The AI assistants (MCP) integration lets the members of your organization connect an AI assistant to Astry. It relies on MCP (Model Context Protocol), an open protocol connecting AI assistants to external services. Supported assistants are currently Claude (claude.ai, desktop and mobile apps) and Claude Code.
Note: This integration is a beta feature. It must first be enabled for your organization by the Astry team (contact us); it then shows up in Organization > Subscription.
Activation
The integration is configured from the main Organization tab, then Incoming integrations and AI assistants (MCP). It must be enabled by an Owner. The integration page then gives the MCP server URL and the connection steps.
Disabling the integration cuts every member connection in less than five minutes.
Connecting an assistant
Each member connects their own assistant:
- Claude: Settings > Connectors, add a custom connector with the URL
https://mcp.astry.fr/mcp, then click Connect. - Claude Code: run
claude mcp add --transport http astry https://mcp.astry.fr/mcp, then type/mcpin Claude Code.
The assistant opens an Astry page where the member signs in (password or company SSO) and then explicitly allows the connection. A connection lasts 30 days at most; it can be cut at any time from the assistant.
Other web applications (Open WebUI...)
Other MCP-compatible applications can connect to Astry, for example an Open WebUI instance hosted by your organization. Applications installed on the member's computer (such as Claude Code) are always accepted. A web application, however, is only accepted if its domain is allowed:
claude.aiandclaude.comare allowed for every organization;- other domains are added by an Owner, in the Allowed web applications section of the integration page (20 domains at most, no IP address or port).
For Open WebUI, add the domain of your instance (for example chat.example.com), then in Open WebUI: Admin Panel > Settings > External Tools, add a server of type MCP (Streamable HTTP) with the URL https://mcp.astry.fr/mcp and OAuth 2.1 authentication. Each member then signs in with their own Astry account.
Removing a domain cuts the connections of the applications hosted on it in less than five minutes. Only allow applications your organization operates or trusts.
What the assistant can do
The assistant acts on behalf of the signed-in member, with their role and permissions:
| Tool | Description | Condition |
|---|---|---|
| List and read incidents | Status, priority, team, assignment, timeline, latest alerts, comments | "view incidents" permission |
| List and read crises | Status message, template fields, actions and their progress, timeline, comments | "view incidents" permission |
| See who is on call | On-call person and rotation per team; crisis on-call when the feature is enabled | "view teams" permission |
| Comment on an incident | Adds a plain-text comment, after the member's approval in the assistant | roles other than Stakeholder and External |
Data and security
- On-call phone numbers, crisis contact emails and notification targets are never shared with the assistant.
- The assistant never receives the member's password nor their Astry session tokens: it has its own access token, valid for one hour.
- Alert and comment contents are flagged to the assistant as data, not as instructions to follow.
- A member removed from the organization, or whose organization disables the integration, loses access in less than five minutes.
- Requests are limited to 120 per minute and per connection.
Traceability
Connections, disconnections and comments posted through an assistant show up in the Timeline (Integrations & AI filter) and, for Owners, in the recent activity of the integration page. Integrations being enabled or disabled, and changes to the allowed web applications, are recorded there as well.