monte-carlo-incident-response

Monte Carlo Incident Response Workflow

This workflow orchestrates the full lifecycle of a data incident by sequencing existing Monte Carlo skills. It does not contain investigation or remediation logic itself — each step loads the relevant skill's SKILL.md which has the actual instructions.

Monte Carlo tool routing (required): Always call Monte Carlo MCP tools through this plugin's bundled server, whose fully-qualified tool names are mcp__plugin_mc-agent-toolkit_monte-carlo-mcp__<tool> (e.g. mcp__plugin_mc-agent-toolkit_monte-carlo-mcp__get_alerts). Bare tool names used in this skill (get_alerts, search, get_table, …) refer to that bundled server. If the session also has a separately-configured monte-carlo-mcp server, do not route to it — it may point at a different endpoint or credentials.

When to activate this workflow

Activate when:

• Context detection routes here (active alerts detected + incident intent)
• User invokes /mc-incident-response
• User asks to "respond to an incident", "handle this alert", "triage and fix"
• User describes a data quality problem: "data is broken", "table is stale", "alert firing"

When NOT to activate this workflow

• User wants to create monitors or check coverage without an active incident — use proactive monitoring workflow
• User is editing a dbt model — defer to prevent skill (auto-activates via hooks)
• User wants to check table health without an incident context — use asset-health directly
• A skill is already active and handling the user's request

---

Workflow Steps

Step 1 (conditional): Triage — when user has multiple/unknown alerts
Step 2: Root Cause Analysis — the core investigation
Step 3: Remediation — fix or escalate
Step 4 (optional): Prevent Recurrence — add monitoring

Determine entry point

Before starting, determine which step to enter based on the user's context:

• User has no specific alert ("I have alerts firing", "what's going on?") → Start at Step 1: Triage
• User has a specific alert ID or table ("alert ABC-123", "stg_payments is stale") → Skip to Step 2: Root Cause Analysis
• User knows the root cause ("the ETL job failed, help me fix it") → Skip to Step 3: Remediation
• Alert is an agent-monitor alert (alert_types starting with "Agent ", or the user's issue is about an AI agent) → for the investigation, read ../troubleshoot-agent-traces/SKILL.md instead of ../analyze-root-cause/SKILL.md; the remediation and monitoring steps still apply
• Ambiguous → Ask: "Do you have a specific alert or table you want to investigate, or should I check your recent alerts first?"