Incident Library MCP Server

Lists cases by category, newest first, one page at a time: `count` and `cases` (id, title, organisation, date, root cause, page url), plus `next_cursor` when more remain; call again with `cursor` for the following page. Use when the question names a category (a root cause, component, symptom, contributing factor, domain or organisation) rather than a symptom sentence; for a sentence use search_incidents, and for one category with its related categories counted use get_topic. Each filter is a slug (kebab-case) of its own kind: `symptom` is what was observed (pod-pending), `factor` is a condition that made it worse (no-alerting), `root_cause` is why it happened (capacity). Filters combine with AND. An unknown slug returns count 0 with no error; find the slug with vocab when you only have words. Reads only; the same filters return the same page.

Use first, whenever someone describes a failure they are seeing. Pass the symptoms as a sentence or a few words, in English or Korean; returns every reviewed public post-incident report the search finds for it, best match first: `total` is how many, `results` is one page of them in full (each with the case id, the page url and the source link), `matched` is every one as a row, and `next_cursor` fetches the next page. `interpreted` lists the values the sentence named, organisations included (the search moves cases carrying them up); `facets` count the results by root cause, component, symptom, contributing factor and organisation with the case ids, which answers 'what usually caused this' from the same call. The optional slug filters keep only cases carrying those values (AND); take slugs from facets, interpreted or vocab. Follow with get_incident for the full case.

Returns one case in full by its id: the structured write-up (symptoms, trigger, root cause, components, contributing factors, summary, impact, timeline, detection, remediation, action items, lessons), its sources with archived copies, and `similar_cases`. Use after search_incidents, list_incidents or get_topic has given you a case id; not for finding cases (use search_incidents for symptoms, list_incidents or get_topic for a category). `lang: ko` returns the Korean text of each field where the reviewers wrote one, otherwise English. The id must look like IL-0007; an id of that shape that matches no approved case returns an error result saying so, and an id of another shape is rejected before the call. Every call for the same id returns the same case.

Returns one vocabulary value with every case that carries it and, under `related`, the other four kinds counted over those cases with case ids: for a symptom, the root causes behind it (answers 'what usually causes this'); for a root cause, the components and factors seen with it. Use when you already have a slug and want the picture around it; use vocab to find the slug from words, list_incidents for a plain paged list, search_incidents for a symptom sentence. `kind` is the slug's category: root_causes, components, symptoms, factors or orgs (the organisations that published cases). With `symptoms`, the page keeps only the cases that sentence finds, best match first, and `query` echoes it, so 'certificate expiry, but only where DNS was involved' is one call. The answer is not paged: `count` and `cases` hold every case of the value (at most a few dozen today). An unknown slug or a slug of the wrong kind returns an error result naming it; nothing is written.

Resolves words to vocabulary slugs for the filters of search_incidents, list_incidents and get_topic. With `query`, returns `matches`: the `limit` values nearest in meaning to the words, nearest first, each with kind, slug, English and Korean name and page url (e.g. 'cert ran out' finds certificate-expiry); `kind` restricts to one category. There is no similarity cutoff: the list is always `limit` long, so when the words name nothing in the library the matches are far from them; read the names before using a slug, and when none fits, search with search_incidents instead of filtering. Without `query`, returns every value of every kind with names, aliases and definitions (a large answer; prefer `query`). Reads only.