automated-triage

Monte Carlo Automated Triage

This skill helps you design, test, and deploy an automated triage agent for Monte Carlo alerts. Rather than a fixed workflow, it gives you the building blocks — a set of MCP tools, a description of each triage stage, and a working example — so you can build a process that matches how your team actually responds to alerts.

Monte Carlo tool routing (required): Always call Monte Carlo MCP tools through this plugin's bundled server, whose fully-qualified tool names are mcp__plugin_mc-agent-toolkit_monte-carlo-mcp__<tool> (e.g. mcp__plugin_mc-agent-toolkit_monte-carlo-mcp__get_alerts). Bare tool names used in this skill (get_alerts, search, get_table, …) refer to that bundled server. If the session also has a separately-configured monte-carlo-mcp server, do not route to it — it may point at a different endpoint or credentials.

Read the reference files before proceeding:

• Triage stages and customisation: references/triage-stages.md (relative to this file)
• Working example workflow: references/triage-example.md (relative to this file)

---

When to activate this skill

Activate when the user:

• Wants to triage or investigate recent Monte Carlo alerts (interactively or automated)
• Wants to set up automated triage for Monte Carlo alerts
• Asks to run agentic triage or investigate recent alert activity
• Wants to understand what triage tools are available and how to use them
• Is building or refining a triage prompt for their environment
• Wants to move from manual alert review to automated or semi-automated triage

When NOT to activate this skill

Do not activate when the user is:

• Investigating a specific known incident (help them directly)
• Creating or configuring monitors (use the monitoring-advisor skill)
• Running impact analysis before a code change (use the prevent skill)

---

Available MCP tools

All tools are available via the monte-carlo-mcp MCP server.

Tool	Toolset	Purpose
get_alerts	default	Fetch recent alerts for a time window
alert_assessment	default	Read-only scoring — scores an alert by incident likelihood and potential impact (HIGH/MEDIUM/LOW each) and returns the verdict without recording anything. Steerable via user_instructions; safe to run in parallel across many alerts
triage_alert	default	Persisted triage — scores an alert and writes the verdict back onto it, exactly like the in-app Triage button (marks the alert triaged, posts a completion notification, records ML feedback). Blocks until done; reuses an existing triage if the alert was already triaged
run_troubleshooting_agent	default	Run the Monte Carlo Troubleshooting Agent on a single alert; async by default — returns immediately, reuses existing results when available
get_troubleshooting_agent_results	default	Poll an async troubleshooting run by incident_id; returns status (not_found/running/success/failed) and results when complete
update_alert	default	Update an alert's status and/or declare an incident by setting severity
set_alert_owner	default	Assign an owner to an alert by email
create_or_update_alert_comment	default	Post or update a triage comment on an alert
mark_event_as_normal	default	Mark all anomaly events in an alert as normal, triggering ML threshold recalibration to prevent re-alerting on the same pattern