto normalizes this across all endpoints into a standard `limit` and `next_cursor` schema, explicitly instructing the LLM to pass cursor values back unchanged, ensuring Claude can reliably read through a complex, multi-hour incident timeline without losing context.

**Strict Relational Dependencies**
Operations in Better Stack are highly relational. You cannot simply "create an incident" in a vacuum - it often requires linking to specific monitors, heartbeat groups, or escalation policies. Modifying an on-call schedule requires referencing specific rotation IDs and user IDs. If you build your own MCP server, you must write extensive validation logic to ensure the LLM fetches the required foreign keys before attempting write operations. Truto's dynamically generated tool schemas automatically document these required parameters, guiding Claude to perform the necessary lookup steps before executing a state change.

**Handling Rate Limits and Uptime Constraints**
During a major outage, your systems generate a high volume of alerts. If your AI agent attempts to query Better Stack aggressively during an incident storm, you will hit API rate limits. Better Stack enforces strict request quotas to maintain system stability. When an upstream API returns an HTTP 429 Too Many Requests, Truto does not retry, throttle, or apply backoff on rate limit errors. Instead, Truto passes that error directly to the caller. Truto normalizes upstream rate limit info into standardized headers (`ratelimit-limit`, `ratelimit-remaining`, `ratelimit-reset`) per the IETF specification. The caller - your MCP client or AI agent framework - is responsible for implementing retry and exponential backoff logic based on these standardized headers. Do not assume your infrastructure layer will absorb these limits for you.

## How to Generate a Better Stack MCP Server

Truto dynamically generates MCP tools from Better Stack's underlying API endpoints. The system reads the API documentation, parses the expected request and response schemas, and compiles them into a JSON-RPC 2.0 endpoint. You can generate this server via the Truto UI or programmatically via the API.

### Method 1: Generating via the Truto UI

For teams who want a visual setup process, you can generate the MCP server directly from the Truto dashboard.

1. Log into your Truto account and navigate to the **Integrated Accounts** section.
2. Select your connected Better Stack instance.
3. Click on the **MCP Servers** tab.
4. Click **Create MCP Server**.
5. Configure the server settings (assign a descriptive name, select specific methods like `read` or `write`, add tool tags, or set an expiration date).
6. Click **Create** and immediately copy the generated MCP server URL (e.g., `https://api.truto.one/mcp/abc123def456...`). This URL contains a hashed token and acts as the sole authentication required for the client.

### Method 2: Generating via the Truto API

For platform engineers building automated provisioning workflows, you can generate the MCP server programmatically using the Truto REST API.

To create the server, make an authenticated POST request to the `/integrated-account/:id/mcp` endpoint:

```bash
curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Better Stack Incident Response Server",
    "config": {
      "methods": ["read", "write"],
      "tags": ["incidents", "on-call"]
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'
```

The API validates the configuration, generates a secure token, provisions the necessary backend routing, and returns the MCP server URL. The underlying token is cryptographically hashed before being stored in a distributed key-value store, ensuring fast, secure routing for all JSON-RPC calls.

## How to Connect the MCP Server to Claude

Once you have your Truto MCP server URL, you need to register it with your LLM client. You can do this visually through the application settings or manually via configuration files.

### Method 1: Connecting via the Claude UI

If you are using the Claude Desktop application or an enterprise web environment that supports direct UI configuration:

1. Open Claude and navigate to **Settings**.
2. Locate the **Integrations** or **Connectors** panel.
3. Select **Add MCP Server** or **Add Custom Connector**.
4. Paste the Truto MCP server URL you generated earlier.
5. Click **Add**. Claude will immediately initiate an MCP handshake, calling the `initialize` and `tools/list` JSON-RPC methods to discover the available Better Stack capabilities.

### Method 2: Connecting via the Configuration File

For local development or headless deployments, you can register the MCP server by modifying the `claude_desktop_config.json` file. Truto provides an SSE (Server-Sent Events) transport layer that can be invoked using the standard `@modelcontextprotocol/server-sse` package.

Locate your configuration file (typically found at `~/Library/Application Support/Claude/claude_desktop_config.json` on macOS or `%APPDATA%\Claude\claude_desktop_config.json` on Windows) and add the following JSON payload:

```json
{
  "mcpServers": {
    "better-stack-truto": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/YOUR_TRUTO_MCP_TOKEN"
      ]
    }
  }
}
```

Save the file and restart Claude Desktop. The model will parse the configuration, establish the SSE connection, and load the Better Stack tools into its context window.

## Core Better Stack MCP Tools

Truto exposes the full surface area of the Better Stack API, but certain operations are critical for coordinating on-call escalations. Here are six high-leverage hero tools your AI agents will use most frequently.

### list_all_better_stack_incidents

This tool retrieves a collection of incident objects, including their current status, severity, and IDs. It handles cursor-based pagination automatically. Claude uses this to establish situational awareness during an ongoing outage.

> "Fetch all currently open incidents in Better Stack. Identify any incidents marked with high urgency and list their names, IDs, and current statuses."

### better_stack_incidents_acknowledge

This tool marks an active incident as seen and under review by an operator. It requires the `incident_id`. Acknowledging an incident stops automated escalation policies from paging the next tier of engineers.

> "Acknowledge incident ID 982347. Add a note to the team that I have verified the database CPU spike and am currently investigating the root cause."

### better_stack_incidents_resolve

This tool closes an active incident once the underlying issue is fixed. Resolving the incident automatically updates connected status pages and halts any active alert loops.

> "The database migration has been rolled back and latency has returned to normal. Resolve incident ID 982347 and confirm the status has been updated."

### better_stack_incidents_escalate

This tool promotes an incident to a higher severity or forces a notification to additional responders based on the escalation policy. It is critical when an initial responder cannot resolve the issue alone.

> "I cannot resolve the Redis cluster failure. Escalate incident ID 982347 immediately to alert the Tier 3 infrastructure engineering team."

### list_all_better_stack_on_call_schedules

This tool retrieves the configuration details for your organization's on-call schedules. Claude uses this to determine who is currently responsible for specific systems before triggering manual overrides or direct communications.

> "Check the Better Stack on-call schedules and tell me who is currently the primary on-call engineer for the 'Core Infrastructure' rotation."

### create_a_better_stack_incident_comment

This tool appends a new comment to an incident timeline. It is essential for maintaining an immutable audit trail of actions taken during an outage, which is required for post-mortem analysis and compliance audits.

> "Add a comment to incident ID 982347 stating: 'Attempted to restart the web pods, but the crash loop backoff persists. Extracting logs for further analysis.'"

For the complete inventory of available endpoints - including tools for managing monitors, heartbeat groups, and status pages - review the [Better Stack integration page](https://truto.one/integrations/detail/betterstack).

## Workflows in Action

Exposing individual REST endpoints as MCP tools is only the first step. The true value of connecting Claude to Better Stack lies in the model's ability to chain these tools together to execute complex, multi-step incident response workflows.

### Scenario 1: Incident Triage & Acknowledgment

**The Persona:** An L1 Support Engineer or Junior SRE responding to an alert storm.

> "I just got paged about a potential issue with the checkout API. Check our open Better Stack incidents, find the relevant alert, acknowledge it so we stop paging the team, and post a comment that I am investigating."

**The Execution Sequence:**
1. Claude calls `list_all_better_stack_incidents` to retrieve the current active alerts.
2. The model parses the JSON response, filtering for incidents related to the "checkout API" and extracting the specific `incident_id`.
3. Claude executes `better_stack_incidents_acknowledge` using the extracted ID, moving the incident from triggered to acknowledged.
4. Finally, Claude calls `create_a_better_stack_incident_comment` using the same ID, appending a human-readable note to the incident timeline.

**The Outcome:** The alert storm is halted, the escalation policy is paused, and the rest of the engineering team sees clear documentation that an operator has taken ownership of the issue.

### Scenario 2: Escalation & Timeline Synthesis

**The Persona:** An Incident Commander or SRE Lead managing a critical outage.

> "Incident 10455 is taking too long to resolve. Escalate it to the next tier immediately. Then, grab the entire timeline of events for this incident and summarize what steps have been taken so far, so I can brief the incoming Tier 3 engineer."

**The Execution Sequence:**
1. Claude calls `better_stack_incidents_escalate` with ID 10455, triggering the next phase of the configured escalation policy.
2. Claude executes `list_all_better_stack_incident_timeline` to extract the granular history of the outage.
3. If the timeline is long, Claude handles the `next_cursor` pagination gracefully, calling the timeline tool again until it has ingested the full event history.
4. The model processes the raw JSON timeline data, synthesizes the system logs and human comments into a cohesive summary, and outputs a formatted incident brief.

**The Outcome:** The appropriate senior engineers are paged immediately, and they are provided with a concise, accurate summary of the outage history without having to manually dig through raw logs.

## Security and Access Control

Exposing your incident management infrastructure to an AI model requires strict governance. If an LLM hallucinates and resolves an active incident prematurely, it could mask a critical outage. Truto provides multiple layers of security to constrain the MCP server's access.

*   **Method Filtering:** You can configure the MCP server to only allow specific HTTP methods. For example, setting `methods: ["read"]` ensures the LLM can query incidents and on-call schedules but cannot create, escalate, or resolve them. This is ideal for generating post-mortem reports safely.
*   **Tag Filtering:** By passing a `tags` array during server creation, you restrict the available tools to specific domains. Tagging an MCP server with `["status_pages"]` ensures the LLM can only interact with public-facing communication tools, completely isolating your internal on-call routing data.
*   **API Token Authentication:** By default, possession of the MCP URL grants access. By enabling `require_api_token_auth: true`, you force the client to provide a valid Truto session or API token in the Authorization header. This prevents unauthorized execution even if the MCP URL is exposed in log files.
*   **Server Expiration (TTL):** You can set an `expires_at` timestamp when generating the server. Once the deadline passes, distributed scheduled tasks automatically purge the token and its associated capabilities. This is perfect for granting an external contractor temporary access to Better Stack data during a specific project.

## Handling Rate Limits in Production

When building automated systems on top of observability platforms, handling rate limits correctly is critical. Better Stack protects its infrastructure aggressively during major incidents.

It is vital to understand that Truto does not retry, throttle, or apply backoff on rate limit errors. If your AI agent executes a loop that queries Better Stack too frequently and triggers an HTTP 429 Too Many Requests response, Truto passes that error directly back to the caller.

To help your agents recover gracefully, Truto normalizes the upstream rate limit information into standardized headers according to the IETF specification (`ratelimit-limit`, `ratelimit-remaining`, `ratelimit-reset`). The caller - whether it is Claude Desktop, a LangGraph agent, or a custom application - is entirely responsible for reading these headers and implementing the appropriate retry and exponential backoff logic. This architectural decision ensures that your integration layer remains transparent and does not mask performance bottlenecks or latency issues caused by aggressive polling.

## Strategic Wrap-up

Connecting Better Stack to Claude transforms incident response from a manual, click-heavy process into an automated, conversational workflow. By leveraging a managed MCP server, you eliminate the need to write custom JSON-RPC handlers, manage OAuth tokens, or maintain complex pagination logic. Your SREs can focus on diagnosing root causes, while Claude handles the administrative overhead of acknowledging alerts, escalating tickets, and documenting timelines.

Whether you need to generate a read-only server for post-mortem analysis or a fully privileged server for automated incident triage, Truto provides the infrastructure required to scale your AI operations securely.

> Stop wasting engineering cycles building custom integrations. Partner with Truto to instantly connect your AI agents to Better Stack and 100+ other B2B platforms.
>
> [Talk to us](https://cal.com/truto/partner-with-truto)