api-patterns
3CX's native PBX MCP server: the per-PBX endpoint shape (every PBX is its own FQDN and its own OAuth authorization server — there is no shared mcp.3cx.com),…
PagerDuty Analytics: MTTA/MTTR/MTTE/MTTS definitions, incident and interruption counts, aggregation levels (account, service, team, escalation policy), time-range constraints, and benchmark tables for interpreting the numbers.
$ npx -y skills add wyre-technology/msp-claude-plugins --skill analytics --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/analyticsContext preview
The summary Claude sees to decide when to auto-load this skill.
PagerDuty Analytics: MTTA/MTTR/MTTE/MTTS definitions, incident and interruption counts, aggregation levels (account, service, team, escalation policy), time-range constraints, and benchmark tables for interpreting the numbers.
name: "PagerDuty Analytics" description: > PagerDuty Analytics: MTTA/MTTR/MTTE/MTTS definitions, incident and interruption counts, aggregation levels (account, service, team, escalation policy), time-range constraints, and benchmark tables for interpreting the numbers. when_to_use: >- When reporting on incident response performance, SLA compliance, or on-call workload from PagerDuty data. Use when: pagerduty analytics, mtta, mttr, incident metrics, pagerduty reporting, service performance, incident frequency, on-call load, or operational metrics.
PagerDuty Analytics provides data-driven insights into incident response performance. Key metrics include Mean Time to Acknowledge (MTTA), Mean Time to Resolve (MTTR), incident frequency, and responder workload. These metrics help MSPs identify operational bottlenecks, measure SLA compliance, and demonstrate value to clients.
MTTA and MTTR measure how fast responders reacted to a page. They are not the same number as contractual SLA attainment on customer tickets, and reporting one as the other misstates compliance to a client.
resolution targets, business-hours clocks, and breach counts are `freshdesk-sla-business-hours` or `halopsa-contracts`.
the PSA, not PagerDuty; use `halopsa-tickets` or `connectwise-psa-tickets`.
health directly; use `rootly-oncall`.
| Metric | Description | |--------|-------------| | **MTTA** | Mean Time to Acknowledge -- average time from incident trigger to first acknowledgement | | **MTTR** | Mean Time to Resolve -- average time from incident trigger to resolution | | **MTTE** | Mean Time to Engage -- average time from trigger to first responder engagement | | **MTTS** | Mean Time to Start -- average time from trigger to first status change | | **Incident Count** | Total number of incidents in the time period | | **Interruptions** | Number of off-hours notifications that interrupted responders |
Analytics can be aggregated at different levels:
All analytics queries require a time range:
pagerduty_get_analytics_incidents
Parameters:
**Example response:**
{
"data": {
"mean_seconds_to_acknowledge": 180,
"mean_seconds_to_resolve": 3600,
"mean_seconds_to_engage": 120,
"mean_seconds_to_first_ack": 180,
"mean_seconds_to_mobilize": 300,
"total_incident_count": 42,
"total_interruptions": 8,
"up_time_pct": 99.5
},
"filters": {
"since": "2026-03-01T00:00:00Z",
"until": "2026-03-27T00:00:00Z"
}
}pagerduty_get_analytics_services
Parameters:
**Example response:**
{
"data": [
{
"service_id": "PSVC123",
"service_name": "Payment API",
"mean_seconds_to_acknowledge": 120,
"mean_seconds_to_resolve": 2400,
"total_incident_count": 15,
"total_interruptions": 3,
"up_time_pct": 99.8
},
{
"service_id": "PSVC456",
"service_name": "Auth Service",
"mean_seconds_to_acknowledge": 300,
"mean_seconds_to_resolve": 7200,
"total_incident_count": 27,
"total_interruptions": 5,
"up_time_pct": 98.9
}
]
}1. Call `pagerduty_get_analytics_incidents` for the past month 2. Call `pagerduty_get_analytics_services` to break down by service 3. Calculate trends by comparing to the previous month 4. Highlight services with degrading MTTA/MTTR 5. Report on total incident count and interruption frequency
1. Get analytics for the target service over the SLA period 2. Compare MTTA against the acknowledgement SLA (e.g., < 5 minutes) 3. Compare MTTR against the resolution SLA (e.g., < 4 hours) 4. Calculate uptime percentage 5. Flag any SLA violations
1. Get per-service analytics for the past 30 days 2. Sort by `total_incident_count` descending to find noisiest services 3. Sort by `mean_seconds_to_resolve` to find slowest-to-resolve services 4. Cross-reference with service dependencies to assess impact 5. Recommend alert tuning or architectural improvements
1. Get analytics filtered by team for the past month 2. Review `total_interruptions` to measure off-hours impact 3. Compare workload across teams to identify imbalances 4. Review escalation frequency to assess coverage gaps 5. Recommend schedule adjustments for better distribution
1. Query analytics for multiple time periods (e.g., each of the last 6 months) 2. Track MTTA and MTTR trends over time 3. Identify whether incident response is improving or degrading 4. Correlate changes with team size, tool changes, or process improvements 5. Present trends in a summary table
| MTTA | Assessment | |------|------------| | < 1 min | Excellent -- likely automated acknowledgement | |
One command to supercharge Claude Code for MSP workflows. Then restart Claude Code. That's it. Documentation: mcp.wyre.ai
Repo: wyre-technology/msp-claude-plugins
3CX's native PBX MCP server: the per-PBX endpoint shape (every PBX is its own FQDN and its own OAuth authorization server — there is no shared mcp.3cx.com),…
3CX's live-operations surface: read-only visibility into active calls, recordings, voicemail, department and queue membership, and forwarding/presence…
3CX's read-only directory surface: resolving a caller by email or by exact extension, searching the PBX's own phonebooks, searching contacts synced from an…
3CX's system-and-configuration surface: server time, PBX event log and application log search, service status, database schema and the read-only SELECT-only…
Abnormal Security abuse mailbox cases: user-reported email submissions, case statuses and judgments, the case lifecycle, bulk and remediation actions, and…
Abnormal Security message analysis: message retrieval, email header inspection, attachments, sender reputation, delivery context, and SPF/DKIM/DMARC…