# Landfall Docs

> Incidents fragment across Slack, Teams, Zoom, DMs and every responder's own coding agent. Landfall is the one war room where the whole crew works from the same live context.

Landfall is a hosted war room for live incidents. Each responder's own coding agent (Claude Code,
Codex CLI, Cursor, VS Code, Claude Desktop, Windsurf) joins it over MCP through the open-source
`landfall` CLI. A finding or hypothesis a coding agent shares is staged until the room admits it.
Landfall suggests fixes and never runs a change. Every page below is served as HTML at the URL
given; the sitemap is at /sitemap.xml.

## Get started

- [How a war room works](https://docs.landfalls.ai/concepts): The fragmented incident (Slack, Teams, Zoom, DMs, private coding-agent sessions), the war room and its timeline, who is in it (people, each responder’s coding agent, Beacon and the Company second brain), the admission gate, suggest-only remediation, and the Canvas, Context, Comms and Postmortem tabs.
- [What Landfall does and does not do](https://docs.landfalls.ai/limits): Where Landfall stops, stated plainly: it never runs a change, what is staged and what is not, Slack and Teams are outbound only, no Zoom or Meet, not a phone pager, the CLI on macOS and Linux, a read-only manager connector, and reads-only access to your telemetry.
- [Quickstart](https://docs.landfalls.ai/getting-started): Three commands to turn the coding agent you already use (Claude Code, Codex CLI, VS Code, Cursor, Claude Desktop, Windsurf) into a live investigator in your team’s shared war room.
- [Using Claude Code](https://docs.landfalls.ai/claude-code): How the landfall CLI’s MCP Edge Bridge gives every Claude Code session twelve incident-scoped tools and a realtime link to the war room, without changing how you use Claude Code.
- [Using the Claude desktop app](https://docs.landfalls.ai/claude-desktop): The Code tab of the Claude desktop app loads the Landfall mod and its /landfall console, from sign-in to a vote, the wall and the timeline. Chat reaches Landfall through the hosted connector, which draws open incidents, a room and its canvas as cards.
- [Landfall Edge (macOS app)](https://docs.landfalls.ai/edge): Install the Landfall Edge macOS app from its DMG, attach the coding agent you already use (your favorite harness), sign in to your organization, and use the dashboard to see every incident and postmortem without a browser.
- [Organization and personal settings](https://docs.landfalls.ai/administration): Who can reach organization settings (owners and admins), what every member manages under Your settings, and how admins review and export the audit log.
- [Connect Okta](https://docs.landfalls.ai/identity/okta): Register an Okta OIDC app for sign-in, and add SCIM provisioning on a SAML or SWA app to create and deactivate your team.
- [Connect Azure AD / Entra ID](https://docs.landfalls.ai/identity/azure-ad): Set up automatic SCIM provisioning from a Microsoft Entra ID enterprise application, and register an app for sign-in. Validate and save refuses Entra ID sign-in today, and provisioning does not depend on it.
- [Connect Google Workspace](https://docs.landfalls.ai/identity/google-workspace): Register an OAuth client for sign-in, and reach Landfall’s SCIM endpoint through a Google Workspace Marketplace SCIM bridge app.
- [Connect another provider (OIDC + SCIM)](https://docs.landfalls.ai/identity/generic-oidc): Standard OpenID Connect discovery for sign-in and SCIM 2.0 (RFC 7643/7644) bearer-token provisioning, for any provider not named elsewhere.

## Deploy

- [Landfall Edge for fleets (MDM)](https://docs.landfalls.ai/deploy/edge): Push the Landfall Edge macOS companion app to responder laptops through Jamf, Kandji, Intune or Munki with no per-machine setup, and remove it just as cleanly.

## Integrations

- [AWS](https://docs.landfalls.ai/integrations/aws): Let Beacon, the room’s AI agent, read your CloudWatch metrics and logs through a read-only IAM role that Landfall’s wizard writes the policies for. No long-lived key leaves your account, and deleting the role ends Landfall’s access.
- [Azure](https://docs.landfalls.ai/integrations/azure): Let Beacon, the room’s AI agent, read Azure Monitor metrics and Log Analytics logs through one app registration (service principal) you create and scope yourself.
- [Google Cloud](https://docs.landfalls.ai/integrations/gcp): Let Beacon, the room’s AI agent, read Cloud Monitoring metrics and Cloud Logging entries for one Google Cloud project through a service account key you create and scope yourself.
- [Datadog](https://docs.landfalls.ai/integrations/datadog): Connect Datadog with an API key and an application key so Beacon, the room’s AI agent, can query your metrics and logs during an investigation.
- [Coralogix](https://docs.landfalls.ai/integrations/coralogix): Connect Coralogix with one Team API key so Beacon, the room’s AI agent, can query your logs during an investigation.
- [Grafana](https://docs.landfalls.ai/integrations/grafana): Connect your own Grafana as a source Beacon, the room’s AI agent, can query during an investigation, reaching every datasource Grafana already has configured, not just Grafana itself.
- [Prometheus](https://docs.landfalls.ai/integrations/prometheus): Connect your own Prometheus as a source Beacon, the room’s AI agent, can query during an investigation.
- [Loki](https://docs.landfalls.ai/integrations/loki): Connect your own Loki as a source Beacon, the room’s AI agent, can query during an investigation.
- [Sentry](https://docs.landfalls.ai/integrations/sentry): Connect Sentry with an Internal Integration token so Beacon, the room’s AI agent, can read your issues and their error events during an investigation.
- [Remote source](https://docs.landfalls.ai/integrations/remote-source): Connect a telemetry service you host yourself, written in any language, as a source Beacon, the room’s AI agent, can query during an investigation. It speaks the Landfall Source Protocol over HTTP or gRPC, and Landfall connects to it by base URL.
- [MCP server](https://docs.landfalls.ai/integrations/mcp-server): Connect any MCP server you already run as a source Beacon, the room’s AI agent, can query during an investigation. Landfall offers only the tools the server marks read-only.
- [Kubernetes](https://docs.landfalls.ai/integrations/kubernetes): Install the Landfall Kubernetes agent with one Helm command. It dials out to Landfall, never needs to be reachable, and answers read-only questions only for incidents the cluster is part of.
- [MySQL](https://docs.landfalls.ai/integrations/mysql): Run the Landfall MySQL agent next to your databases with docker run or Helm. It reads schema changes, error spikes, statement digests, sessions and lock waits through a read-only user whose password stays with you, and it never reads a table row.
- [PagerDuty](https://docs.landfalls.ai/integrations/pagerduty): Connect PagerDuty with a read-only REST API token so the war room knows who is on call and, once you name an escalation policy, who comes next.
- [Native on-call](https://docs.landfalls.ai/integrations/native-oncall): Build on-call schedules with layers, restrictions and overrides, and escalation policies with steps and repeats, inside Landfall, then switch your organization to answer from them.
- [Opsgenie](https://docs.landfalls.ai/integrations/opsgenie): Save an Opsgenie API key (GenieKey) for Test connection and for optional writes that acknowledge or close a linked alert from the room, each approved by a person. Landfall reads no alerts or schedules from Opsgenie.
- [Slack](https://docs.landfalls.ai/integrations/slack): Post approved incident updates into a Slack channel, and optionally let people vote on a decision from Slack. Landfall never reads your workspace’s message history.
- [Microsoft Teams](https://docs.landfalls.ai/integrations/teams): Post approved incident updates into one Microsoft Teams channel through the webhook URL a Teams workflow gives you. Landfall never reads your Teams messages.
- [Telegram](https://docs.landfalls.ai/integrations/telegram): Post incident updates to a Telegram chat through a bot you create with @BotFather. Landfall never reads your message history.
- [Buzz](https://docs.landfalls.ai/integrations/buzz): Put a Landfall investigator in a Buzz channel from the persona pack or through Landfall Edge, and post incident updates and a canvas summary into one Buzz channel with an identity Landfall generates and keeps.
- [Voice room](https://docs.landfalls.ai/integrations/voice): Carry audio between the people in a war room through a LiveKit media server and, when recording is on, turn the recording into a transcript every agent reads, with a speech engine that speaks the OpenAI transcription API. Recording is off by default.
- [GitHub](https://docs.landfalls.ai/integrations/github): Install one platform-level GitHub App on your organization so Beacon, the room’s AI agent, can search code, read commits and pull requests, and trace an incident to the change that caused it.
- [Jira](https://docs.landfalls.ai/integrations/jira): Connect Jira with an API token so a person can turn an incident follow-up into a Jira ticket with one click, and the room can see how that ticket is going. Status flows from Jira to Landfall only.
- [Cortex XDR](https://docs.landfalls.ai/integrations/cortex-xdr): Connect Palo Alto Cortex XDR with a Standard API key and its key ID so Beacon, the room’s AI agent, can read your alerts and incidents during an investigation.
- [Manager connector](https://docs.landfalls.ai/integrations/manager-connector): Point Claude at your Landfall organization and ask in plain language what is burning now, what happened last month, and what is waiting on a decision, through a read-only remote MCP connector.
- [Architecture map](https://docs.landfalls.ai/integrations/architecture-map): Upload your own diagrams and docs. Landfall redacts them and reads them into a structured map of services, dependencies and external systems that every investigation starts with, and any admin can correct it.
- [Vendor Status Watch](https://docs.landfalls.ai/integrations/vendor-status-watch): Watch the published status feeds of Cloudflare, Datadog, GitHub and Stripe and match a disruption against your Architecture Map, naming the affected dependency rather than only the vendor.

## Triggering integrations

- [CloudWatch](https://docs.landfalls.ai/integrations/cloudwatch-alerts): Open a war room when a CloudWatch alarm goes into ALARM, forwarded through SNS and a small Lambda to Landfall’s trigger endpoint, with later alarms and the OK recovery recorded on the room it opened.
- [Coralogix](https://docs.landfalls.ai/triggering/coralogix): Open a Landfall incident the moment a Coralogix alert fires, through an outbound webhook on the shared trigger endpoint and ingest token.
- [Datadog](https://docs.landfalls.ai/triggering/datadog): Open a Landfall incident the moment a Datadog monitor alerts, with repeats and the recovery landing in the room the first alert opened.
- [PagerDuty](https://docs.landfalls.ai/triggering/pagerduty): Open a Landfall war room the moment a PagerDuty incident triggers, through a signed Webhooks v3 subscription, and record its escalations and resolution on that room.
- [Opsgenie](https://docs.landfalls.ai/triggering/opsgenie): Open a Landfall war room when an Opsgenie alert is created, through a Webhook integration that sends a per-organization secret header, and record Acknowledge and Close on that room.
- [GitHub](https://docs.landfalls.ai/triggering/github): Which GitHub events open a Landfall incident (code scanning, secret scanning and Dependabot alerts, and failed runs of workflows you mark deploy-critical), how to turn each one on, and how redeliveries are deduplicated.
- [Sentry](https://docs.landfalls.ai/triggering/sentry): Open a Landfall incident when a Sentry issue alert fires, through a relay you run that adds your organization’s ingest token and forwards Sentry’s webhook to the shared trigger endpoint.
- [Cortex XDR](https://docs.landfalls.ai/triggering/cortex-xdr): Open a Landfall incident, suggested as a security incident, from a Cortex XDR incident notification signed with HMAC-SHA256 on its own per-organization route. The route has not yet been tested against a live Cortex XDR delivery.
- [Alertmanager (shared setup)](https://docs.landfalls.ai/triggering/alertmanager): Issue a per-organization webhook secret and point Alertmanager at Landfall once. Every rule engine that delivers through Alertmanager (Prometheus, Loki, Grafana) reuses this exact setup.
- [Prometheus](https://docs.landfalls.ai/triggering/prometheus): Open a Landfall incident automatically the moment a Prometheus alerting rule fires, through the shared Alertmanager webhook.
- [Loki](https://docs.landfalls.ai/triggering/loki): Open a Landfall incident automatically the moment a log-pattern condition fires in Loki’s own bundled ruler, through the shared Alertmanager webhook.
- [Grafana](https://docs.landfalls.ai/triggering/grafana): Open a Landfall incident the moment a Grafana alert rule fires, through Alertmanager or through a webhook contact point that posts straight to Landfall.
- [Buzz](https://docs.landfalls.ai/triggering/buzz): Open a Landfall incident from a Buzz workflow, started by a reaction, a keyword or a manual run. The workflow calls Landfall with a per-organization secret, and each distinct message opens one incident.
- [Remote source](https://docs.landfalls.ai/triggering/remote-source): Open a Landfall incident from a service you host by posting the Source Protocol trigger payload to the shared trigger endpoint with your ingest token. The incident is attributed to the remote connection and deduplicated by your own key.
- [Vendor Status Watch](https://docs.landfalls.ai/triggering/vendor-status-watch): Open a Landfall incident when a vendor’s status page reports a disruption that touches your Architecture Map and that vendor’s watch is set to open incidents. Landfall’s own poll finds the match, so there is no webhook payload to configure.
- [Heartbeats](https://docs.landfalls.ai/triggering/heartbeats): Open a Landfall incident automatically when a registered heartbeat goes silent past its interval plus grace period. Landfall’s own 5-minute sweep detects it, so there is no webhook payload to configure.
- [MCP servers (not applicable)](https://docs.landfalls.ai/triggering/mcp-server): Why a connected MCP server is a read-only tool source that cannot open a Landfall incident, and where the provider behind it keeps its own triggering path.

## Architecture

- [Keeping stakeholders current](https://docs.landfalls.ai/architecture/stakeholders): The Comms tab (a templated draft a human approves, sent at most once, with a Sent view), the Postmortem tab (a fold of the timeline with the root cause from admitted findings only) and the manager connector for read-only questions from Claude.
- [Integrations architecture](https://docs.landfalls.ai/architecture/integrations): The one shared model behind every Landfall integration: the connector framework, dynamic agent access with no per-provider code, and the incident-triggering pipeline, with GitHub as the worked example.
- [Shared context](https://docs.landfalls.ai/architecture/shared-context): How a war room’s shared context works: what is staged (what a responder’s coding agent shares, and what a person proposes), the bar each kind of claim must meet, who votes (the people in the room; a coding agent casts no vote on a default install), the human override that always wins, who pulled the current picture, how an item is removed and how the agents that had it are told.
- [The war room chat](https://docs.landfalls.ai/architecture/war-room-chat): Who shares a room (people, Beacon, each responder’s coding agent, and the Company second brain as a source that never posts), how a message is read, the live run row, when Beacon replies, threads and reactions, unread and search, and the room’s settings.
- [What the investigation knows](https://docs.landfalls.ai/architecture/investigation-context): The six kinds of context a room can attach, what pinning an architecture component changes, the organization instructions document, runbook links read from the triggering alert, steering an investigation, and the memory loop.
- [Your terminal and the CLI](https://docs.landfalls.ai/architecture/investigator-terminal): What runs on an investigator’s machine: the landfall CLI as an MCP front end, the room daemon with one room per machine and a cursor per reader, the four lifecycle hooks, the status line, and the three moments at which a war room’s context can reach a coding agent.
- [Company second brain](https://docs.landfalls.ai/architecture/org-memory): How the Company second brain learns from every resolved incident with no accept step, why it believes what it does, and how it finds the past incidents that matter to a new one by fusing lexical and vector search into one ranking.
- [Automatic architecture mapping](https://docs.landfalls.ai/architecture/auto-mapping): What Landfall reads from a connected AWS account and GitHub installation to derive services, dependencies, and external dependencies with no uploaded document, what permissions improve it, and how a human reviews or corrects the result.
- [Data sources architecture](https://docs.landfalls.ai/architecture/data-sources): The one typed contract behind every telemetry source Landfall reads: kinds on every operation, the catalog every agent reads, canonical operations over native ones, raw payloads with source-owned shaping, the Source Protocol, and the per-organization marketplace.

## Reference

- [Canvas widgets](https://docs.landfalls.ai/reference/widgets): Every widget type the war-room canvas can render (stat, time series, table, log view, timeline, world map, code finding, events, graph), the time-window control, the status dot that says how fresh a card is, the card menu and info view, and how agents add widgets.
- [Source SDK](https://docs.landfalls.ai/reference/source-sdk): Write a telemetry source Landfall can read without a Landfall code change: the protocol endpoints, authentication, the response envelope, the reference server, the conformance suite, the trigger payload and versioning.
- [Heartbeats](https://docs.landfalls.ai/reference/heartbeats): Register a dead-man’s switch for any scheduled job outside Landfall and ping it at the end of each run. Covers the URL shape, the auth header, and what a silent heartbeat does.
- [landfall CLI](https://docs.landfalls.ai/cli): The short map of the open-source landfall CLI: install, login, connect, and the MCP Edge Bridge commands, with the landfalls-ai/landfall-cli README as the always-current reference.

## Legal

- [Privacy notice](https://docs.landfalls.ai/privacy): What Landfall collects, why, who else sees it, and how to have it deleted, written to describe what the product actually does today.