{
  "name": "Fronterio — Slack incident capture",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "slack-incident-command",
        "options": {}
      },
      "id": "a2b4e61b-1111-4a00-bbbb-000000000001",
      "name": "Slack /incident command",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [240, 300],
      "webhookId": "slack-incident-command"
    },
    {
      "parameters": {
        "functionCode": "const text = $json.body.text || '';\nconst [severity, ...titleParts] = text.split(' ');\nconst validSeverity = ['low', 'medium', 'high', 'critical'].includes(severity) ? severity : 'medium';\nconst title = titleParts.length ? titleParts.join(' ') : 'Untitled incident (from Slack)';\nreturn [{\n  json: {\n    severity: validSeverity,\n    title,\n    reporter: $json.body.user_name,\n    channel: $json.body.channel_name,\n    rawText: text\n  }\n}];"
      },
      "id": "a2b4e61b-2222-4a00-bbbb-000000000002",
      "name": "Parse command",
      "type": "n8n-nodes-base.function",
      "typeVersion": 1,
      "position": [500, 300]
    },
    {
      "parameters": {
        "url": "https://fronterio.com/api/mcp/sse",
        "method": "POST",
        "sendHeaders": true,
        "headerParameters": {
          "parameters": [
            {
              "name": "Authorization",
              "value": "Bearer {{$credentials.fronterioApiKey}}"
            },
            {
              "name": "Content-Type",
              "value": "application/json"
            }
          ]
        },
        "sendBody": true,
        "jsonBody": "={\n  \"jsonrpc\": \"2.0\",\n  \"id\": 1,\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"report_incident\",\n    \"arguments\": {\n      \"agent_id\": \"{{$env.FRONTERIO_DEFAULT_AGENT_ID}}\",\n      \"severity\": \"{{$json.severity}}\",\n      \"title\": \"{{$json.title}}\",\n      \"description\": \"Reported via Slack /incident by {{$json.reporter}} in #{{$json.channel}}.\\n\\nRaw: {{$json.rawText}}\",\n      \"source\": \"slack_slash_command\"\n    }\n  }\n}",
        "options": {}
      },
      "id": "a2b4e61b-3333-4a00-bbbb-000000000003",
      "name": "Fronterio report_incident",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4,
      "position": [780, 300]
    },
    {
      "parameters": {
        "respondWith": "json",
        "responseBody": "={\n  \"response_type\": \"ephemeral\",\n  \"text\": \":white_check_mark: Incident logged in Fronterio. Incident ID: `{{$json.result.content[0].incident_id}}`. If this is classified as serious, the Article 73 deadline clock has started.\"\n}"
      },
      "id": "a2b4e61b-4444-4a00-bbbb-000000000004",
      "name": "Reply to Slack",
      "type": "n8n-nodes-base.respondToWebhook",
      "typeVersion": 1,
      "position": [1060, 300]
    }
  ],
  "connections": {
    "Slack /incident command": {
      "main": [[{ "node": "Parse command", "type": "main", "index": 0 }]]
    },
    "Parse command": {
      "main": [[{ "node": "Fronterio report_incident", "type": "main", "index": 0 }]]
    },
    "Fronterio report_incident": {
      "main": [[{ "node": "Reply to Slack", "type": "main", "index": 0 }]]
    }
  },
  "settings": {
    "executionOrder": "v1"
  },
  "meta": {
    "source": "fronterio.com/integrations/n8n",
    "description": "Listens for Slack /incident slash commands and posts them directly to Fronterio's report_incident MCP tool. Format: `/incident <severity> <title>` where severity is low|medium|high|critical. Serious incidents auto-start the EU AI Act Article 73 authority deadline clock. Point your Slack slash-command at the webhook URL and set FRONTERIO_DEFAULT_AGENT_ID in your n8n environment."
  }
}