HephaistoAn SRE agent that shows its working

It receives Alertmanager webhooks, investigates with PromQL, LogQL and the Kubernetes API, writes a diagnosis citing the evidence it used — and acts only inside limits you set.

See a real investigation

Install it

What it actually does

Diagnosis is measured, not asserted

Against ten seeded chaos scenarios on a real cluster, the agent named the correct root cause in 8 of 10. The bar was stated in v0.1.0 and the denominator is published with the number.

How that was measured

It ships configured to act nowhere

An empty namespace allowlist, an empty auto-action list, and Observe mode. Three independent things you must change before anything can happen, and each one is a deliberate act in git.

The safety model

The model never holds a mutating tool

Investigate reads. Plan emits JSON with no tools at all. Execute is C# over a closed enum. A prompt injection in a log line can, at best, produce a plan the policy engine then rejects.

What the agent is told

Everything known broken is written down

The backlog is public, numbered and evidenced, including the entries that block claims this project would like to make. It is linked from the README on purpose.

The project record