How to set up the PagerDuty MCP server

PagerDuty coordinates incident response across services, teams, on-call schedules, and incidents. Use OAuth for user-delegated access or a REST API key for an approved automation. PagerDuty's MCP server guide documents the remote endpoint, https://mcp.pagerduty.com/mcp, and both supported authentication methods.

This guide prepares PagerDuty for any compatible MCP client. The PagerDuty agent template is separate from PagerDuty authentication and service access.

Choose a connection method

Choose OAuth when the MCP connection should follow the authorizing user's incident and service access. Choose a REST API key when the MCP connection needs a stored, non-interactive credential. PagerDuty's MCP server guide and API access key documentation cover these options.

Recommended: OAuth

Use OAuth when the connection should observe the authorizing user's PagerDuty teams, services, and incidents. Start with a test service and a test user who is not an account owner.

1. Register the OAuth application in PagerDuty and enter the exact redirect URL requested by the MCP client; for Dome, use https://api.domesystems.ai/oauth/callback.
2. Request only the scopes needed for the intended incident lookup or acknowledgement workflow.
3. Authorize as the test user and select the intended PagerDuty account.
4. Read a known test incident and verify that an incident in an unassigned team is unavailable.
5. Keep incident resolution, escalation-policy changes, and service deletion out of a read-only setup.

PagerDuty's MCP server guide lists the remote endpoint and links to its current OAuth requirements.

Alternative: API token

For a least-privileged test, create a User Token REST API Key. It is a personal token: calls use the permissions of the PagerDuty user who created it. PagerDuty requires Advanced Permissions for users to create one.

To create a personal token:

1. In PagerDuty, open User Icon → My Profile → User Settings.
2. Under API Access, select Create API User Token.
3. Give it a clear description, create it, and copy the key immediately—PagerDuty shows the full value only once.
4. In the MCP client, use https://mcp.pagerduty.com/mcp and send the header Authorization: Token token=<your-key>.
5. Record the token owner and rotation date, then test an allowed incident and an out-of-boundary resource.

For account-wide automation, an Account Owner or Admin can instead create a General Access REST API Key under Integrations → Developer Tools → API Access Keys. Select Read-only API Key where available. Do not use an Events API integration key: it is not a REST API credential and will not authenticate to PagerDuty MCP.

PagerDuty's API access key documentation explains the permission model and both key types.

Verify PagerDuty MCP

Use this checklist to confirm the MCP server is connected with the intended access.

• Connect the MCP client using the newly created authorization.
• Confirm that PagerDuty MCP tools are discovered.
• Read one known test resource that the authorized identity is allowed to access.
• Attempt to read a resource outside the approved PagerDuty boundary; it should be unavailable or denied.
• Confirm that no write capability beyond the reviewed setup is available.

Troubleshooting

An authorization can be valid while no incidents are visible because the user is not assigned to the relevant team or service. Fix membership first; broadening account role changes the incident boundary.

Next steps

Deploy the PagerDuty agent template to create a governed agent in Dome that can work with the approved services and incidents, with the template's included model, tools, and rules.