The Server Agent. On call, with discipline.

Generic LLMs can't do this.

What it actually does.

Real work the agent does end-to-end. Every step is auditable, every consent gate logged, every escalation routed to a named human.

1. 01

   Alert-storm collapse

   100+ alerts from one root failure become one incident with one owner.

   • Ingest alerts from Datadog, Prometheus, CloudWatch, and Sentry on a 30-second window.
   • Cluster by service-graph proximity, time correlation, and shared error fingerprint.
   • Suppress duplicates. Escalate the highest-signal alert as the parent.
   • Attach child alerts as evidence. Post a single incident to PagerDuty.
   • Notify the on-call via Slack with a one-screen summary.
   Permission tierRead-only.

   Human in the loopSuppression is reversible. Raw alerts stay in their source systems and surface on demand.
2. 02

   Root-cause hypothesis

   A ranked list of likely causes with confidence scores, citing logs, metrics, and the last deploy.

   • Pull traces, logs, and metrics for the affected service across a 60-minute window.
   • Cross-reference the last three deploys, recent config changes, and infrastructure events.
   • Generate three to five hypotheses ranked by Bayesian confidence.
   • Cite the specific log lines, span IDs, and commit SHAs supporting each.
   • Refuse to recommend action below 70% confidence. Flag for human triage.
   Permission tierRead-only.

   Human in the loopHypotheses are advisory text. No write path is reachable from this surface.
3. 03

   Runbook execution

   Runs a documented runbook step by step, pausing for approval at every state-changing action.

   • Match incident signature against the runbook library.
   • Surface the proposed runbook with diff preview of changes.
   • Execute read-only diagnostic steps automatically.
   • Block on Slack approval for any state-changing step (restart, scale, failover).
   • Log every step to the audit trail with operator identity and timestamp.
   Permission tierApproval required per step. Change windows enforced. Hard cap on blast radius.

   Human in the loopA named operator approves every state-changing step.
4. 04

   Incident timeline auto-generation

   A minute-by-minute timeline of what failed, what fired, who acted, and what changed.

   • Capture every alert, deploy, config change, and human action from t-60 to t+resolved.
   • Stitch into a chronological narrative with span and log citations.
   • Annotate with the on-call's Slack messages and approval decisions.
   • Render as markdown for ingestion into Jira, Linear, or Notion.
   • Hand off to the postmortem first-draft generator.
   Permission tierRead-only.

   Human in the loopOutput is text. No retroactive editing of source data.
5. 05

   Deploy correlation

   When error rates spike, the agent checks the last deploy first and shows you the diff.

   • Detect anomaly in error rate or latency on a service.
   • Query the last 24 hours of deploys touching that service or its dependencies.
   • Surface the suspect deploy with author, time, and changed files.
   • Compare current and previous version metrics side by side.
   • Propose rollback as an approval-gated action.
   Permission tierApproval required for rollback. Read-only for analysis.

   Human in the loopRollback requires explicit operator approval and runs the team's standard rollback path.
6. 06

   Intrusion-attempt triage

   SSH brute-force, anomalous API patterns, and suspicious lateral movement classified against MITRE ATT&CK and paged.

   • Watch auth logs, network flow, and process lineage for known intrusion patterns.
   • Classify against MITRE ATT&CK techniques (T1110, T1078, T1021, T1059).
   • Score severity using source reputation, target sensitivity, and pattern frequency.
   • Page security on-call via the security channel, not the SRE channel.
   • Forward enriched event to the SIEM (Splunk, Sentinel, Chronicle).
   Permission tierRead-only by default. Block-IP available as approval-required.

   Human in the loopIP blocks scoped to the affected segment, time-boxed to 60 minutes, security approval required.
7. 07

   On-call handoff brief

   The outgoing on-call's last 12 hours summarised in one screen for the incoming on-call.

   • Collect open incidents, recent alerts, deploy state, and active change windows.
   • Summarise unresolved issues with current hypotheses and owner.
   • Flag flaky services, recurring alerts, and the most-paged signals this week.
   • Highlight scheduled maintenance and embargo periods.
   • Deliver as a Slack DM and a printable PDF at shift change.
   Permission tierRead-only by construction.

   Human in the loopThe on-call still runs the shift. The agent makes the first 10 minutes easier.

Phase by phase.

The end-to-end path the agent runs. Every phase logs what it captured, what consent applies, and where a human gates the next step.

1. 01

   Detection

   Latency on the checkout service crosses 2x baseline. Three downstream alerts fire within 90 seconds.

2. 02

   Correlation

   Server Agent collapses 47 alerts into one incident, identifies checkout as the parent service, attaches the rest as evidence.

3. 03

   Hypothesis

   Three candidates ranked: deploy at 14:02 UTC 84%, DB connection pool saturation 41%, upstream rate limit 22%. Cites the suspect commit.

4. 04

   Page

   On-call gets a Slack ping and a PagerDuty page with the one-screen summary and the top hypothesis.

5. 05

   Triage

   Operator opens the diff. Agent runs read-only diagnostics: pool stats, slow query log, recent migration check.

6. 06

   Action

   Operator approves rollback. Agent executes the team's standard rollback runbook, pausing for the production confirmation.

7. 07

   Verification

   Error rate returns to baseline within 8 minutes. Agent confirms by watching the same signals that fired, then declares the incident mitigated.

8. 08

   Postmortem

   First draft posted in the incident channel within 10 minutes of resolution, with timeline, blast radius, contributing factors, and proposed action items.

The non-negotiables, spelled out.

Consent, security, accuracy, and residency. Explicit, auditable, and the same line items your CISO or GC already asks about.

What the numbers look like.

Figures we can point at. Every one carries a source you can verify.

What it replaces. What it augments.

What the Server Agent does

It watches your production fleet, correlates the signals, and pages you with the incident already triaged.

The numbers, up front.

Pricing scopes to fleet because the work scopes to fleet. A 200-host startup and a 40,000-host bank don't pay the same, and they shouldn't. We size by host count, signal volume, and the permission tiers you enable, then quote once. No per-seat tax, no per-incident gouging, no surprise overage at quarter-end.