n8n Incident Auto-Response: Claude, Cursor, ClickUp & WhatsApp

Turn monitoring alerts into automated incident handling—with Claude root-cause analysis, Cursor fixes, ClickUp tracking, and WhatsApp escalation

This n8n workflow receives monitoring webhooks, creates and updates an incident in ClickUp, uses Anthropic Claude to generate structured root-cause analysis, and—when safe—triggers a Cursor background agent to implement and deploy a fix. If auto-remediation isn’t appropriate, it escalates to your on-call contact via WhatsApp.

What this workflow does

• Ingests alerts from your monitoring system through a POST webhook, extracting service, severity, and an error signature for tracking and deduplication.
• Deduplicates flapping incidents using stored execution state, scores severity, and checks whether the service is eligible for unsupervised remediation.
• Creates a ClickUp incident task with normalized alert details, then waits briefly to debounce recurring alerts.
• Runs root-cause analysis with Claude, producing a structured output including confidence, risk level, and fix instructions.
• Auto-remediates or escalates: if the service is allowlisted and the analysis meets confidence/risk thresholds, it proceeds; otherwise it prepares an escalation report.
• Applies a safety window, then triggers a Cursor background agent to open a PR, run tests, and—when configured—auto-merge/deploy.
• Finalizes and notifies by updating the ClickUp incident with the outcome and sending the resolved/escalated result to on-call via WhatsApp.

Use cases

• Automatically triage production alerts by linking incidents to ClickUp tasks and rich Claude analysis.
• Safely apply fast fixes for known/allowlisted services using Cursor to implement and validate code changes.
• Escalate uncertain or high-risk incidents to on-call immediately with a WhatsApp summary.

Technical details

• Integrations / nodes: webhook, if, code, wait, merge, ClickUp, and Claude/Cursor actions.
• Required credentials: ClickUp, Anthropic (HTTP header auth), and Cursor (HTTP header auth).