ArgoCD requires a Growth or Enterprise plan. It’s visible in Settings → Environment → Integrations on Free and Starter, but won’t connect until you upgrade. See Pricing & tiers.
What this integration enables
- Deployment context — agents can read current application sync status, recent deployment history, and which image tags are deployed per service
- Change correlation — agents cross-reference recent ArgoCD sync events with incident timing during diagnosis to identify deployment-correlated failures
- Rollback actions — with explicit HITL approval, the resolution specialist can trigger an ArgoCD rollback to the previous healthy revision. Rollbacks are gated by Human-in-the-Loop by default. The only carve-outs that gate a batch unconditionally, regardless of control mode or org settings, are a P1/P2-severity incident and a recommendation that opens a GitOps fix PR — a rollback doesn’t carry a separate “always gates” rule of its own. If your org has enabled auto-approve in Self-Driving mode, a rollback on a P3/P4 incident — including one affecting production traffic — can be approved and executed automatically like any other pending recommendation, with no additional risk check. See HITL Gates for the full rule set.
Rollback durability
A runtime rollback is only a durable fix if your Application isn’t self-healing. If your ArgoCD Application hasselfHeal: true in its sync policy, ArgoCD reverts the manual rollback back to the committed manifest on its next reconcile — the rollback is ephemeral, not a lasting fix. When GitHub is also connected, sureops pairs the runtime rollback with a source-revert PR that reverts the offending commit in git; the durable fix lands once that PR merges and ArgoCD syncs it in.
If your Application also has automated sync enabled (syncPolicy.automated), ArgoCD refuses a manual sync-to-a-specific-revision outright — the runtime rollback becomes non-executable, not merely ephemeral. In that case, the source-revert PR is the only path to recovery.
Prerequisites
- An environment selected in the top-right context switcher — Settings → Environment → Integrations is scoped to that environment and stays disabled until one is selected
- A running ArgoCD instance
- Admin access to ArgoCD to generate an API token
- An MCP server exposing your ArgoCD API to sureops (self-hosted — sureops does not connect to ArgoCD’s API directly; see Setup below)
Integration connections are per-environment. Connecting ArgoCD here only applies to the environment that was selected in the context switcher at the time — it does not carry over to your other environments. Repeat this connect flow for each environment that needs ArgoCD.
Setup
sureops connects to ArgoCD through an MCP server you run — there’s no vendor-hosted ArgoCD MCP option, so this is the only connection path.1
Generate an API Token
In ArgoCD, go to Settings → Accounts and generate a new API token for a service account.The token needs read access to applications and, if you want rollback support, the ability to sync/rollback applications. Scope the token to the minimum permissions your policy allows. You’ll use this token to configure your ArgoCD MCP server in the next step — it isn’t entered directly into sureops.
2
Stand up an MCP server for ArgoCD
Deploy an MCP server that speaks to your ArgoCD API (e.g.
argocd-mcp), pointed at your ArgoCD Server URL and configured with the API token from step 1. If you’re using the sureops demo environment, this MCP server is already provisioned in-cluster — you can skip this step.3
Connect in sureops
In sureops, go to Settings → Environment → Integrations and click Connect next to ArgoCD.Fill in:
- MCP Server Endpoint — the URL of your running ArgoCD MCP server
- Authentication Method — Bearer Token, API Key, or Basic Auth, matching how your MCP server expects inbound requests to be authenticated
- Token — labeled Bearer Token, API Key, or Password depending on the method you selected above