Published October 16, 2026 (IST) by the AgentStack News Desk. Facts were checked against Cognition’s Devin Oncall documentation, the Dynatrace launch partner post dated October 15, 2026, and Cognition’s October 15 announcement on X.
Cognition launched Devin Oncall on October 15, 2026, extending its coding agent into production incident response. The product watches alerts and bugs, investigates with telemetry and code, and can open a fix pull request for engineer review.
Cognition’s X announcement says Devin Oncall already handles thousands of alerts a day for large customers. Dynatrace joined as a launch partner, wiring runtime intelligence into Devin through an MCP server and Dynatrace skills.
The AgentOps angle: coding agents are moving into the on-call stack, where observability tools already own the incident workflow. This report draws on the Devin Oncall docs, the Dynatrace partnership post, and Cognition’s October 15 X announcement, per our editorial standards.
TL;DR
- What landed: Devin Oncall for investigating alerts, bugs, and incidents, with optional fix pull requests, announced October 15, 2026.
- Status: generally available on Devin Cloud, per Cognition and Seismo coverage of the launch.
- Three products: Responders for incoming alerts and bugs, Incidents for Slack incident channels, and Reports for recurring on-call insights.
- Telemetry path: connect at least one monitoring tool during setup; Dynatrace ships an MCP server plus skills as a launch partner.
- Triggers: Slack, Microsoft Teams, and PagerDuty events can start responders; PagerDuty also exposes an MCP server for session context.
- Operator takeaway: treat Oncall like a new SRE teammate with scoped connectors, review every PR, and measure alert noise before granting write access.
What Cognition Shipped in Devin Oncall
Devin Oncall is documented as three products on one setup path. Responders watch alert and bug sources as they arrive. Incidents join Slack channels that match a preset prefix. Reports summarize what is driving alerts and which pull requests Devin opened or merged.
Setup is one-time per organization. Admins connect telemetry, then Devin learns systems for about one to two hours and writes skills that later Oncall sessions reuse. Organization admins alone can connect tools for the whole org, according to the docs.
| Product | What it watches | What Devin focuses on |
|---|---|---|
| Responders | Alerts, bug reports, support questions | Impact, root cause, mitigation or code fix |
| Incidents | Slack channels with an incident prefix | Likely root cause, mitigations, ongoing updates |
| Reports | Matched responders and incidents on a schedule | Alert thresholds, recurring issue classes, PR outcomes |
Responders can group repeated events into one issue, so a noisy alert is investigated once instead of once per page. That design choice matters more than the marketing claim of thousands of daily alerts, because alert fatigue is where most on-call automation fails.
How Dynatrace Wires Runtime Context Through MCP
Dynatrace’s October 15 post positions the company as a launch partner. The Dynatrace extension for Devin ships through the Devin Marketplace as an MCP server plus skills that teach Devin how Dynatrace data is structured, including DQL patterns and alerting workflows.
The post argues that agents which query separate stores rebuild context on every question, burning time and tokens. Dynatrace says Devin can start from problem and root-cause objects already correlated in its graph, then pull logs, metrics, traces, deployments, and runtime security findings under the configured permissions.
| Piece | What Dynatrace says it provides | Auth model called out |
|---|---|---|
| MCP server | Authenticated access to the Dynatrace environment | Dynatrace platform token stored in installation credentials |
| Skills (examples) | dt-dql-essentials, dt-alerting and related guidance | Skills load when relevant to preserve context window |
| Marketplace listing | Install once from Devin’s plugin marketplace | Token not written into the plugin manifest |
| Incident flow | Problem, root cause, logs, metrics, traces for a failing service | Same Grail data SRE teams already use |
MCP remains the control plane for tool access here. Our MCP explained guide and MCP gateways list cover how enterprises gate those connectors. Putting Observability behind MCP is the same pattern agents already use for tickets and file systems.
Which Triggers and Channels Start an Investigation
The docs list Slack messages and user-group mentions, Microsoft Teams channel messages, and PagerDuty incident events as responder triggers. Each responder watches one integration at a time and can hold up to ten triggers, with optional conditions to narrow which events fire.
PagerDuty docs say incidents can trigger automations and Oncall responders, while a separate PagerDuty MCP server gives sessions access to incidents, services, and on-call schedules after OAuth setup. Incidents mode is Slack-centric: Devin joins channels that match a prefix such as incident-, with proactive or one-shot RCA response modes.
- Alerts responder: assess severity fast, then root cause and mitigation.
- Support + Bugs responder: reproduce, find root cause, fix in code.
- Incidents proactive: post a likely root cause, keep investigating, maintain a report.
- Incidents one-shot RCA: post a likely root cause with confidence, then stop unless upgraded.
- Reports: schedule insights on thresholds, recurring classes, and PR outcomes to Slack or Teams.
Limits on ACU spend, invocation count, network policy, and which MCP connectors a responder may use are first-class settings. That is the governance surface AgentOps teams should lock before flipping auto-join on for every incident channel.
Why Autonomous Oncall Matters for AgentOps Teams
Most AgentOps programs stop at traces and evals for agent quality. Devin Oncall pushes the same coding agent into remediation, which changes the blast radius from a wrong summary in a dashboard to a wrong pull request landing in production code.
What to verify on day one
Run Oncall in investigate-only mode first, with PR creation gated behind a human review policy. Confirm that alert grouping works on your noisiest monitor, that MCP connectors are least-privilege, and that every session identity maps to an auditable Run as user.
- Connect one telemetry tool and wait for setup skills to finish before creating responders.
- Start with a single Alerts responder on a low-severity Slack channel, not PagerDuty page-worthy services.
- Require human review on every fix PR; treat Devin output like a junior SRE draft.
- Record false-positive rate and mean time from alert to first useful note for two weeks.
- Only then turn on Incidents auto-join or write-capable connectors.
# Illustrative operator checklist (not vendor CLI)
# 1) Install Dynatrace (or other) MCP connector with a scoped platform token
# 2) Create Alerts responder -> Slack #alerts-low only
# 3) Connectors: read-only observability MCP; no prod deploy tools
# 4) Limits: cap ACU and invocations per day
# 5) After 50 investigations, review Reports for recurring classes before widening scopeTeams building the surrounding stack can start from our AgentOps tools map, the best AI agent observability tools guide, and yesterday’s Claude Platform OpenTelemetry traces note. Eval platforms in our AI agent evaluation tools list help score whether Oncall notes and PRs improve over time.
Claims, Benchmarks, and What Remains Vendor Copy
Cognition’s X post says Oncall already handles thousands of production alerts a day. That is a customer-usage claim, not an independent AgentStack measurement. Seismo’s launch brief also cites SREGym-Lite end-to-end success of 100% with Opus 5.5 in 2 minutes 21 seconds, a second review agent checking tool calls, and responders skipping roughly 60% of checks by remembering past alerts.
Those benchmark numbers come from secondary coverage of Cognition’s announcement materials. We have not reproduced SREGym-Lite. Treat them as vendor-reported until Cognition publishes a full public method paper or third parties re-run the suite.
| Claim | Where it appears | How we treat it |
|---|---|---|
| Thousands of alerts per day already handled | Cognition X announcement, Oct 15 | Vendor usage claim; not independently verified |
| Generally available on cloud | Seismo launch brief citing Cognition | Consistent with docs being live and setup guides public |
| SREGym-Lite 100% end-to-end with Opus 5.5 | Seismo summary of announcement | Vendor benchmark; method not re-run by AgentStack |
| Review agent checks reasoning and tool calls | Seismo summary of announcement | Architecture claim; confirm in your tenant if exposed |
| ~60% of checks skipped via remembered alerts | Seismo summary of announcement | Cost claim; measure on your own alert corpus |
Limits, Governance Gaps, and Open Questions
Public docs do not publish a full matrix of every telemetry vendor beyond the setup requirement to connect at least one tool. Dynatrace is the clearest MCP path in launch-day writing. Datadog and Sentry appear in secondary coverage as integration targets, but operators should confirm connector availability in their own Devin tenant.
Incidents mode requires Slack and, in an enterprise, only one organization at a time can turn it on, per the docs. Auto-join works only for public channels. Write access to remediations and PRs inherits whatever connectors and agent mode you attach, so least privilege is on you.
Pricing is not broken out as a separate Oncall SKU in the pages we reviewed. Expect usage to follow existing Devin ACU and plan limits unless Console copy says otherwise.
What to Watch Next
Five follow-ups over the next few months will show whether Devin Oncall becomes a default SRE teammate for production incidents, or stays a narrow pilot for low-severity alert triage inside engineering shops that already trust Devin on their application code.
- Connector matrix: which observability and ticketing tools ship first-party MCP skills beyond Dynatrace and PagerDuty.
- PR quality: merge rate and rollback rate for Oncall-authored fixes in public customer stories.
- Identity: whether Run as and agent-aware audit logs satisfy enterprise change-management rules.
- Noise control: whether Reports measurably cut alert volume after threshold tuning.
- Multi-org Incidents: whether the one-org-at-a-time Slack Incidents limit loosens.
Frequently Asked Questions
What is Devin Oncall and when did Cognition launch it?
Devin Oncall is Cognition’s product for investigating alerts, bugs, and incidents with Devin, then remediating and opening fix pull requests when configured. Cognition announced it on October 15, 2026. Docs describe Responders, Incidents, and Reports as the three product surfaces under one organization setup.
How does Dynatrace connect to Devin Oncall?
Dynatrace’s October 15 launch partner post says you install the Dynatrace extension from the Devin Marketplace. The extension includes an MCP server for authenticated access plus skills such as DQL and alerting guidance. You authenticate with a Dynatrace platform token stored in installation credentials, not in the plugin manifest.
Which tools can trigger a Devin Oncall responder?
Official docs list Slack channel messages and user-group mentions, Microsoft Teams channel messages, and PagerDuty incident events as responder triggers. Each responder watches one integration, supports up to ten triggers with conditions, and can attach optional runbooks plus MCP connector allowlists.
Should AgentOps teams let Devin Oncall merge fixes automatically?
Public docs emphasize investigation, mitigation recommendations, and opening fix PRs for review. Day-one practice should keep humans in the merge path, scope MCP connectors to read-heavy telemetry, and use ACU limits. Widen write access only after you measure false-positive rate and PR quality on your own alert corpus.
How is Devin Oncall different from ordinary agent observability?
Observability tools record what an agent or service did. Devin Oncall consumes those signals to investigate and optionally change code. That moves AgentOps from dashboards into change management, so identity, connector scope, and PR review gates matter as much as trace coverage.
The Bottom Line
Cognition put a coding agent on the pager path with Devin Oncall, and Dynatrace showed how MCP can feed that agent correlated runtime context instead of raw dashboard scraping. The useful day-one move is a narrow Alerts responder with human-reviewed PRs, not full auto-join on every severity.
We will update this story when Cognition publishes a fuller connector matrix, GA pricing detail, or independent SREGym-Lite replication. Send corrections through our contact page.
Related coverage: agent observability, AgentOps, observability tools, Claude Platform OTel traces, MCP explained, and MCP gateways.