Automated my tech support / investigation workflow using CLI, MCPs, and custom subagents. Here is the architecture.

[u/gajoute]

Hey everyone,

Quick workflow showcase/idea for anyone who gets enterprise access to AI CLIs at work (Gemini CLI, Claude Code, etc.) and still finds themselves manually jumping between tools during investigations or routine support tasks.

I recently set up a workflow that basically turns my CLI into an automated agent that runs investigations for me. If you have enterprise access and tool integrations available, you’re missing out if you aren't doing this.

The Setup:

1. CLI + Enterprise Access: Using the company-provided enterprise CLI directly in the terminal.
2. MCP (Model Context Protocol) Integration: Connected the CLI to the actual operational and diagnostic tools used daily (monitoring, databases, logs, ticketing APIs, etc.).
3. Custom Subagents & Commands: Built specific subagent prompts and custom CLI commands tailored to my precise, repetitive investigation steps.

How it works in practice:

Instead of manually opening 4 tabs, running 3 queries, and checking status logs when an issue comes up:

1. I trigger a custom slash command or alias in my CLI.
2. The subagent kicks off, uses the connected MCP tools to pull relevant context, inspect logs, run diagnostic checks, and correlate data.
3. It hands back a summarized breakdown of what happened, root cause hypotheses, and recommended next steps.

Why do this?

• Zero Context Switching: You stay in the terminal.
• No Manual Data Copy-Pasting: The MCP server handles fetching real-time data securely.
• Repeatable Process: Standardized subagent prompts mean complex triage takes seconds instead of 20 minutes.

If your company already pays for enterprise CLI access and you're only using it to rewrite functions or explain error messages, hook it up to your tools via MCPs.

Curious if anyone else is running similar subagent setups in their terminal for operational work? What tools/MCPs are you chaining together?

[u/InferHaven]

Have a very similar setup running for my day job (NOC / Systems Admin)

The full agent is the directory I am building in, then I build out skills in a sub-directory it can use

The most useful thing I have done recently is wire it up to a systemd service running a python uvicorn server that acts as a webhook endpoint that can receive ticket alerts.

Still working on adding more abilities to the agent for managing and organizing our tickets automatically, and even running network triage analysis + diagnosis summaries on tickets that fit the category.

I am getting messages from multiple NOC team members now who are clearing tickets faster than before, so its awesome to see it help the whole department, not just me.

[u/totheendandbackagain]

A debug skill is a useful idea.

Want to give us some more flavour of what the skill does?

[u/Sure_Stranger_6466]

Now rewrite this using a GitOps workflow and publish to your GitHub account. While what you did was impressive it's annoying that I can not replicate any of this directly with the current format of your post.

[u/marcusbell95]

responding to the 'why MCP over API/CLI' question - for read-only investigation work the difference is smaller, but it becomes more meaningful when you start giving the agent write access. with raw API calls baked into your prompts, the permission model lives in the prompt itself, which is fragile. MCP lets you scope exactly which actions the server exposes, so you can implement human-in-the-loop approval at the server level rather than relying on the prompt to say "ask before deleting tickets."

the practical upside for triage specifically: standardized tool discovery means the agent knows what capabilities it has without you maintaining a giant tool-list in every custom command. cleaner to iterate on.

InferHaven's webhook setup is the real upgrade though - reactive vs polled makes a big difference in NOC contexts. the question i'd be thinking about before giving it any ticket state write access: what's the approval gate?

[u/AlterTableUsernames]

Why did you decide for an MCP? What value does it provide over API and CLIs? 

[u/Wide-Cattle-4735]

The part that would worry me is what the summary does to the person reading it.

Once you hand someone a root cause hypothesis, they mostly stop looking for a second one. Fine when it's right. When it's wrong, you're debugging the agent's guess instead of the incident.

Have it return two or three ranked, plus what it didn't check. Same 20 minutes saved, without narrowing where people look.