Axiom MCP Server vs incident.io API

Axiom MCP Server 60

No x402, MPP or L402 (0). The pricing page states the platform fee, the free allowances, add-on prices and that usage carries volume discounts, with a calculator rather than a printed per-unit rate (20). The Personal plan is free with no card (20). POST /v2/orgs/provision needs no authentication and returns a working token, so an agent can start without a person, though a person must claim the organisation within 24 hours for it to persist (20). 0 + 20 + 20 + 20 = 60.

incident.io API 10

No x402, MPP or L402 (0). Plan prices per seat are public, Team at $19 and Pro at $25 a user a month, with no per-call price (10). The Basic plan is free, but the pricing page marks API, webhooks and MCP as not included, and the docs route trials through sales (0). A person signs up, pays and creates a key in the dashboard (0).

Axiom MCP Server 62

The server is closed source (axiomhq/mcp isn't public) and tools/list needs a session, so the input schemas couldn't be read; partial credit for a contract that exists (10). llms.txt on axiom.co and a Markdown twin of every docs page (10). The tools reference gives each tool a purpose, an example request and a Read or Write label, says to use queryMetrics for metrics datasets instead of queryDataset, and the 29 October 2026 changelog adds session instructions on finding dataset and field names first (15). No parameters, types or enums are published for the tools (4). An example per tool, the REST docs' error shapes and the 429 bodies; no MCP error list (8). A dated changelog with MCP entries and a protocol version stated (2026-07-28 alongside the session transport), and a registry version (15). 10 + 10 + 15 + 4 + 8 + 15 = 62.

incident.io API 88

OpenAPI 3.0.3 description, public at api.incident.io/v1/openapiV3.json per the docs and read from docs.incident.io/openapi/latest.json, 284 operations and 777 schemas (25). llms.txt and a Markdown twin of every docs page (10). Every operation has a description, but the median is 65 characters and few say when not to use a call. List incidents is the exception, with worked filter examples (12). 262 enums, required fields marked and two free-form objects in the whole file (13). 4,014 example values and thirteen error statuses on every operation, though the shared error example pairs an unrelated code and message (13). Versions sit in the path per resource and the changelog is generated from the description file (15).

Axiom MCP Server 72

Scored as a hosted MCP server. status.axiom.co is an incident.io page with six US and six EU components (API, ingest, querying, alerting, endpoints, app) and uptime per component for August to November 2026, with no MCP component (20). feed.rss holds nine incidents in the 90 days to 3 November 2026, among them elevated query errors in the US from 18:05 to 19:15 UTC on 14 October with missed monitor runs, a metrics ingestion and query disruption on 15 October, elevated query errors after a deployment on 21 October, metrics query error rates on 25 October, query errors and monitor delays on 27 October, metrics ingest on 30 October, EU monitor alerting degraded on 7 October, and console authentication through GitHub degraded on 12 August. US querying shows 99.90 per cent uptime. One incident over an hour on the query path and several shorter ones, so one major (10). Rate limits are published as headers (X-RateLimit-Scope, -Limit, -Remaining, -Reset) and plan limits on the limits page, but the per-minute numbers aren't printed (12). 429 with a message and reset headers, query cost caps that answer 429 with the reset time, and provisioning 429 with backoff guidance; no idempotency keys for the write tools (10). A published SLA of 99.9 per cent monthly uptime for Axiom Cloud with 10 and 25 per cent credits (10). Not marked beta; registry version 1.0.0 (10). 20 + 10 + 12 + 10 + 10 + 10 = 72.

incident.io API 90

Scored as a hosted API. status.incident.io lists components with history, API and MCP among them (20). The feed, re-read on 1 November 2026, has four incidents in the 90 days from 3 August, each on one component. Opsgenie webhook delays on 3 August, alert listing in the public API and dashboard on 18 August until a rollback (no duration given), Microsoft Teams latency from 13:00 to 15:08 UTC on 20 August and Slack Enterprise Grid login errors for a subset of customers on 2 October. All partial, nothing since 2 October (20). Limits are published with numbers, 1,200 requests a minute per key and lower figures for eight endpoints (15). 429 carries Retry-After, the body recommends exponential backoff, and seven create calls require an idempotency_key (15). The SLA commits to 99.9 per cent a month on Pro and Enterprise (10). The API carries no beta label (10).

Axiom MCP Server 63

31 tools in the reference, 28 without service map, so the 11-to-30 band with no toolset switch (15). APL queries take their own limits and time ranges, and the REST API documents timestamp pagination; nothing documents page sizes for the list tools (15). 429 bodies state the limit and reset, the REST docs describe error shapes, and a sendFeedback tool reports unclear descriptions to Axiom (12). Reads and writes are labelled in the docs, but delete tools have no confirmation step, no idempotency keys exist for writes, and annotations weren't confirmed (8). One-command setup for 16 clients with OAuth, a setup prompt for agents, and official SDKs in eight languages for the API behind it (13). 15 + 15 + 12 + 8 + 13 = 63.

incident.io API 75

Scored for the REST API. page_size sets response size, but no field selection was found and incident objects are large. The description file is 5.4 MB, with per-resource files as the smaller route (12). Cursor pagination on 41 list operations and operator filters such as status_category[one_of] (18). Errors carry a code, a message, the field at fault and a request_id (18). idempotency_key is required on seven create calls, and updates by PUT have no key (14). Seven official SDKs and a CLI with JSON output, with idempotency_key and visibility required to create an incident (13).

Axiom MCP Server 72

Browser OAuth creates a session the agent uses as the signed-in user, listed and revocable under Settings > Profile, and the docs say agents never see tokens; the header route uses a personal access token with full account rights, and the organisation id, not a secret, may go in the URL (26). Query cost limits on roles cap what an OAuth session can spend, scoped API tokens with expiry exist for the REST API, but the MCP server runs with the user's whole role and lists delete tools with no confirmation, and the AI agents page's read-only description contradicts the tools reference (12). Log, trace and event content is untrusted text and no injection guidance was found (2). An audit log on every organisation for 30 days, full history as an add-on, and session listing (12). ISO 27001, SOC 2 Type II, a security.txt on app.axiom.co, a bug bounty policy at axiom.co/security and annual penetration tests (20). 26 + 12 + 2 + 12 + 20 = 72.

incident.io API 64

Organisation keys carry chosen permissions, 13 of 36 scopable to teams, can be rotated and are shown once. User keys take the owner's role and die with the account. 30 for that, less the checklist's 10 because alert event and heartbeat endpoints accept the alert source token in a token query parameter. The API key itself travels only in the header (20). A viewer permission gives read-only keys and the MCP status page tool only drafts, but no confirmation step guards destructive API calls (15). Alert payloads and incident text are untrusted content. The docs cover redaction of sensitive data, and no injection guidance for API consumers was found (4). Audit logs are Enterprise only, kept one year, exported or streamed, and API actions are attributed to the key (10). security.txt valid to July 2027, a disclosure policy with a five-working-day reply, SOC 2 Type I and II claimed, yearly penetration tests, no paid bounty (15).

Axiom MCP Server 70

Closed service with clear terms naming Axiom, Inc. (15). A privacy policy with retention by data category, a DPA that names the sub-processor page and US or EU processing, and per-plan retention on the pricing page; the sub-processor list itself renders through a script and the terms carry no date (20). The changelog has a deprecation category and the docs mark the legacy query endpoint, but no notice period is written down (10). US and EU edge deployments are documented and the DPA says data may be processed in either, with the sub-processor list unread (12). 15 + 20 + 10 + 12 = 57.

incident.io API 77

Closed service under published Terms and Conditions effective 1 August 2026, with the SDKs, CLI and skills plugin under MIT (17). Privacy policy, DPA, sub-processor list and an AI data handling page are public. The terms limit training on customer content to the customer's own benefit. The security FAQ's statement that no data leaves Europe disagrees with a sub-processor list naming 17 processors in the United States, and retention is stated in general terms (20). Deprecated endpoints carry a removal date in their descriptions and the docs give integrators three months, but the changelog shows removals with no earlier entry (17). 20 sub-processors with locations and purposes, hosting regions named, 15 days' notice of changes in the DPA (18).