Prerequisites
- A Honeycomb account with access to the team you want CloudThinker to read.
- Permission to authorize CloudThinker during Honeycomb’s OAuth flow.
- At least one environment with a dataset receiving telemetry. Every query tool needs a dataset; an environment with none means the account sends no telemetry, not a healthy zero.
CloudThinker connects to Honeycomb’s US endpoint,
https://mcp.honeycomb.io/mcp. The EU endpoint is not selectable, so an EU-only team cannot connect yet.Setup
1
Open the connection
Go to Connections → Honeycomb in your CloudThinker workspace.
2
Start the OAuth flow
Click Connect. CloudThinker opens Honeycomb’s authorization page.
3
Authorize CloudThinker
Sign in to the Honeycomb account that can reach the team you want to use, then approve access.
4
Return to CloudThinker
Honeycomb sends you back and CloudThinker stores the tokens. The connection shows a Connected status.
Connection details
Honeycomb uses OAuth, so there are no fields to fill in. CloudThinker stores the access and refresh tokens after the flow completes and refreshes them without asking you again.Required permissions
CloudThinker inherits whatever the authorizing Honeycomb account can reach. The authorization grants two scopes:Agent capabilities
Once connected, Alex can:Verify the connection
Example prompts
Writes are permanent
Honeycomb’s MCP server exposes no delete tool. A board, trigger, SLO, marker, or recipient the agent creates cannot be removed from CloudThinker; you remove it in Honeycomb. Every write is therefore gated twice. The agent states the effect and shows the exact inputs, and the change runs only after you approve it in that turn.Troubleshooting
The OAuth flow does not complete
The OAuth flow does not complete
Your browser may be signed in to a different Honeycomb account. Sign in to the intended account, then start the Honeycomb connection again.
Every call fails with an authentication error
Every call fails with an authentication error
The stored tokens are no longer valid, usually because the authorization was revoked in Honeycomb. Remove the connection and reconnect.
The agent reports no datasets
The agent reports no datasets
Queries need a dataset in a queryable environment. Confirm the environment is receiving telemetry in Honeycomb; an environment with no dataset cannot answer a query, a BubbleUp, or a trace question.
The agent skips one of my environments
The agent skips one of my environments
$activity-log$ is Honeycomb’s own audit environment. It appears in the environment list, but every scoped call rejects it, so CloudThinker skips it on purpose.A create was refused
A create was refused
Creating a board, trigger, SLO, marker, or recipient needs your approval in the same turn. Answer the approval prompt while it is open; a new turn asks again.
Security
- Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
- Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
- Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
- Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
- No result links in chat — Honeycomb signs its query-result and trace-result download URLs. CloudThinker shares the human permalink instead, so a copied message never carries a token that grants result access.
- Reconnect to switch teams — remove the existing connection before authorizing a different Honeycomb account.
Related
Alex Agent
Cloud and observability investigation agent
Approvals
How CloudThinker gates a write behind your confirmation