# Investigate incidents with Annie

Delegate an investigation to Annie and retrieve its analysis and next steps.

Source: https://anyshift.io/for-agents/product/remote-agents

## Investigate alerts automatically

- PagerDuty webhooks can start an RCA according to the project’s automation rules. Configure a Slack destination to receive findings.

[PagerDuty to Slack setup](https://anyshift.io/for-agents/use-cases/investigate-deployment-alert)

## Connect Annie Remote MCP

- Delegate an investigation to Annie and retrieve its analysis and next steps.

- Endpoint: https://api.anyshift.io/mcp/remote

- Reuse an existing connection. For a new connection in Codex, run these commands, sign in through browser OAuth, then confirm the intended project with list_projects.

```text
codex mcp add annie --url https://api.anyshift.io/mcp/remote
codex mcp login annie
```

[Connect Annie](https://docs.anyshift.io/pages/product/integration/remote_mcp)

## Other MCP clients

- Your client must support Streamable HTTP and browser OAuth. Add this remote server, sign in to Anyshift and select the intended project. The configuration format varies by client; reuse an existing plugin or server connection.

```text
{
  "mcpServers": {
    "annie": {
      "type": "http",
      "url": "https://api.anyshift.io/mcp/remote"
    }
  }
}
```

## Before starting

- Provide the alert, service and time window. Reuse the project’s infrastructure and observability connections. PagerDuty is needed for its automatic trigger; Slack is needed only if you choose Slack delivery.

[Integration catalog](https://anyshift.io/for-agents/integrations)

## Ask Annie to investigate

- Annie returns findings and evidence, or explains what could not be established. A started investigation is not a completed result.

```text
In the selected Anyshift project, investigate this alert in read-only mode: [paste the alert, affected service and time window]. Use ask_annie with mode=rca, then get_annie_response until the investigation completes or reports a failure. Return the findings, supporting evidence and unresolved questions. Do not change infrastructure or publish messages.
```

## Read the result

- Annie can only assess data available in the selected project and incident window. Missing permissions, unavailable telemetry or gaps in history must remain explicit. Nearby deployment and alert timestamps alone do not prove a root cause.

- Poll the existing investigation with get_annie_response. Do not start another investigation just because the first call has not returned a final answer.

[Investigate a deployment alert](https://anyshift.io/for-agents/use-cases/investigate-deployment-alert)

## Compass Digital ruled out an unrelated change

- In Anyshift’s published Compass Digital case, a sign-in issue followed a CI/CD identity change. Annie traced the sign-in dependency path to shared SSO and ruled out the unrelated change. Incident-time telemetry located the interruption; the SSO owner confirmed an outage during an upgrade.

- The decision was to avoid an unrelated rollback. This is a customer case published by Anyshift, not a controlled performance comparison. A nearby change alone did not establish the cause.

[Read the Compass Digital case (Markdown)](https://anyshift.io/markdown/blog/compass-digital-login-outage.md)

## Usage

- An investigation run by Anyshift uses the agent run allowance. Use Graph MCP if your own agent only needs to retrieve evidence.

[Pricing](https://anyshift.io/for-agents/pricing)