Incident intelligence, agent handoff, and content creation

DarkNOC Vodacom demo

A demo-ready incident workbench where operators build a ticket package from map evidence, then hand the same grounded context to Codex, Claude, Cursor, Pilot, or content agents through clean MCP URLs.

Explore MapExplore Live Incident MapTicket · area · evidenceCreate a ticket, draw an area, collect evidence Copy MCP Setup What Is Left

Serverless

Serverless MCP route

Country model

One deployment per domain

Evidence flow

Ticket → MCP → artifact

Map tiles © OpenStreetMap contributors

Try The Live NOC

Open the incident map, create or select a ticket, draw the area, and collect evidence from overlays, wizards, panels, and raster picks.

Connect Admin MCP

Give Codex, Claude, Cursor, or Pilot a clean URL for package readiness, missing context, ticket exports, and operational handoff.

Capture Visual Proof

Use browser WebMCP to snapshot map moments, record guided clips, attach evidence, and preserve source/caveat metadata.

Demo data noticeshow

Vodacom South Africa is used only as a South Africa demo label. DarkNOC is not affiliated with, endorsed by, or representing Vodacom South Africa or any mobile network operator. This demonstration uses publicly available and crowdsourced radio site information, including OpenCelliD, together with synthetic operational data generated for demonstration purposes. No operator-confidential, customer-confidential, or employer-confidential data is used. Content must separate simulator output, public-source context, and agent interpretation.

Interactive incident storyVodacom demo Incident Evidence WalkthroughOpen the actual deployed Incident Twin for this operator and continue with live map, raster, incident, and panel components.Open Incident Twin

Drive The Visible GUI

Agents can switch mode, open panels, toggle overlays, focus a point, and frame bounds before capture.

ui_switch_modeui_open_paneloverlay_set_visibilitymap_focus_locationmap_fit_bounds

Capture Map Evidence

Agents can take PNG snapshots, start/stop browser-approved WebM clips, and list recent visual moments.

map_capture_snapshotmap_record_guided_clip_startmap_record_guided_clip_stopmap_get_recent_visual_moments

Build GIF Capture Plans

Agents can produce a GIF-like frame plan from browser-captured visual moments.

story_prepare_gif_capture_plan

Attach To Ticket

Visual moments and reports can be written back only through browser confirmation against the active ticket.

ticket_attach_map_snapshotticket_attach_visual_momentticket_attach_agent_report

One MCP Endpoint

Admin and content work use the same serverless MCP URL. The difference is the prompt or tool you call, not a different URL. This matches the deployed-project model: one country/domain, one endpoint, many workflows.

Local MCP endpoint

http://localhost:3001/api/mcp

Production MCP endpoint

https://za.darknoc.net/api/mcp

Discovery manifest URL

http://localhost:3001/mcp.json

Operations MCP Workflow

Use the single project MCP URL for ticket package inspection, package readiness, missing context, simulator health, Pilot handoff, and normal NOC analysis.

Call these prompts

incident_context_auditagent_handoff_prompt

Useful tools

agent_validate_context_packageticket_get_missing_contextticket_get_packageagent_prepare_prompt

Where results appear

Prompt results come back to Codex, Claude, Cursor, or curl as result.messages[0].content.text. Tool calls return result.structuredContent.

Network Storytelling Workflow

Use the same MCP URL and network_storyboard_prompt for evidence-backed public/demo stories with map snapshots, guided clips, and no-affiliation caveats grounded in a completed ticket.

Call these prompts

network_storyboard_prompt

Useful tools

story_prepare_artifact_manifestmap_capture_snapshotstory_export_html_package

Where results appear

Prompt results return in the MCP client as a ready storyboard. story_export_html_package returns a self-contained HTML story package.

Cursor Config

Put this in the project MCP config. The country/project is selected by the deployed domain and environment; no profile or deployment query string is needed.

.cursor/mcp.json

{
  "mcpServers": {
    "darknoc": {
      "url": "http://localhost:3001/api/mcp"
    }
  }
}

Where The Input Comes From

1. Create or select a ticket in the app. The ticket is the source of truth for incident, polygon/area, panel captures, raster picks, affected sites, notes, and agent reports.
2. Populate the ticket from the map. Collect coverage, demand/headroom, population, POIs, alarms, sites, remediation, and wizard outputs before asking content agents to write.
3. Give MCP the ticket context. Use ticket=... and incidentId=... for a specific case, or pass a context object in tool/prompt arguments. The market deployment is locked by the project/domain.
4. Use browser WebMCP for pixels. Serverless MCP can read structured ticket data; the live browser bridge captures map screenshots, short clips, raster-pick moments, and visual evidence.

First Prompt For Admin MCP

Paste into Codex / Claude / Cursor

Use the darknoc MCP.
Read darknoc://agent-workbench/workspace-guide and darknoc://agent-workbench/auth-policy.
Call agent_validate_context_package first.
If blocked, call ticket_get_missing_context and ticket_get_handoff_path.
Then call agent_prepare_prompt with targetAgent="codex" or "claude".
Use ticket_get_package as the source of truth. Do not invent missing panel/raster evidence.

Admin Prompt API Test

curl -X POST 'http://localhost:3001/api/mcp' \
  -H 'content-type: application/json' \
  -d '{
    "jsonrpc":"2.0",
    "id":1,
    "method":"prompts/get",
    "params":{
      "name":"incident_context_audit",
      "arguments":{
        "context":{"ticket":{"id":"tkt_demo","title":"Demo incident","workflowType":"incident_response","state":"building","contributionCount":5}}
      }
    }
  }'

Result path: result.messages[0].content.text

Deployment Model

Treat each market as its own product deployment. The domain and env choose the country, operator label, data sources, disclaimer, and enabled deployment. The MCP URLs stay clean because the project already knows its market.

Deploy one project/domain per country.

Set NEXT_PUBLIC_DEFAULT_DEPLOYMENT and NEXT_PUBLIC_ENABLED_DEPLOYMENTS to that country.

Set NEXT_PUBLIC_HIDE_DEPLOYMENT_SWITCHER=true for demos.

Configure AGENT_WORKBENCH_MCP_TOKEN and AGENT_WORKBENCH_MCP_SESSION_SECRET for non-local use.

Configure the public Supabase URL/key plus production and localhost Auth redirect URLs.

Attach object storage before enabling public screenshot/video exports.

Deployment readiness check

curl 'http://localhost:3001/api/mcp/deployment-readiness'

Productization Roadmap

Ready Now

Serverless MCP route with one clean URL and admin tool workflows.

Clean CIDX-style MCP URLs with country selected by deployment/project, not URL parameters.

Bearer-token and short-lived ticket-scoped session token support for HTTP MCP.

Deployment-readiness endpoint/resource for auth, country lock, CORS, public URL, and artifact storage checks.

Cursor config, first prompts, and direct JSON-RPC test blocks.

Browser WebMCP contract for GUI control, snapshots, guided clips, visual moments, and ticket evidence.

Supabase product accounts with registration, existing-user login, recovery, sign-out, and RLS-ready session identity.

Active-market demo policy, public-source caveats, and no-affiliation disclaimer.

Production build path and static/route split verified.

Still To Finish

Enterprise authorization: map authenticated users to tenants, roles, and organization-level access policy.

Durable ticket and artifact store: persist ticket packages, snapshot metadata, WebM/GIF URLs, and agent reports outside browser memory.

Real media pipeline: object storage, upload URLs, thumbnail generation, and optional async rendering worker.

Agent execution bridge: direct Codex/Claude/Pilot run orchestration, status, cancellation, cost limits, and report attach flow.

Country deployment packaging: one project/domain per country with locked env, source manifest, operator label, and no country selector.

Security hardening: rate limits, durable audit/revocation store, and prompt-injection guardrails.

End-to-end QA: desktop/mobile flows from ticket creation to MCP analysis to evidence export.

Public And Open-Source Context

Statistics South Africa

Population, census, settlement, and demographic context for exposed communities.

Use publication date and geography level; avoid implying real-time population movement unless supplied by a live feed.

WorldPop / Humanitarian Data Exchange

Population rasters and density estimates for selected areas and impact envelopes.

Cell values are modeled estimates; report resolution and year when exporting.

OpenStreetMap / Geofabrik-style extracts

Roads, buildings, POIs, hospitals, schools, substations, and access routes.

Community-mapped coverage varies; flag sparse regions and stale extracts.

OpenCelliD and crowdsourced radio site catalogs

Public and crowdsourced radio site reference points for demo coverage, site proximity, and spatial context.

Coverage and freshness vary; use as public demo context, not authenticated operator telemetry.

ICASA, ITU, and public ICT reports

Regulatory and market context for spectrum, coverage, subscriptions, and resilience claims.

These sources are contextual; do not present them as live operator telemetry.

South African Weather Service / WMO CAP feeds where licensed

Flood, severe-weather, fire-danger, and warning context around the incident.

Respect licensing and attribution; retain alert timestamps and severity labels.

DarkNOC simulators and local spatial folders

Coverage, demand, capacity, tickets, incidents, remediation, and visual evidence state.

Simulator output must be labeled as demo/simulated unless backed by an authenticated production feed.