On-call alert → AI runbook
PagerDuty → Claude reads last 5 deploys + logs → draft runbook in the alert thread.
p95 latency on /api/checkout crossed 1200ms for 6 min. Correlated deploy: web@d41f2a. Suggested rollback command attached.
Page goes off at 03:00. The on-call spends 15 minutes hunting for the latest deploy and the right log query before they even start debugging.
Before the on-call opens their laptop, the incident channel already has: probable cause, suspect deploy, copy-paste log query, suggested rollback command.
Ingredients & skills
- ANTHROPIC_API_KEY
- PAGERDUTY_WEBHOOK_SECRET
- GITHUB_TOKEN
- DATADOG_API_KEY
- SLACK_BOT_TOKEN
- Anthropic
- PagerDuty
- GitHub
- Datadog
- Slack
- github-mcp
- datadog-mcp
- slack-mcp
How it works
A PagerDuty webhook hands the alert to Claude. It pulls the last 5 deploys, tails the relevant logs, and posts a runbook draft into the incident channel within 30 seconds.
1 — Webhook receiver
Verify the PagerDuty signature first. Always. Treat unsigned posts as hostile.
export const Route = createFileRoute("/api/public/pagerduty")({
server: { handlers: { POST: async ({ request }) => {
const sig = request.headers.get("x-pagerduty-signature") ?? "";
const body = await request.text();
if (!verifyPD(sig, body, process.env.PAGERDUTY_WEBHOOK_SECRET!)) return new Response("bad sig", { status: 401 });
const incident = JSON.parse(body);
await draftRunbook(incident);
return new Response("ok");
} } },
});2 — Gather context
Three parallel reads. Pass them all to Claude in one message.
const [deploys, logs, dashboards] = await Promise.all([
github.listDeploys({ since: '30m' }),
datadog.logs.search({ query: incident.tags.join(' AND '), from: '30m ago' }),
datadog.dashboards.list({ tag: incident.service }),
]);3 — Draft and post
Single Slack message, threaded under the incident channel.
await slack.chat.postMessage({
channel: `incident-${incident.id}`,
text: runbook,
blocks: toBlocks(runbook),
});The button above runs the same command with your saved config. This is the raw CLI form.
locker deploy oncall-runbook --trigger pagerduty