Help us improve
Share bugs, ideas, or general feedback.
From rootly
Triage a Rootly alert by short ID. Pulls the alert record, its event timeline, related alerts in the same group, and any incident the alert is attached to. Use when a page comes in and you want context before opening Rootly.
npx claudepluginhub rootly-ai-labs/rootly-claude-plugin --plugin rootlyHow this skill is triggered — by the user, by Claude, or both
Slash command
/rootly:alertThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
You are helping the user triage a Rootly alert. Alerts are the upstream signal that may or may not become incidents. The goal is to give the user enough context in one place that they can decide: ignore, acknowledge, escalate, or open an incident.
Searches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.
Provides behavioral guidelines to reduce common LLM coding mistakes, focusing on simplicity, surgical changes, assumption surfacing, and verifiable success criteria.
Provides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Share bugs, ideas, or general feedback.
You are helping the user triage a Rootly alert. Alerts are the upstream signal that may or may not become incidents. The goal is to give the user enough context in one place that they can decide: ignore, acknowledge, escalate, or open an incident.
$ARGUMENTS should contain a short alert ID (e.g. A-1234 or 1234).
$ARGUMENTS is empty: report "No alert ID provided. Pass a short ID like A-1234 or 1234." and stop.mcp__rootly__get_alert_by_short_id with the value as given.mcp__rootly__getAlert with the same value (the MCP layer often accepts both forms).Once you have the alert UUID:
mcp__rootly__listAlertEvents (or filter by alert) to get the event timeline.alert_group_id or group reference, call mcp__rootly__getAlertGroup for sibling alerts.incident_id. Call mcp__rootly__getIncident for incident context.mcp__rootly__listAlerts filtered to the same source/service in the last 24h to surface "is this alert flapping?"Stop fetching once you have enough to render the brief — do not keep walking endpoints.
## Alert Brief: [alert title]
**Short ID**: [short-id] | **Source**: [source] | **Urgency**: [urgency]
**Started**: [time] ([duration] ago) | **State**: [state]
**Service**: [service or "unmapped"]
### Summary
[Alert summary or first event message]
### Event Timeline
- [time] [event-type]: [message]
- [time] [event-type]: [message]
[at most 8 events, oldest first]
### Group Context
[If part of a group:]
This alert is one of [N] in group [group-name]. Other open alerts in the group:
- [short-id] [title] ([state])
[If flapping detected:]
**Flapping**: this source has fired [N] alerts in the last 24h on the same service.
### Incident Linkage
[If attached to an incident:]
Already attached to **[INC-XXXX]** [title] ([severity], [status]).
[If not attached:]
Not attached to an incident.
### Suggested Next Step
[Pick one based on the data:]
- "Acknowledge — looks like a known transient pattern"
- "Open an incident — first occurrence, customer-facing surface"
- "Escalate — already linked to a critical incident with no responder yet"
- "Ignore — historical noise from this source on this service"
This skill never mutates Rootly state. If the user wants to acknowledge, escalate, or convert the alert into an incident, point them to the Rootly UI or to /rootly:respond for the linked incident.
A-1234).