Skip to main content

Overview

IncidentFox provides 50+ built-in tools across multiple categories. These tools enable agents to interact with your infrastructure and observability stack.

Tool Categories

CategoryToolsDescription
Kubernetes9Pod logs, deployments, events, resource usage
AWS8EC2, Lambda, RDS, ECS, CloudWatch
Observability15+Grafana, Datadog, Coralogix, New Relic
GitHub16Code search, PRs, issues, Actions
Custom MCPUnlimitedAdd your own tools via MCP

Tool Distribution by Agent

AgentToolsPurpose
PlannerNonePlanning only, delegates to others
K8s Agent9Kubernetes troubleshooting
AWS Agent8AWS resource debugging
Metrics Agent22Anomaly detection, correlation
Coding Agent15Code analysis, CI/CD
Investigation Agent30+All tools (dynamic)

How Tools Work

Tool Loading

Tools are loaded dynamically based on:
  1. Integration Installed - Is the package available?
  2. Credentials Configured - Are API keys set?
  3. Team Settings - Is the tool enabled?
Example log output:
slack_tools_loaded: count=4
github_tools_loaded: count=16
kubernetes_tools_loaded: count=9
aws_tools_loaded: count=8

Configuring Tools

Enable/Disable

{
  "tools": {
    "kubernetes": {
      "enabled": true
    },
    "docker_exec": {
      "enabled": false
    }
  }
}

Per-Agent Configuration

{
  "agents": {
    "investigation_agent": {
      "disable_default_tools": ["shell", "docker_exec"],
      "enable_extra_tools": ["custom_runbook_search"]
    }
  }
}

Tool Metrics

All tools track:
  • tool_calls_total{tool_name, status} - Call count
  • tool_duration_seconds{tool_name} - Execution time
View in Prometheus or the Web UI under Agent Runs.

Common Tools

Most Used for Investigations

ToolCategoryDescription
get_pod_logsKubernetesFetch container logs
get_cloudwatch_logsAWSQuery CloudWatch logs
search_coralogix_logsObservabilitySearch Coralogix
query_prometheusObservabilityQuery Grafana/Prometheus
search_github_codeGitHubSearch across repos

Most Used for CI/CD

ToolCategoryDescription
get_github_actions_logsGitHubCI build logs
describe_codepipelineAWSPipeline status
read_github_fileGitHubRead code files
git_diffGitShow changes

Next Steps