Incident intelligence, agent handoff, and content creation

DarkNOC South Africa

A demo-ready incident workbench where operators build a ticket package from map evidence, then hand the same grounded context to Codex, Claude, Cursor, Pilot, or content agents through clean MCP URLs.

Serverless
Serverless MCP route
Country model
One deployment per domain
Evidence flow
Ticket → MCP → artifact
Map tiles © OpenStreetMap contributors

Try The Live NOC

Open the incident map, create or select a ticket, draw the area, and collect evidence from overlays, wizards, panels, and raster picks.

Connect Admin MCP

Give Codex, Claude, Cursor, or Pilot a clean URL for package readiness, missing context, ticket exports, and operational handoff.

Connect Content MCP

Turn the populated ticket into grounded blogs, short clips, GIF-like guides, decks, press notes, and vendor demo scripts.

Capture Visual Proof

Use browser WebMCP to snapshot map moments, record guided clips, attach evidence, and preserve source/caveat metadata.

Demo protection: Vodacom is used only as a South Africa demo label. DarkNOC is not affiliated with, endorsed by, or representing Vodacom, Vodacom Group, Vodafone, or any mobile network operator. Demo outputs combine simulator state, local spatial files, and public/open sources; they are not operator-confidential records. Content must separate simulator output, public-source context, and agent interpretation.

Drive The Visible GUI

Agents can switch mode, open panels, toggle overlays, focus a point, and frame bounds before capture.

ui_switch_modeui_open_paneloverlay_set_visibilitymap_focus_locationmap_fit_bounds

Capture Map Evidence

Agents can take PNG snapshots, start/stop browser-approved WebM clips, and list recent visual moments.

map_capture_snapshotmap_record_guided_clip_startmap_record_guided_clip_stopmap_get_recent_visual_moments

Build GIF / Story Plans

Agents can produce a GIF-like frame plan, then use the content tools to turn ticket evidence into blogs, videos, decks, or demos.

story_prepare_gif_capture_planstory_prepare_artifact_manifestcontent_prepare_gif_sequence

Attach To Ticket

Visual moments and reports can be written back only through browser confirmation against the active ticket.

ticket_attach_map_snapshotticket_attach_visual_momentticket_attach_agent_report

One MCP Endpoint

Admin and content work use the same serverless MCP URL. The difference is the prompt or tool you call, not a different URL. This matches the deployed-project model: one country/domain, one endpoint, many workflows.

Local MCP endpoint
http://localhost:3001/api/mcp
Production MCP endpoint
https://sa.darknoc.net/api/mcp
Discovery manifest URL
http://localhost:3001/mcp.json

Operations MCP Workflow

Use the single project MCP URL for ticket package inspection, package readiness, missing context, simulator health, Pilot handoff, and normal NOC analysis.

Call these prompts
incident_context_auditagent_handoff_prompt
Useful tools
agent_validate_context_packageticket_get_missing_contextticket_get_packageagent_prepare_prompt
Where results appear

Prompt results come back to Codex, Claude, Cursor, or curl as result.messages[0].content.text. Tool calls return result.structuredContent.

Content / Story Workflow

Use the same MCP URL and the content prompts/tools for blogs, short videos, GIF-like clips, presentations, animations, press notes, vendor demos, and content packs grounded in a completed ticket.

Call these prompts
network_storyboard_promptenterprise_content_prompt
Useful tools
content_prepare_video_storyboardcontent_prepare_gif_sequencecontent_prepare_press_notecontent_validate_public_guardrails
Where results appear

Content prompt results return in the MCP client as a ready brief. Content tool calls return structured asset plans with storyboard moments, production notes, citations, and guardrail status.

Cursor Config

Put this in the project MCP config. The country/project is selected by the deployed domain and environment; no profile or deployment query string is needed.

.cursor/mcp.json
{
  "mcpServers": {
    "darknoc": {
      "url": "http://localhost:3001/api/mcp"
    }
  }
}

Where The Input Comes From

  1. 1. Create or select a ticket in the app. The ticket is the source of truth for incident, polygon/area, panel captures, raster picks, affected sites, notes, and agent reports.
  2. 2. Populate the ticket from the map. Collect coverage, demand/headroom, population, POIs, alarms, sites, remediation, and wizard outputs before asking content agents to write.
  3. 3. Give MCP the ticket context. Use ticket=... and incidentId=... for a specific case, or pass a context object in tool/prompt arguments. The market deployment is locked by the project/domain.
  4. 4. Use browser WebMCP for pixels. Serverless MCP can read structured ticket data; the live browser bridge captures map screenshots, short clips, raster-pick moments, and visual evidence.

First Prompt For Admin MCP

Paste into Codex / Claude / Cursor
Use the darknoc MCP.
Read darknoc://agent-workbench/workspace-guide and darknoc://agent-workbench/auth-policy.
Call agent_validate_context_package first.
If blocked, call ticket_get_missing_context and ticket_get_handoff_path.
Then call agent_prepare_prompt with targetAgent="codex" or "claude".
Use ticket_get_package as the source of truth. Do not invent missing panel/raster evidence.
Admin Prompt API Test
curl -X POST 'http://localhost:3001/api/mcp' \
  -H 'content-type: application/json' \
  -d '{
    "jsonrpc":"2.0",
    "id":1,
    "method":"prompts/get",
    "params":{
      "name":"incident_context_audit",
      "arguments":{
        "context":{"ticket":{"id":"tkt_demo","title":"Demo incident","workflowType":"incident_response","state":"building","contributionCount":5}}
      }
    }
  }'

Result path: result.messages[0].content.text

First Prompt For Content MCP

Paste into Codex / Claude / Cursor
Use the darknoc MCP.
Read darknoc://agent-workbench/content-mcp-guide and darknoc://agent-workbench/demo-policy.
Call enterprise_content_prompt or content_prepare_creation_brief.
Arguments: assetType="blog|video_clip|gif|presentation|animation|press_note|vendor_demo|content_pack", targetAudience, storyAngle.
Use the fully populated ticket package as source material.
For visual claims, use the live browser WebMCP tool story_prepare_artifact_manifest, then capture snapshots or short guided clips.
Include this disclaimer in public/demo output: Vodacom is used only as a South Africa demo label. DarkNOC is not affiliated with, endorsed by, or representing Vodacom, Vodacom Group, Vodafone, or any mobile network operator. Demo outputs combine simulator state, local spatial files, and public/open sources; they are not operator-confidential records.
Direct Content Prompt API Test
curl -X POST 'http://localhost:3001/api/mcp' \
  -H 'content-type: application/json' \
  -d '{
    "jsonrpc":"2.0",
    "id":1,
    "method":"prompts/get",
    "params":{
      "name":"enterprise_content_prompt",
      "arguments":{
        "targetAgent":"cursor",
        "assetType":"video_clip",
        "targetAudience":"vendor demo",
        "storyAngle":"show how the ticket evidence explains the incident and next actions"
      }
    }
  }'

Deployment Model

Treat each market as its own product deployment. The domain and env choose the country, operator label, data sources, disclaimer, and enabled deployment. The MCP URLs stay clean because the project already knows its market.

Deploy one project/domain per country.
Set NEXT_PUBLIC_DEFAULT_DEPLOYMENT and NEXT_PUBLIC_ENABLED_DEPLOYMENTS to that country.
Set NEXT_PUBLIC_HIDE_DEPLOYMENT_SWITCHER=true for demos.
Configure AGENT_WORKBENCH_MCP_TOKEN and AGENT_WORKBENCH_MCP_SESSION_SECRET for non-local use.
Attach object storage before enabling public screenshot/video exports.
Deployment readiness check
curl 'http://localhost:3001/api/mcp/deployment-readiness'

Productization Roadmap

Ready Now

Serverless MCP route with one clean URL and admin/content tool workflows.
Clean CIDX-style MCP URLs with country selected by deployment/project, not URL parameters.
Bearer-token and short-lived ticket-scoped session token support for HTTP MCP.
Deployment-readiness endpoint/resource for auth, country lock, CORS, public URL, and artifact storage checks.
Executable content-prep MCP tools for blogs, short clips, GIF sequences, decks, animations, press notes, vendor scripts, citations, and guardrails.
Cursor config, first prompts, content prompt, and direct JSON-RPC test blocks.
Browser WebMCP contract for GUI control, snapshots, guided clips, visual moments, and ticket evidence.
South Africa demo policy, public-source caveats, and no-affiliation disclaimer.
Production build path and static/route split verified.

Still To Finish

Production identity: connect user auth, tenant policy, role mapping, and organization-level access control.
Durable ticket and artifact store: persist ticket packages, snapshot metadata, WebM/GIF URLs, and agent reports outside browser memory.
Real media pipeline: object storage, upload URLs, thumbnail generation, and optional async rendering worker.
Agent execution bridge: direct Codex/Claude/Pilot run orchestration, status, cancellation, cost limits, and report attach flow.
Country deployment packaging: one project/domain per country with locked env, source manifest, operator label, and no country selector.
Public content workspace: review/publish queue for blogs, short videos, GIFs, decks, press notes, citations, and disclaimers.
Security hardening: rate limits, durable audit/revocation store, content approval gates, and prompt-injection guardrails.
End-to-end QA: desktop/mobile flows from ticket creation to MCP analysis to content artifact export.

Public And Open-Source Context

Statistics South Africa
Population, census, settlement, and demographic context for exposed communities.
Use publication date and geography level; avoid implying real-time population movement unless supplied by a live feed.
WorldPop / Humanitarian Data Exchange
Population rasters and density estimates for selected areas and impact envelopes.
Cell values are modeled estimates; report resolution and year when exporting.
OpenStreetMap / Geofabrik-style extracts
Roads, buildings, POIs, hospitals, schools, substations, and access routes.
Community-mapped coverage varies; flag sparse regions and stale extracts.
ICASA, ITU, and public ICT reports
Regulatory and market context for spectrum, coverage, subscriptions, and resilience claims.
These sources are contextual; do not present them as live operator telemetry.
South African Weather Service / WMO CAP feeds where licensed
Flood, severe-weather, fire-danger, and warning context around the incident.
Respect licensing and attribution; retain alert timestamps and severity labels.
DarkNOC simulators and local spatial folders
Coverage, demand, capacity, tickets, incidents, remediation, and visual evidence state.
Simulator output must be labeled as demo/simulated unless backed by an authenticated production feed.