EMS MCP Server Introduction The EMS MCP Server exposes the capabilities of the Event Management System (EMS) to any MCP-compatible AI host. Through this server, AI assistants can query active alerts, inspect event details, correlate incidents to devices or customers, and retrieve mapping rule information — all using natural language.
EMS (Event Management System) is the central monitoring platform for WxCDI/CCE infrastructure. It supports multiple ingress methods (API, SNMP, Email) and integrates with ServiceNow for ticket management.
What You Can Do with EMS MCP Capability Example Prompt List active alerts "Show me all critical alerts in the last hour" Get alert details "What triggered alert fingerprint abc123?" Inspect alert history & activity "Show the history and audit timeline for alert abc123" Acknowledge & Self-assign alerts "Ack and assign alert abc123 to me" Unassign alerts "Unassign alert abc123" Resolve alerts "Resolve alerts with fingerprints fp1, fp2" Enrich alerts with custom fields "Mark alerts matching severity == 'low' as change related" Read AI analysis reports "Show the AI report for alert abc123" Get mapping rules "What mapping rule handles CUCM SNMP traps?" Get extraction rules "Show me all extraction rules" Get deduplication rules "List all deduplication rules" Manage drop rules "Create a drop rule for low severity prometheus alerts" Manage maintenance windows "Put alerts from site-a into a 4 hour maintenance window" Browse runbooks "Show all runbooks and their scores" Discover & execute workflows "List workflows, then run wf1 on group alert ga1" Create correlation rules "Create a correlation rule for CUCM alerts grouped by device" Submit AI feedback "Submit positive feedback for analysis report exec123"
Installation EMS MCP Install Guide
Once installed, the following tools are exposed to the AI host:
Tool name Description query_alertsQuery alerts from EMS using CEL filter expression, status, and limit query_alerts_fingerprintQuery alert fingerprints from EMS using CEL filter, status, and limit query_activity_logsGet the audit timeline for a specific alert (by fingerprint) or group alert (by UUID) get_alert_historyGet the history of an alert via alert fingerprint, with optional instance enrichment ack_assign_alertAcknowledge and assign an alert to yourself via alert fingerprint unassign_alertUnassign (clear the assignee of) an alert via alert fingerprint assign_alertBatch assign alerts to a specific user via alert fingerprints update_alert_statusUpdate alert status (firing, resolved, acknowledged, suppressed, pending) via fingerprints batch_enrich_alert_ticketBatch enrich alerts with ticket number and URL via alert fingerprints enrich_alertsAdd or update arbitrary enrichment key-value pairs on alerts selected by fingerprints or CEL execute_alert_workflowExecute a workflow on an alert via alert fingerprint and workflow ID or name
Tool name Description list_workflowsList all available workflows in EMS to discover workflow IDs and display names
Tool name Description list_group_alertsList group alerts with optional CEL filtering, sorting, limit, and offset get_group_alertGet details of a specific group alert by its UUID get_group_alert_alertsGet the list of sub-alerts associated with a group alert get_group_alert_auditGet audit log (activity history) for a specific group alert create_group_alertCreate a new group alert with name, description, severity, status, and assignee add_alerts_to_group_alertMove alerts into an existing group alert by fingerprints (removes them from their current group) assign_group_alertsAssign or unassign one or more group alerts to a user change_group_alert_statusBatch-change the status of one or more group alerts, optionally updating sub-alerts enrich_group_alertsAdd or update enrichment key-value pairs on one or more group alerts execute_group_alert_workflowExecute a workflow on a group alert via group alert ID and workflow ID
Tool name Description get_rulesGet all correlation rules from EMS create_correlation_ruleCreate a new correlation rule with CEL query, SQL query, grouping criteria, and name template
Tool name Description get_all_mappingGet all mapping rules in EMS get_mapping_ruleGet mapping rule details by rule ID get_mapping_rule_executionsGet execution history of a mapping rule by rule ID get_mapping_rule_execution_detailsGet details of a specific execution of a mapping rule get_mapping_rule_versionsGet all versions of a mapping rule by rule ID get_mapping_rule_version_detailsGet details of a specific revision of a mapping rule
Tool name Description get_all_extractionsGet all extraction rules in EMS get_extraction_ruleGet extraction rule details (latest version) by rule ID get_extraction_rule_executionsGet execution history of an extraction rule by rule ID get_extraction_rule_execution_detailsGet details of a specific execution of an extraction rule get_extraction_rule_version_detailsGet details of a specific revision of an extraction rule
Tool name Description get_all_deduplicationsGet all deduplication rules in EMS
Tool name Description list_drop_rulesList all drop rules in EMS get_drop_ruleGet a specific drop rule by its ID create_drop_ruleCreate a drop rule with name, provider type, CEL condition, and optional drop interval enable_drop_ruleEnable a drop rule by its ID disable_drop_ruleDisable a drop rule by its ID
Maintenance Rule Tools Tool name Description list_maintenance_rulesList all maintenance window rules in EMS create_maintenance_ruleCreate a maintenance window that marks or suppresses alerts matching a CEL query update_maintenance_ruleUpdate an existing maintenance window rule (replaces all fields) delete_maintenance_ruleDelete a maintenance window rule by its ID
Tool name Description get_all_runbooksGet all runbooks in EMS get_runbook_scoreGet runbook score details by runbook ID
Tool name Description get_alert_ai_reportGet the AI-generated analysis report for an alert by its fingerprint submit_analysis_feedbackSubmit feedback (good/bad with comments) for an AI analysis report by execution ID
Authorization EMS use Personal Access Tokens (PAT) for authentication. To generate a PAT, follow the guide here: EMS MCP Guide
Troubleshooting 401 Unauthorized
Connection refusedEMS_API_URL is reachable from your machine. Check VPN or firewall rules.
No tools available in VS Codemcp.json has no JSON syntax errors.