Integration

Sysdig integration

Sysdig cloud monitoring and security API: read and manage Monitor alerts, browse and ingest the event feed, list dashboards and connected agents, and read the platform's teams, users and notification channels. Sysdig hostnames differ per region and Monitor and Secure can be separate hosts, so the host is part of the credential and the token is issued per product. Requests authenticate with a bearer token, either a user API token or a service account token.

Connect Sysdig How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Sysdig.Built from the 16 Sysdig tools below, on the connection you add once.

Common Sysdig use cases

auditing who has access to the Sysdig account
raising an alert threshold after a noisy period
pulling recent alert events into an incident timeline
confirming which address or webhook a channel delivers to
reading an alert definition before changing its threshold
working out which team a service account should belong to
cleaning up alerts for a service that has been decommissioned
checking where an alert actually delivers before relying on it
checking which scope a team is limited to before adding a user
checking which teams a user belongs to during an access review

What you can do with Sysdig

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Alert, 5 operations

create_alertCreate alertPOSTCreates a Sysdig Monitor alert from a definition object.
delete_alertDelete alertDELETERemoves a Sysdig Monitor alert definition.
get_alertGet alertGETReturns a single Sysdig Monitor alert definition.
list_alertsList alertsGETReturns every Sysdig Monitor alert configured on the account.
update_alertUpdate alertPUTReplaces a Sysdig Monitor alert with a new definition, using optimistic locking.

User, 3 operations

get_current_userGet current userGETReturns the Sysdig user or service account behind the token, which is how you confirm the credential works.
get_userGet userGETReturns a single Sysdig user by identifier.
list_usersList usersGETReturns the Sysdig users on the account.

Event, 2 operations

get_eventGet eventGETReturns a single Sysdig event by identifier.
list_eventsList eventsGETReturns Sysdig events for a time window, filtered by category, alert state or free text.

Notification channel, 2 operations

get_notification_channelGet notification channelGETReturns a single Sysdig notification channel with its delivery settings.
list_notification_channelsList notification channelsGETReturns the Sysdig notification channels that alerts deliver through.

Team, 2 operations

get_teamGet teamGETReturns a single Sysdig team with its configuration.
list_teamsList teamsGETReturns the Sysdig teams on the account.

Agent, 1 operation

list_connected_agentsList connected agentsGETReturns the Sysdig agents currently reporting in, with a total count.

Dashboard, 1 operation

list_dashboardsList dashboardsGETReturns the Sysdig dashboards visible to the token, optionally without their panel definitions.

Use Sysdig from Claude Code, Cursor or Codex

Connect Sysdig in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Sysdig operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Sysdig

Create your workspace
Sign up free. Nothing to install.
Connect Sysdig once
Add your Sysdig connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Sysdig integration FAQ

What can you do with the Sysdig integration?

LiveContext exposes 16 operations on Sysdig, covering alert, user, event and notification channel. Common uses include auditing who has access to the Sysdig account, raising an alert threshold after a noisy period and pulling recent alert events into an incident timeline.