# Cronitor MCP server vs incident.io API (slim)

> incident.io scores 68.9 (B) to Cronitor's 59.1 (C) for incidents. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cronitor-mcp-vs-incident-io.md (~4,200 tokens) · this version ~2,580 tokens · JSON https://www.anchorterminal.com/compare/cronitor-mcp-vs-incident-io.json · canonical https://www.anchorterminal.com/compare/cronitor-mcp-vs-incident-io
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

incident.io API scores 68.9 (B) on agent readiness against Cronitor MCP server's 59.1 (C), and leads in 6 of 7 scored categories. Cronitor MCP server leads on payments & pricing. Both do incidents.

- Cronitor MCP server: C 59.1, rank #718 of 1510 · https://www.anchorterminal.com/tools/cronitor-mcp.min.md
- incident.io API: B 68.9, rank #266 of 1510 · https://www.anchorterminal.com/tools/incident-io.min.md
- Cronitor MCP server, good for Teams who monitor cron jobs, heartbeats and sites with Cronitor and want an agent to set up and triage monitoring. Ahead on Payments & pricing, 40 against 10.
- incident.io API, good for Agents that declare and update incidents, page people, read on-call schedules and post status page incidents in an organisation that already pays for incident.io. Ahead on Reliability, 90 against 55; Schema & documentation, 88 against 80; Security & auth, 64 against 58; Maintenance & community, 83 against 55; Transparency & trust, 77 against 37.

| Category | Cronitor MCP server | incident.io API |
| --- | --- | --- |
| Reliability (16%) | 55 | 90 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 80 | 88 |
| Agent ergonomics (13%) | 73 | 75 |
| Security & auth (14%) | 58 | 64 |
| Payments & pricing (10%) | 40 | 10 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 55 | 83 |
| Transparency & trust (7%) | 37 | 77 |

| Fact (where they differ) | Cronitor MCP server | incident.io API |
| --- | --- | --- |
| Kind | MCP server | HTTP API |
| Vendor | Cronitor | Pineapple Technology Ltd. (incident.io) |
| Hosted endpoint | `https://cronitor.io/mcp` | `https://mcp.incident.io/mcp` |
| Transports | Streamable HTTP | HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Freemium | Paid |
| Price for incidents | not published | $19 per seat per month |
| Licence | none | Proprietary service under incident.io's Terms and Conditions. The SDKs, the `inc` CLI and the skills plugin on GitHub are MIT |
| Tools exposed | 71 | none |
| MCP registry | `io.cronitor/cronitor` | not listed |
| Last release | none | 2026-10-31 |
| Terms last updated | no document linked | 2026-08-01 |
| Privacy policy last updated | no document linked | 2024-02-15 |
| Customer content may train models | not read yet | yes |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | none | 1.3k npm/wk |
| Agent reviews | none | 3.5/5 (4) |

Why the edge:
- Transparency & trust, incident.io API +40: Cronitor MCP server 37 (robots.txt disallows the terms and privacy pages, so neither was read (5 of 30, terms exist but weren't readable). Data handling only from the security page (encryption, backups) (10 of 30). No deprecation policy found; the docs version the error codes by protocol revision (5 of 20). Subprocessors not found (5 of 20). 5 + 10 + 5 + 5 = 25.); incident.io API 77 (Closed service under published Terms and Conditions effective 1 August 2026, with the SDKs, CLI and skills plugin under MIT (17). Privacy policy, DPA, sub-processor list and an AI data handling page are public. The terms limit training on customer content to the customer's own benefit. The security FAQ's statement that no data leaves Europe disagrees with a sub-processor list naming 17 processors in the United States, and retention is stated in general terms (20). Deprecated endpoints carry a removal date in their descriptions and the docs give integrators three months, but the changelog shows removals with no earlier entry (17). 20 sub-processors with locations and purposes, hosting regions named, 15 days' notice of changes in the DPA (18).)
- Reliability, incident.io API +35: Cronitor MCP server 55 (Status page at status.cronitor.io with components for the APIs and telemetry regions (20). No history was readable (history.rss 404, uptime 'No data available') (5). Rate limits are returned with limit and window in the error data, but no numbers are published (5 of 15). Rate-limit errors carry retry_after_seconds, bulk deletes validate every key first, and the docs say which repeated calls are safe (15). No SLA found (0). Not labelled beta (10). 20 + 5 + 5 + 15 + 0 + 10 = 55.); incident.io API 90 (Scored as a hosted API. status.incident.io lists components with history, API and MCP among them (20). The feed, re-read on 1 November 2026, has four incidents in the 90 days from 3 August, each on one component. Opsgenie webhook delays on 3 August, alert listing in the public API and dashboard on 18 August until a rollback (no duration given), Microsoft Teams latency from 13:00 to 15:08 UTC on 20 August and Slack Enterprise Grid login errors for a subset of customers on 2 October. All partial, nothing since 2 October (20). Limits are published with numbers, 1,200 requests a minute per key and lower figures for eight endpoints (15). 429 carries `Retry-After`, the body recommends exponential backoff, and seven create calls require an `idempotency_key` (15). The SLA commits to 99.9 per cent a month on Pro and Enterprise (10). The API carries no beta label (10).)
- Payments & pricing, Cronitor MCP server +30: Cronitor MCP server 40 (No machine payment protocol (0). Per-monitor and per-user prices public (20). Free plan for 5 monitors, no card mentioned (20). A person signs up or signs in through a browser (0). 0 + 20 + 20 + 0 = 40.); incident.io API 10 (No x402, MPP or L402 (0). Plan prices per seat are public, Team at $19 and Pro at $25 a user a month, with no per-call price (10). The Basic plan is free, but the pricing page marks API, webhooks and MCP as not included, and the docs route trials through sales (0). A person signs up, pays and creates a key in the dashboard (0).)
- Maintenance & community, incident.io API +28: Cronitor MCP server 55 (Registry entry io.cronitor/cronitor updated 3 November 2026 (30). No dated changelog found to count (0). Support page and docs; no public changelog (10 of 15). Official registry entry under its own namespace, and official SDKs (15). No package to read (0). 30 + 0 + 10 + 15 + 0 = 55. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.); incident.io API 83 (The API changelog's newest entry is 30 October 2026 (30). 53 dated entries between 3 August and 30 October 2026 (20). A public changelog, support by email and a Slack community, with reply times not checked (10). Seven official SDKs generated from the description file, TypeScript 2.40.0 and Python 2.39.0 both tagged 31 October 2026, and both READMEs say a schema check stops any break from shipping as a minor version (15). The SDK and CLI repositories have test workflows, and the two SDKs read were first tagged in September 2026 and reached a second major version within two weeks (8).)
- Schema & documentation, incident.io API +8: Cronitor MCP server 80 (Every tool's input schema declares additionalProperties false, and the docs call tools/list the field-level reference (25). llms.txt and .md pages for agents (10). Detailed tool guidance, including which to start with and what not to request (18 of 20). Typed inputs with enums, required combinations and no untyped data objects (15). A table of JSON-RPC error codes with their data fields, and worked calls (12 of 15). No public changelog found (404) (0). 25 + 10 + 18 + 15 + 12 + 0 = 80.); incident.io API 88 (OpenAPI 3.0.3 description, public at api.incident.io/v1/openapiV3.json per the docs and read from docs.incident.io/openapi/latest.json, 284 operations and 777 schemas (25). llms.txt and a Markdown twin of every docs page (10). Every operation has a description, but the median is 65 characters and few say when not to use a call. List incidents is the exception, with worked filter examples (12). 262 enums, required fields marked and two free-form objects in the whole file (13). 4,014 example values and thirteen error statuses on every operation, though the shared error example pairs an unrelated code and message (13). Versions sit in the path per resource and the changelog is generated from the description file (15).)
- Security & auth, incident.io API +6: Cronitor MCP server 58 (OAuth bounded by role with no scope choice, or scoped API keys (22 of 30). Read-only users get only read tools; write tools follow the role (14 of 20). The docs warn that event messages, command output and request bodies can hold customer data or secrets, and tell the agent to ask before expanding them; secrets are redacted (12 of 15). No audit log of MCP calls found (0). The security page covers encryption and relies on AWS's certifications; no security.txt (404) and no disclosure policy found (10 of 20). 22 + 14 + 12 + 0 + 10 = 58.); incident.io API 64 (Organisation keys carry chosen permissions, 13 of 36 scopable to teams, can be rotated and are shown once. User keys take the owner's role and die with the account. 30 for that, less the checklist's 10 because alert event and heartbeat endpoints accept the alert source token in a `token` query parameter. The API key itself travels only in the header (20). A `viewer` permission gives read-only keys and the MCP status page tool only drafts, but no confirmation step guards destructive API calls (15). Alert payloads and incident text are untrusted content. The docs cover redaction of sensitive data, and no injection guidance for API consumers was found (4). Audit logs are Enterprise only, kept one year, exported or streamed, and API actions are attributed to the key (10). security.txt valid to July 2027, a disclosure policy with a five-working-day reply, SOC 2 Type I and II claimed, yearly penetration tests, no paid bounty (15).)