---
title: "Incident Response"
description: "From alert to diagnosis, hands-free."
order: 30
duration: "10 min"
chapter: "07-the-always-on-system"
type: lesson
---

## From alert to diagnosis, hands-free

The most advanced L4 pattern combines Channels and MCP into an automated incident response pipeline. Here is the full flow:

<div class="callout">
  <div class="callout-label">Incident Response Flow</div>
  <p><strong>1. Alert arrives:</strong> Monitoring system sends a webhook — "QuickBooks sync failed"</p>
  <p><strong>2. Check connection:</strong> Claude tests the QuickBooks MCP connection — is the API responding?</p>
  <p><strong>3. Check recent changes:</strong> Claude reviews recent configuration changes — did someone rotate credentials?</p>
  <p><strong>4. Diagnose:</strong> Claude checks error logs, identifies the issue (expired OAuth token, rate limit, network timeout)</p>
  <p><strong>5. Notify:</strong> Claude sends a diagnostic summary via Telegram: "QuickBooks sync failed. Cause: OAuth token expired 2 hours ago. Action needed: re-authorize in QuickBooks settings."</p>
  <p><strong>6. Optionally remediate:</strong> If the fix is automatable (retry after rate limit, refresh token), Claude handles it and confirms</p>
</div>

Each step uses a different MCP server or tool. The Channel provides the trigger. MCP servers provide the data. Claude provides the reasoning — not following a rigid runbook, but investigating an incident the way an experienced operator would.

> "The first time the incident response pattern caught a real bug at 3am, diagnosed it, and had a PR ready by the time I woke up, I understood what L4 actually means."

## The system that works while you sleep

Step back. Look at what you have built across the last three chapters:

| Layer | What You Built | Chapter |
|-------|---------------|---------|
| **Knowledge** | SKILL.md — your organizational rules | Ch 04 |
| **Data** | MCP connection — live access to your systems | Ch 07 (this chapter) |
| **Interface** | Claude Code + Remote Control | Ch 06 |
| **Automation** | Routines + Channels | Ch 07 (this chapter) |

Knowledge plus data plus automation. Your categorization rules applied to real transactions on a schedule, with exceptions pushed to you via Telegram. That is L4 — the system surfaces insights before being asked and acts within defined boundaries.

<div class="exercise">
  <div class="callout-label">Try This</div>
  <p>What is ONE thing you check every morning? A dashboard, an inbox, a report, a set of numbers? Write it down. That is your next scheduled task.</p>
  <p>Now think: what event in the outside world should Claude respond to without you asking? A new email, a failed deployment, an invoice arrival, an alert? Write that down too. That is your first channel.</p>
  <p>You are at L4. In the next chapter, you will close the last gap — the systems and applications that have no API, no MCP server, no command line interface. The ones you can only operate by clicking.</p>
</div>

## Check your understanding

Answer in your own words — write it down before opening the key. Your tutor grades against the criteria and generates fresh variants on retries.

**Q1.** Design an incident-response flow for a real failure you encounter: the trigger, two diagnostic checks, the notification, and the line that separates what it may auto-remediate from what needs a human.

<details>
<summary>Answer key — attempt every question first</summary>

## Answer key

### Q1

**Model answer:** Any coherent flow passes: real trigger (alert webhook), two checks that actually discriminate causes (is the API up? did credentials change?), a notification that carries the diagnosis, and a defensible boundary — mechanical/reversible fixes (retry, token refresh) auto-remediate; anything touching money, data deletion, or ambiguity goes to a human.

**Pass criteria:** all four components present; auto-remediation boundary drawn at reversibility/ambiguity, not arbitrary

</details>


**Next:** [Browser Automation](/mastering-claude/08-when-apis-dont-exist/31-browser-automation/)