SLA-Aware Incident Detection and Alert Routing via MCP in Distributed Systems

Abstract

Modern distributed systems generate large volumes of telemetry—metrics, logs, and traces—across interconnected services. In production operations, related failures often surface as fragmented alerts, making it difficult to separate high-impact incidents from background noise. Static threshold-based monitoring can produce excessive false alarms and delay incident triage. This paper presents a Service-Level Agreement (SLA)-aware approach to incident detection and alert routing that integrates three components: an incremental incident-grouping model based on temporal and tag similarity with per-event work O(K); SLA-weighted scoring and capacity-aware routing derived from a utility-based prioritization scheme; and adaptive anomaly detection using cumulative sum (CUSUM) with tunable false-positive control. The design is implemented as a Model Context Protocol (MCP)-based multi-agent pipeline for correlation, scoring, prioritization, and routing. Evaluation uses OpenTelemetry-style microservice telemetry across 30 runs with bootstrap 95% confidence intervals and non-parametric statistical tests, along with a public KPI benchmark. The MCP-Agent approach improves precision over static thresholding (0.171 versus 0.055) and F1 over tag-and-time grouping (0.282 versus 0.104), while maintaining a false-positive rate below the target budget of six alerts per hour. Scalability experiments spanning 10–200 services show sub-millisecond median latency and throughput above 1,800 events per second.