Introduction
The Model Context Protocol (MCP) is an emerging standard for embedding semantic context into AI agents, a key enabler of a comprehensive, integrated Site Reliability Engineering (SRE) practice. Released by Anthropic in late 2024 and widely adopted across the observability and operations tooling ecosystem through 2025 and 2026, MCP has established itself as the common language between language models and the systems they need to operate.
In an environment where autonomous agents increasingly handle operational tasks, MCP equips those agents with factual, consistent, and enriched contextual information needed for effective knowledge retrieval, reliable decision-making, and autonomous collaboration across heterogeneous systems.
This article explores MCP from a strategic angle, highlighting its transformative role in SRE, before demonstrating its practical value through a real-world example of an MCP server focused on investigating incidents tied to external events.
The Model Context Protocol: principles and promise for agentic systems
What MCP actually is
The Model Context Protocol is an open standard that defines a common interface between a client (typically an LLM-driven agent) and servers exposing reusable "tools," resources, and prompts. Rather than hand-coding each integration between a model and a third-party system, MCP standardizes the discovery of available capabilities, their semantic description, and their invocation.
This standardized semantic layer solves a recurring problem in agent-based architectures: in complex operational environments, AI agents often work with limited, task-specific context, leading to ambiguous actions, misinterpretations, hallucinated outputs, and ultimately flawed decisions.
Why generic approaches fall short in enterprise environments
A large language model's generic knowledge, however capable, stops at what it saw during training: it doesn't know the exact topology of a production cluster, an organization's internal naming conventions, or its incident history. Retrieval-augmented generation (RAG) closes part of that gap by injecting relevant documents, but it remains a static read of knowledge, it doesn't let an agent act, query a system in real time, or trigger a verified action.
MCP shifts the register: rather than merely providing context text, it exposes executable capabilities, querying a metrics store, consulting an incident repository, posting a message, with a semantic description the model can interpret to pick the right tool and parameters. By systematically managing and sharing this context, MCP improves the consistency, accuracy, and efficiency of agent-based workflows, reducing operational cost and improving decision-making across the system.
Reliability: a natural adoption ground for MCP
The cognitive load of SRE and the cost of lost context
In modern SRE practices, context is the cornerstone of effective incident management, from triage and acknowledgment through troubleshooting, resolution, and post-incident analysis. SRE is inherently a high cognitive load task for IT operations teams: context is constantly changing, acquiring and updating operational knowledge is a permanent effort, and every minute spent reconstructing history stretches the time to resolution.
The limits of RAG and generic knowledge in a specific environment
As observability and operations tooling vendors increasingly introduce AI agents into their ecosystems, they're finding that common approaches, generic LLM knowledge or RAG, aren't enough to solve the context problem when agents must operate in a specific enterprise environment, with its own tools, conventions, and proprietary systems. This is exactly where MCP becomes especially valuable: it lets a single agent connect, through one protocol, to Prometheus, Datadog, an ITSM system, a Git repository, or an internal knowledge base, without a bespoke integration for each.
Anatomy of an MCP-driven SRE flow in seven steps
From the user request to tool discovery
Step 1, The application front end (for example, an incident investigation UI) captures a user request: an SRE engineer asks, "Investigate the high latency on the payment service over the last two hours."
Step 2, The MCP client interprets the user's intent. It uses an LLM to determine which MCP server to call based on the type of investigation, traffic analysis, anomaly detection, log inspection.
Step 3, The MCP client retrieves the tools exposed by SRE MCP servers: query service logs (via cloud logging, Datadog), retrieve metric anomalies (via Prometheus, Chronosphere), post status updates to incident Slack channels, or search for similar prior incidents in an internal knowledge base.
Selection, human validation, and secure execution
Step 4, The LLM determines the specific tool and its parameters: "Query latency metrics for the checkout-service pod in prod-cluster-1 from 10 a.m. to noon."
Step 5, Human-in-the-loop approval: the user reviews and validates the action plan suggested by the LLM before any execution, an essential guardrail for any tool that can alter a production state.
Step 6, The MCP server securely executes the action: it wraps controlled access to the target system, retrieves latency metrics via the Prometheus API, summarizes the results, and returns them to the investigation UI or the Slack channel.
The LLM-enriched response
Step 7, The LLM augments the response: it enhances the raw execution results with context-aware insights and presents them in a format the on-call engineer can act on. By applying this flow, MCP clients and servers let AI agents consume internal and external knowledge, precisely identify and resolve incidents, proactively detect anomalies, and collaborate across systems without losing critical context, improving both the accuracy and the speed of reliability operations.
Should you invest in MCP? A strategic decision framework
Signals that justify investing now
As with any emerging technology trend, adopting MCP is a strategic decision for leadership teams. MCP acts as a context provider as a service: its value depends heavily on the AI agents consuming it. An organization should consider investing if AI agents already play a significant role in its reliability engineering and IT operations workflows, for example if it relies on cloud-native or SRE tooling agents such as Amazon Q, Google Cloud Assist, Dynatrace Davis, or Datadog Bits AI, where MCP integration can significantly improve effectiveness.
The signal is even stronger if operations frequently suffer from context loss, misinterpretations, or inefficiencies in AI-driven interactions, or if the organization is building internal agents that require structured, persistent domain knowledge. From a tooling producer's standpoint, investing in MCP is particularly strategic if observability toolchain vendors, Rootly, GitHub, or others, already offer ready-to-use MCP servers.
Signals that call for waiting
Conversely, investment in MCP deserves reconsideration if an organization's operational knowledge isn't yet semantically mapped, if the complexity of AI-driven systems remains low, or if current tooling vendors don't yet support the protocol. If immediate budget constraints outweigh long-term strategic benefits, deferring adoption can be a prudent choice, as long as it isn't pushed back indefinitely, given how fast the MCP ecosystem has been moving since 2025.
EventOrOutage case study: telling a real incident from an expected pattern
A real-world example: when traffic drops and no system is at fault
In SRE, incident response relies heavily on internal signals, metrics, logs, traces. But what happens when the "incident" isn't technical at all? A team once saw platform traffic drop during what appeared to be peak usage hours. After thorough troubleshooting, they discovered the drop coincided with a widely watched international sporting event. No system issue at all, just a piece of external context missing from internal telemetry.
How EventOrOutage leverages external context
Incident management platforms increasingly position themselves as key context providers, connecting diverse semantic signals to AI systems. Rootly's MCP server illustrates this: it leverages an LLM via MCP to interpret the semantic context behind traffic anomalies, integrates external sources such as Holiday API or Calendrific to enrich the context available to AI agents, and helps agents classify anomalies to distinguish a genuine incident from an expected behavior pattern.
The four-step flow in detail
EventOrOutage, built by Rootly AI Labs, lets an incident triage agent reference one or more external contexts to decide whether a traffic drop is a genuine incident or the result of an external event. Step 1: a user triggers a request via a Slack bot, "Validate this incident." Step 2: the LLM embedded in the MCP server parses the request, then calls external context providers to retrieve relevant signals. Step 3: the LLM enriches the MCP server's response with that context and formats it into a readable summary. Step 4: the Slack bot, driven by the MCP client, uses that summary to trigger downstream actions, for example automatically posting a comment on the relevant ITSM ticket: "This might be a related event, please investigate further."
Measured results, limits, and security vigilance
Benefits observed on alert fatigue and productivity
Early experiments with MCP in incident management report substantial benefits: reduced alert fatigue through more accurate identification of genuine incidents versus routine events, improved operational efficiency with faster response to real problems, and increased productivity through context-aware AI automation rather than blind alert triggering.
Security, governance, and the exposure surface of MCP servers
These benefits don't remove the need for solid governance: every exposed MCP server adds a potential attack surface, and growing agent autonomy calls for strict access controls, systematic logging of tool calls, and regular review of granted permissions. The human-in-the-loop approval at step 5 of the flow described above isn't a cosmetic detail, it's the main guardrail against a poorly calibrated agent action, especially when the invoked tool can alter a production state.
Conclusion: from trend to tooled SRE practice
Adopting MCP, particularly with practical implementations like EventOrOutage, significantly improves semantic context capabilities in AI-driven reliability engineering and incident management. Organizations leveraging MCP can expect improved operational efficiency, greater accuracy in incident management, and strategic resilience across operational landscapes increasingly driven by autonomous agents, provided they treat the protocol's security and governance with the same rigor as the rest of the IT estate.
Disclaimer: The statements and opinions expressed in this article are those of the author(s) and do not necessarily reflect the positions of Adservio.
STAY POSTED
Get our next analyses and field notes straight to your inbox.
