feat(controller): wire incident.io MCP credentials for incident triage (#50)

Add a per-flow `incident_triage.incident_io_api_key_secret` config field
that mounts `INCIDENT_IO_API_KEY` onto incident-triage agent Jobs via
SecretKeyRef. When the env var is present at job startup, setup-claude.sh
registers the incident.io remote MCP server (mcp.incident.io/mcp, HTTP
transport, Bearer-token auth) in the workspace mcp.json. When empty no
MCP server is registered — ticketing pods are unaffected.

The Bearer header is templated into mcp.json via `jq --arg` rather than
Claude Code's runtime `${VAR}` substitution, which has known bugs for
HTTP MCP headers (anthropics/claude-code#51581, #6204).

Mirrors the per-flow config precedent from #46.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarahjanenewnham

CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **Per-flow incident.io MCP credentials**: new
+  `incident_triage.incident_io_api_key_secret` config field selects a
+  Kubernetes Secret whose `INCIDENT_IO_API_KEY` key is injected into the
+  incident-triage agent Job via SecretKeyRef. When set, `setup-claude.sh`
+  registers the incident.io remote MCP server (`https://mcp.incident.io/mcp`,
+  HTTP transport, Bearer-token auth) in the workspace `mcp.json` at job
+  startup. When empty, no incident.io MCP server is registered — the
+  ticketing flow is unaffected. The Bearer header is templated into
+  `mcp.json` via `jq --arg` rather than Claude Code's runtime `${VAR}`
+  substitution, which has known bugs for HTTP MCP headers
+  (anthropics/claude-code#51581, #6204).
+
 ### Changed
 
 - **Richer incident.io context surfaced to the agent**:

docker/engine-claude-code/setup-claude.sh

@@ -46,6 +46,21 @@ cp /etc/claude-code/settings.json "${CLAUDE_DIR}/settings.json"
 # available via the explicit --mcp-config flag in the claude invocation.
 cp /etc/claude-code/mcp.json /workspace/.mcp.json
 
+# Conditionally register the incident.io remote MCP server when an API key
+# is present on the pod (set via SecretKeyRef from IncidentTriageConfig).
+# We assemble the workspace mcp.json ourselves rather than relying on Claude
+# Code's ${VAR} substitution in HTTP headers, which has known bugs
+# (anthropics/claude-code#51581, #6204).
+if [ -n "${INCIDENT_IO_API_KEY:-}" ]; then
+    jq --arg key "$INCIDENT_IO_API_KEY" \
+        '.mcpServers."incident-io" = {
+            type: "http",
+            url: "https://mcp.incident.io/mcp",
+            headers: {"Authorization": ("Bearer " + $key)}
+        }' /workspace/.mcp.json > /workspace/.mcp.json.tmp \
+        && mv /workspace/.mcp.json.tmp /workspace/.mcp.json
+fi
+
 # Export CLAUDE_CONFIG_DIR so claude itself picks it up when the non-default
 # path is in use.  A no-op when CLAUDE_CONFIG_DIR was already set in the env.
 export CLAUDE_CONFIG_DIR="${CLAUDE_DIR}"

internal/config/config.go

@@ -214,6 +214,14 @@ type IncidentTriageConfig struct {
 	// from the first configured Slack channel in Notifications.Channels
 	// is used.
 	SlackTokenSecret string `yaml:"slack_token_secret,omitempty"`
+
+	// IncidentIOAPIKeySecret is the Kubernetes Secret backing
+	// INCIDENT_IO_API_KEY on the incident-triage agent Job. When set,
+	// setup-claude.sh registers the incident.io remote MCP server in
+	// the agent's workspace mcp.json, authenticated as a Bearer token.
+	// The Secret must contain a key named INCIDENT_IO_API_KEY. When
+	// empty, no incident.io MCP server is registered.
+	IncidentIOAPIKeySecret string `yaml:"incident_io_api_key_secret,omitempty"`
 }
 
 // SecretResolverConfig configures the task-scoped secret resolver.

internal/controller/incident.go

@@ -169,6 +169,20 @@ func (r *Reconciler) ProcessIncidentEvent(ctx context.Context, evt webhook.Incid
 			Key:        r.resolveSlackTokenKey(ctx, tokenSecret),
 		}
 	}
+	// Per-flow incident.io MCP credentials. The agent's MCP client reads
+	// INCIDENT_IO_API_KEY from the pod env to authenticate to
+	// mcp.incident.io. Only the incident-triage flow needs this — ticketing
+	// pods skip it. setup-claude.sh registers the incident.io MCP server in
+	// the workspace mcp.json when this env var is present at job startup.
+	if apiKeySecret := r.config.IncidentTriage.IncidentIOAPIKeySecret; apiKeySecret != "" {
+		if engineCfg.SecretKeyRefs == nil {
+			engineCfg.SecretKeyRefs = make(map[string]engine.SecretKeyRef)
+		}
+		engineCfg.SecretKeyRefs["INCIDENT_IO_API_KEY"] = engine.SecretKeyRef{
+			SecretName: apiKeySecret,
+			Key:        "INCIDENT_IO_API_KEY",
+		}
+	}
 
 	if err := r.prepareSession(ctx, tr.ID); err != nil {
 		return fmt.Errorf("preparing session storage: %w", err)

internal/controller/incident_test.go

@@ -586,3 +586,69 @@ func TestProcessIncidentEvent_OmitsEmptyIncidentLabels(t *testing.T) {
 			"empty IncidentStatus.Category must not produce a dangling osmia:incident-status: label")
 	}
 }
+
+// TestProcessIncidentEvent_SetsIncidentIOAPIKeySecretKeyRef verifies that
+// the incident-triage agent Job's INCIDENT_IO_API_KEY SecretKeyRef points
+// at the Secret named by IncidentTriage.IncidentIOAPIKeySecret. The Key
+// is the literal "INCIDENT_IO_API_KEY" — unlike the Slack token there is
+// no well-known-key probing because the operator-managed Secret is
+// expected to follow the documented naming convention.
+func TestProcessIncidentEvent_SetsIncidentIOAPIKeySecretKeyRef(t *testing.T) {
+	cfg := incidentTestConfigWithTicketingSlack()
+	cfg.IncidentTriage.IncidentIOAPIKeySecret = "incident-io-api"
+
+	logger := testLogger()
+	k8s := fake.NewSimpleClientset(
+		&corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "incident-io-api",
+				Namespace: "test-ns",
+			},
+			Data: map[string][]byte{
+				"INCIDENT_IO_API_KEY": []byte("inc_test_key"),
+			},
+		},
+	)
+	eng := &recordingEngine{name: "claude-code"}
+	jb := &mockJobBuilder{}
+	r := NewReconciler(cfg, logger,
+		WithEngine(eng),
+		WithJobBuilder(jb),
+		WithK8sClient(k8s),
+		WithNamespace("test-ns"),
+	)
+
+	require.NoError(t, r.ProcessIncidentEvent(context.Background(), incidentTestEvent("01HZINCIOAPI")))
+
+	ref, ok := eng.lastConfig.SecretKeyRefs["INCIDENT_IO_API_KEY"]
+	require.True(t, ok, "INCIDENT_IO_API_KEY SecretKeyRef must be set on the agent Job")
+	assert.Equal(t, "incident-io-api", ref.SecretName,
+		"SecretName must point at IncidentTriage.IncidentIOAPIKeySecret")
+	assert.Equal(t, "INCIDENT_IO_API_KEY", ref.Key,
+		"Key is the literal env var name — no well-known-key probing for this field")
+}
+
+// TestProcessIncidentEvent_OmitsIncidentIOAPIKeyWhenSecretNotConfigured
+// verifies that when IncidentTriage.IncidentIOAPIKeySecret is empty the
+// agent Job receives no INCIDENT_IO_API_KEY SecretKeyRef. This is the
+// path setup-claude.sh relies on to skip MCP server registration for
+// flows that don't need incident.io access.
+func TestProcessIncidentEvent_OmitsIncidentIOAPIKeyWhenSecretNotConfigured(t *testing.T) {
+	cfg := incidentTestConfigWithTicketingSlack()
+	// IncidentIOAPIKeySecret deliberately left empty.
+
+	logger := testLogger()
+	eng := &recordingEngine{name: "claude-code"}
+	jb := &mockJobBuilder{}
+	r := NewReconciler(cfg, logger,
+		WithEngine(eng),
+		WithJobBuilder(jb),
+		WithNamespace("test-ns"),
+	)
+
+	require.NoError(t, r.ProcessIncidentEvent(context.Background(), incidentTestEvent("01HZINCIOOFF")))
+
+	_, ok := eng.lastConfig.SecretKeyRefs["INCIDENT_IO_API_KEY"]
+	assert.False(t, ok,
+		"INCIDENT_IO_API_KEY SecretKeyRef must be absent when IncidentIOAPIKeySecret is empty")
+}