Connect AI assistants to IncidentVault

Full MCP developer documentation, security reference and tool schemas

Requires an existing IncidentVault account, an eligible tenant administrator or permitted custom role, enabled MCP and API access.

Operational MCP URL: https://app.incidentvault.com/api/mcp/apps/server. Use the provider-specific URL below for native enhancements. OAuth uses PKCE S256, client metadata documents or dynamic registration. Verify the callback origin and select only needed permissions; client names are self-declared.

Interactive operational workspace

Supported MCP Apps hosts, including ChatGPT and Claude, render a functional dashboard with filters, paging, record review, follow-up creation, task edits, operational incident intake and manual action checks. Other hosts receive structured facts and citation links as text; Gemini widget support is not assumed. Counts describe loaded pages, not the whole tenant.

Permissions and approval

Write scopes are opt-in. Current role, location, tenant and record restrictions are checked on every call. App actions reuse create_tasks, update_tasks, create_incidents and update_incidents policies. Pending/approved are not executed success. Keep the same idempotency key for identical retries and inspect uncertain outcomes before starting another action. Provider confirmations still apply. Revoke connections in MCP → Providers.

Data-use boundary and privacy supplement

The operational endpoint returns only opaque record IDs, allowlisted status/priority, dates, location IDs and audit percentages. Names, narratives, medical details, custom fields, attachments, arbitrary fields, financial transfers and administrative/security tools are excluded. Source links open the protected IncidentVault app for sensitive details. Follow your organization's data-sharing policy when connecting an AI account.

The separate private endpoint https://app.incidentvault.com/api/mcp/server retains the full authorized catalog and can expose sensitive records. Grant only needed permissions and review your connection's data-sharing controls.

IncidentVault stores connection identity, scopes, hashed tokens, encrypted consent/action details and audit history. Access tokens last at most one hour, rotating refresh tokens 30 days and grants 90 days. Maintenance removes expired protocol artifacts; connection/audit retention follows our policy. Revocation prevents future access but cannot retract data already shared. Review the provider's retention and privacy terms.

Privacy policy and contact · Terms

ChatGPT / Codex

Endpoint: https://app.incidentvault.com/api/mcp/apps/chatgpt

  1. Ask your tenant administrator to enable MCP and API access.
  2. Add https://app.incidentvault.com/api/mcp/apps/chatgpt as a remote MCP connection in your AI client's supported connector settings.
  3. Sign in to IncidentVault, verify the callback destination, and select only the permissions you need.
  4. Write access and sensitive operations remain subject to your tenant's permissions and approval rules.
  5. Supported MCP Apps hosts can display the shared operational dashboard; other hosts receive text and source links.

Claude

Endpoint: https://app.incidentvault.com/api/mcp/apps/claude

  1. Ask your tenant administrator to enable MCP and API access.
  2. Add https://app.incidentvault.com/api/mcp/apps/claude as a remote MCP connection in your AI client's supported connector settings.
  3. Sign in to IncidentVault, verify the callback destination, and select only the permissions you need.
  4. Write access and sensitive operations remain subject to your tenant's permissions and approval rules.
  5. Supported MCP Apps hosts can display the shared operational dashboard; other hosts receive text and source links.

Gemini

Endpoint: https://app.incidentvault.com/api/mcp/apps/gemini

  1. Ask your tenant administrator to enable MCP and API access.
  2. Add https://app.incidentvault.com/api/mcp/apps/gemini as a remote MCP connection in your AI client's supported connector settings.
  3. Sign in to IncidentVault, verify the callback destination, and select only the permissions you need.
  4. Write access and sensitive operations remain subject to your tenant's permissions and approval rules.
  5. Supported MCP Apps hosts can display the shared operational dashboard; other hosts receive text and source links.

Microsoft 365 Copilot

Endpoint: https://app.incidentvault.com/api/mcp/apps/server

  1. Ask your tenant administrator to enable MCP and API access.
  2. Add https://app.incidentvault.com/api/mcp/apps/server as a remote MCP connection in your AI client's supported connector settings.
  3. Sign in to IncidentVault, verify the callback destination, and select only the permissions you need.
  4. Write access and sensitive operations remain subject to your tenant's permissions and approval rules.
  5. Supported MCP Apps hosts can display the shared operational dashboard; other hosts receive text and source links.

GitHub Copilot

Endpoint: https://app.incidentvault.com/api/mcp/apps/copilot

  1. Ask your tenant administrator to enable MCP and API access.
  2. Create a dedicated API key with the required scopes and an eligible active owner.
  3. Configure the remote HTTP server URL in your GitHub Copilot MCP settings. Store the key only in the supported secret store.
  4. Start with read-only scopes. Enable writes deliberately subject to your organization's permissions and approval rules.