Honeycomb

Connect Honeycomb with OAuth so agents can rank failing endpoints, run BubbleUp, and follow a trace to the span that failed

Connect your Honeycomb team to let CloudThinker agents rank endpoints by failing spans, run BubbleUp (Honeycomb’s comparison of failing events against healthy ones) to find what changed, open a trace waterfall, and review triggers, SLOs, and boards. You sign in to Honeycomb once through OAuth. There’s no API key to create or paste.

Prerequisites

• A Honeycomb account that can reach the team you want agents to read.
• At least one environment with a dataset receiving telemetry. Every query needs a dataset, so an environment with none can’t answer anything.
• A team on Honeycomb’s US region. CloudThinker connects to https://mcp.honeycomb.io/mcp, so a team that lives only in Honeycomb’s EU region can’t connect yet. If you need EU, ask your CloudThinker contact.
• The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.

Setup

1. Start the connection

   Open More → Workspace settings → Connections, stay on the Builtin Connections tab, select Honeycomb, and click Connect. CloudThinker opens Honeycomb’s authorization page.

2. Authorize CloudThinker

   Sign in to the Honeycomb account that can reach your team, then approve access. If your browser is already signed in to a different Honeycomb account, sign out of it first.

3. Return to CloudThinker

   Honeycomb sends you back to CloudThinker, which stores the tokens and refreshes them on its own.

   Success state: Honeycomb shows Connected. Run the verify prompt below to see which team you connected.

Connection details

There are no fields to fill in.

Item	Value
Authentication	OAuth. Honeycomb issues the tokens and CloudThinker stores them for you
Endpoint	https://mcp.honeycomb.io/mcp, Honeycomb’s hosted MCP server

Required permissions

Agents see what the authorizing Honeycomb account sees, and CloudThinker can’t narrow that grant. To limit what agents reach, authorize with a dedicated Honeycomb user for CloudThinker whose access covers only the team and environments you want them to use.

A dedicated user also keeps the connection alive when people change roles. If the authorizing person leaves the team and loses access, every call starts failing until someone connects again.

Creating or updating a board, trigger, SLO, marker, or recipient is a write. When it asks you, the agent states the effect, shows the exact inputs, and waits for your answer.

Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.

To make every board, trigger, SLO, marker, or recipient write wait for a person, choose Manual. Once CloudThinker turns on Rule enforcement for your workspace, an Ask first Rule can single out just those writes.

Agent capabilities

Capability	What agents can do	Approval
Discovery	Name the team, list environments and datasets, and report whether triggers, boards, and recipients exist	No
Service health	Rank endpoints by failing span count, with error rate and p95 latency	No
Root cause	Run BubbleUp to find the field that separates failing spans from healthy ones	No
Traces	List spans, read span details, and open a full trace waterfall	No
Queries	Run queries, read results, find columns, and look up saved queries	No
Alerting review	Read triggers, boards, and notification recipients	No
Changes	Create or update a board, trigger, or SLO, and create a marker or recipient	Through Approvals

Agents rank by failing span count rather than error rate alone, so a rarely called endpoint at 100% errors doesn’t outrank the endpoint that’s actually hurting users. A BubbleUp result is a correlation, and agents report it as one, not as a proven cause.

Honeycomb’s MCP server has no delete. A board, trigger, SLO, marker, or recipient an agent creates stays until you remove it in Honeycomb. Approve a create only when you want the object to exist.

Verify the connection

Summarize my Honeycomb setup: team, environments, datasets, and whether triggers exist

Expect your team name, the environments with a dataset count for each, and whether triggers, boards, and recipients are set up.

Example prompts

Which endpoint is in the worst shape right now?
Why is POST /checkout failing, and what changed? Run BubbleUp on the errors
Which datasets have no trigger watching them?

Agents share Honeycomb’s query and trace permalinks in their answers, so you can open the same view in Honeycomb.

Troubleshooting

The OAuth flow doesn't complete

Your browser is probably signed in to a different Honeycomb account. Sign in to the right account in Honeycomb, then click Connect again.

Every call fails with an authentication error

The stored tokens are no longer valid, usually because access was revoked in Honeycomb. Open More → Workspace settings → Connections, select Honeycomb, click Connect in the error notice, and authorize again.

The agent says there are no datasets or no telemetry

The environment has no dataset, or no span data in the time window. Check in Honeycomb that the environment is receiving events, or ask for a wider window.

An environment called $activity-log$ is skipped

That’s Honeycomb’s own audit environment. It shows up in the environment list but can’t be queried, so agents skip it on purpose.

A create or update didn't run

You declined it, didn’t answer the approval prompt, or a Rule refused it. Agents don’t retry a declined write. Ask again if you want it.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• No signed result links in chat: Honeycomb’s raw result download URLs carry a token that grants access to the data. Agents share the permalink instead, so a copied message doesn’t leak access.
• Switching teams: click Disconnect on the Honeycomb connection, then connect again with the other Honeycomb account.
• Disconnect clears CloudThinker’s copy only: it deletes the stored tokens but doesn’t revoke the grant in Honeycomb. If your policy requires it, also remove CloudThinker’s access in your Honeycomb account settings.

Related

Approvals

How CloudThinker asks before a Honeycomb write runs.

Splunk Observability

Read-only APM, traces, and SignalFlow queries.