Requirements

The cluster side

• A Kubernetes cluster and a Prometheus/Alertmanager stack that can POST to a webhook.
• prometheus-operator, because the chart ships its alert rules as PrometheusRule objects.
• PostgreSQL 17 with pgvector. The agent fails fast without it, on purpose — the invariant is no audit, no action, and an executor that cannot write an audit row must not act. The chart can install a single-replica Postgres for you (postgres.embedded.enabled=true), which is intended for evaluation rather than production.

There is deliberately no SQLite fallback. The schema is Postgres-locked at eight independent points — the vector extension, jsonb, GIN and HNSW indexes, a generated tsvector column, websearch_to_tsquery, the <=> distance operator, and role DDL. A second provider would mean a second schema that drifts, on the layer whose safety claim is "no audit, no action".

A model

Llm:Provider selects gemini or openai. The latter is the wire format rather than the vendor, so DeepSeek, OpenRouter, and a local Ollama or LM Studio server are all reached through it by setting Llm:Endpoint.

Two things about model choice that cost real time to learn:

• Ship a price with the model. Llm:Pricing maps a model id to a price. An unpriced model is charged at zero, which switches the cost budget off rather than approximating it.
• Not every provider can constrain output to a JSON schema. DeepSeek answers 400 "This response_format type is unavailable now". Because phase 1 is unaffected, the agent then diagnoses correctly and proposes nothing — which is indistinguishable, in a run summary, from an agent that considered acting and declined. Set Llm:PlanningStructuredOutput=JsonObject for such a provider.

Whether a model will propose a remediation at all varies enormously between models, and is measured: see the table in What it is.

Embeddings, optionally separate

Embeddings are configured separately from the chat model (Llm:EmbeddingProvider), so a fully self-hosted install can keep the semantic arm of search by pointing at any endpoint serving /v1/embeddings — which is what Ollama and vLLM already serve. No external account is required.

Without an embedding endpoint, search falls back to its lexical arm and says so. The generator degrades rather than throwing: a null vector is written and lexical plus trigram search still works.

Grafana, optionally

Grafana plus grafana-mcp is what gives the agent its PromQL, LogQL and trace tools. Without it the agent degrades to Kubernetes-only reads and says so in its logs. It will still investigate; it will simply have fewer instruments.

The agent hands the model eighteen of that server's tools, by name, and the names are those of mcp-grafana 2.0.1 (chart grafana-mcp 0.27.1), the version they were read from and tested with. Traces need a server that has Tempo tools of its own: search_tempo_traces, get_tempo_trace, list_tempo_attribute_names and list_tempo_attribute_values. The alert's rule is read with alerting_rules_read. An older server still works for metrics and logs; the tools it does not offer are not handed to the model, and the grafana-mcp row of /api/status reads Degraded and names each one - see troubleshooting.

grafana_api_request is not used. A server started with --disable-api loses nothing the agent needs.

What you do not need

No cluster at all, if you only want to look: see See it without a cluster.