Description
When an alert fires at night, the on-call engineer flips between metrics, logs, traces and change records, finally finds a lead, and then writes "resolved" in the ticket. The next time the same failure happens, the investigation starts from scratch.
AegisOps chains inspection, alerting, investigation, ticketing and approval into one flow. Inspection rules detect anomalies and an agent explains them: it pins down the affected asset and time window, pulls metrics, logs, traces and changes as needed, lays out candidate causes with supporting and contradicting evidence plus what's still missing, and drafts a ticket with the raw evidence attached for a person to confirm and assign.
The agent only gathers evidence and makes suggestions within its permissions; it can't run shell commands or change systems. Real remediation needs approval, and business results are rechecked afterwards. The author publishes benchmarks: on 12 public failure cases with the same DeepSeek model, the optimized evidence strategy cut diagnosis time by 33.7% and tokens by 53.7%. The default demo mode runs without any model key.
Inspection and alerts: 8 built-in inspection rules on a schedule, with alert dedup and correlation; raw alerts are kept and correlations can be confirmed or split.
Agent investigation: LangGraph orchestrates, Deep Agents investigate, Skills load on demand, and evidence is read through read-only tools and MCP.
Evidence-backed tickets: fixed asset and time window, raw evidence stored with hashes, reports linked to evidence, and tickets with assignment, notes, attachments and review.
Reusing experience: runbooks filtered by org, system, environment and version, keyword and optional pgvector search, and reviewed cases and skills reused later.
Approval and recovery: approvals bound to parameters, version and expiry; checkpoints, leases and idempotent writes let interrupted tasks resume without duplicate tickets.
Controlled usage: caps on evidence rounds, model requests and tokens, with per-call usage, latency and failures recorded and progress streamed over SSE.
AegisOps chains inspection, alerting, investigation, ticketing and approval into one flow. Inspection rules detect anomalies and an agent explains them: it pins down the affected asset and time window, pulls metrics, logs, traces and changes as needed, lays out candidate causes with supporting and contradicting evidence plus what's still missing, and drafts a ticket with the raw evidence attached for a person to confirm and assign.
The agent only gathers evidence and makes suggestions within its permissions; it can't run shell commands or change systems. Real remediation needs approval, and business results are rechecked afterwards. The author publishes benchmarks: on 12 public failure cases with the same DeepSeek model, the optimized evidence strategy cut diagnosis time by 33.7% and tokens by 53.7%. The default demo mode runs without any model key.
Features
Inspection and alerts: 8 built-in inspection rules on a schedule, with alert dedup and correlation; raw alerts are kept and correlations can be confirmed or split.
Agent investigation: LangGraph orchestrates, Deep Agents investigate, Skills load on demand, and evidence is read through read-only tools and MCP.
Evidence-backed tickets: fixed asset and time window, raw evidence stored with hashes, reports linked to evidence, and tickets with assignment, notes, attachments and review.
Reusing experience: runbooks filtered by org, system, environment and version, keyword and optional pgvector search, and reviewed cases and skills reused later.
Approval and recovery: approvals bound to parameters, version and expiry; checkpoints, leases and idempotent writes let interrupted tasks resume without duplicate tickets.
Controlled usage: caps on evidence rounds, model requests and tokens, with per-call usage, latency and failures recorded and progress streamed over SSE.
