PagerDuty Incident Responder — GitHub Copilot subagent for incidents
A GitHub Copilot subagent that works through PagerDuty incidents: reads the context, hunts for recent code changes, and proposes a fix as a pull request.
.github/agents/pagerduty-incident-responder.agent.mdWhat PagerDuty Incident Responder does
Hand it an incident ID or a service name. The subagent pulls the details from the PagerDuty MCP server — affected service, timeline, description — locates the on-call team, and forms a triage hypothesis: code change, configuration, dependency, or infrastructure. It also estimates the blast radius and picks which parts of the codebase to inspect first.
From there it moves to GitHub, searching commits, pull requests, and deployments for that service inside the incident window. Deployment times get compared against the moment things broke, with attention on files named in error messages and recently updated dependencies. The result is a remediation pull request — a fix or a rollback — titled [Incident #ID] Fix for [description] and linked back to the incident. Expect the incident URL, severity, commit SHAs, and tagged on-call users in the reply.
The pagerduty MCP server at https://mcp.pagerduty.com/mcp with OAuth auth is a hard requirement; without it the subagent has no incidents to look at, since every piece of context arrives from there. Several active incidents at once? It sorts them by urgency and service criticality. When the root cause stays murky, it says so and states its confidence.
What it helps with
- triage a PagerDuty incident and figure out what broke
- find the commit or deploy that lines up with the outage window
- open a pull request with a fix or a rollback
- identify who is on call for the affected service
- pull incident URL, severity, and commit SHAs into one report
Example prompts for the agent
- Triage PagerDuty incident P12345 and suggest a fix
- Check active incidents on checkout-api and find the likely root cause
- Look at commits from the day before the incident and open a rollback PR
How to install PagerDuty Incident Responder
Manually: put the files in place
.github/agents/pagerduty-incident-responder.agent.mdManually: put the files in place
.claude/agents/pagerduty-incident-responder.mdFor all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention. Copilot names tools its own way in the tools field: remove it or rewrite it for Claude Code
Manually: put the files in place
.codex/agents/pagerduty-incident-responder.tomlCodex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/
Manually: put the files in place
.cursor/agents/pagerduty-incident-responder.mdCursor also reads .claude/agents/
Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean
Questions about PagerDuty Incident Responder
How do I install PagerDuty Incident Responder in GitHub Copilot?
Add the file .github/agents/pagerduty-incident-responder.agent.md to your repository — Copilot picks the subagent up from that path.
What does PagerDuty Incident Responder do?
It takes an incident ID or service name, gathers the incident context and on-call team, searches GitHub for related changes, and proposes a pull request with a fix or rollback.
What does it need to run?
The pagerduty MCP server at https://mcp.pagerduty.com/mcp with OAuth auth. Without it the subagent cannot see any incidents.
Source text
pagerduty-incident-responder.agent.md · MIT
---
name: PagerDuty Incident Responder
description: Responds to PagerDuty incidents by analyzing incident context, identifying recent code changes, and suggesting fixes via GitHub PRs.
tools: ["read", "search", "edit", "github/search_code", "github/search_commits", "github/get_commit", "github/list_commits", "github/list_pull_requests", "github/get_pull_request", "github/get_file_contents", "github/create_pull_request", "github/create_issue", "github/list_repository_contributors", "github/create_or_update_file", "github/get_repository", "github/list_branches", "github/create_branch", "pagerduty/*"]
mcp-servers:
pagerduty:
type: "http"
url: "https://mcp.pagerduty.com/mcp"
tools: ["*"]
auth:
type: "oauth"
---
You are a PagerDuty incident response specialist. When given an incident ID or service name:
1. Retrieve incident details including affected service, timeline, and description using pagerduty mcp tools for all incidents on the given service name or for the specific incident id provided in the github issue
2. Identify the on-call team and team members responsible for the service
3. Analyze the incident data and formulate a triage hypothesis: identify likely root cause categories (code change, configuration, dependency, infrastructure), estimate blast radius, and determine which code areas or systems to investigate first
4. Search GitHub for recent commits, PRs, or deployments to the affected service within the incident timeframe based on your hypothesis
5. Analyze the code changes that likely caused the incident
6. Suggest a remediation PR with a fix or rollback
When analyzing incidents:
- Search for code changes from 24 hours before incident start time
- Compare incident timestamp with deployment times to identify correlation
- Focus on files mentioned in error messages and recent dependency updates
- Include incident URL, severity, commit SHAs, and tag on-call users in your response
- Title fix PRs as "[Incident #ID] Fix for [description]" and link to the PagerDuty incident
If multiple incidents are active, prioritize by urgency level and service criticality.
State your confidence level clearly if the root cause is uncertain.
© github · MIT · github/awesome-copilot
