Owner-level deduplication
Crash loops, image-pull backoffs, OOM kills, job failures, CPU throttling and pod-not-ready events collapse into one issue per owning workload, instead of one alert per pod per restart.
AI SRE · Runs in your cluster
The AI SRE that investigates like a senior engineer
Not another alert dashboard. NudgeBee's AI SRE plans an investigation, runs real diagnostic commands against your own stack, and returns a root cause with the evidence attached.
Self-hosted in your cluster · Zero telemetry · Bring your own model · Free forever tier
What is an AI SRE?
An AI SRE, or AI site reliability engineer, is an autonomous agent that investigates production incidents the way a senior engineer would: it queries your existing observability stack, correlates signals across services, and returns a root cause backed by cited evidence. NudgeBee's AI SRE runs inside your own cluster, reads freely, and asks for approval before it changes anything.
Cut MTTR, not your budget
Bring your own model across nine provider routes, zero markup, or run open-weight models on your own GPUs.
ParallelThe investigation is planned up front, then independent steps run at once. Faster root-cause analysis.
Low tokensGrounded by a knowledge graph and memory, with prompt caching and on-device embeddings.
Bring your own model across nine provider routes, zero markup, or run open-weight models on your own GPUs.
How an investigation actually runs
Four stages, every one of them inspectable in source.
-
Plan
A ReWOO planner reasons out the full multi-step investigation as a dependency graph before executing anything. Independent steps then run in parallel rather than one at a time.
-
Execute
Specialist sub-agents run real diagnostic commands through a credential-injected sandbox:
kubectl,helm,argocd, the AWS, Azure and gcloud CLIs, PromQL queries, log queries against Loki, Elasticsearch and SigNoz, trace queries against Jaeger, ClickHouse and Chronosphere, plus the full Datadog and New Relic APIs. NudgeBee runs 62 named specialist agents with 116 registered tools. A router agent classifies each query to the right domain agent. -
Correlate
Findings are resolved against a live topology knowledge graph, so the service that is failing is separated from the thing that actually broke. Causal correlation across real dependency edges, not time-window grouping.
-
Verify
Three quality gates before you see an answer. A plan critiquer reviews the investigation plan and can send it back up to three times. A failure-reflection step reasons about why a step failed and pivots instead of blindly retrying. A final-answer critiquer rejects symptom-only answers outright.
It correlates on a live topology graph, not a time window
NudgeBee keeps a live graph of your environment: services, workloads, nodes, config objects and cloud resources, with the real edges between them. When something breaks, it walks those edges to separate the service that is failing from the thing that actually broke.
In this map, checkout-api is only where the 503s surface. Following the CALLS edge reaches payment-gateway, and the IS_CONFIGURED_BY edge reaches a ConfigMap that changed at 14:02. That config change is the root cause, two hops from the symptom.
The graph carries 61 node types and 37 relationship types, built from four cloud and Kubernetes sources plus five runtime behavioural sources including eBPF and distributed trace spans. It is causal correlation across real dependency edges, not alerts grouped by the minute they fired.
It will not accept a symptom as a root cause
Most AI SRE tools stop at the first thing that looks wrong. NudgeBee is explicitly prevented from doing that. The following are rejected as root causes and cannot be returned as a final answer:
- An HTTP 404, 500 or 503
CrashLoopBackOff- "Resource Missing"
- A bare configuration value
Every answer must include a 5-Whys chain, and every link in that chain must carry a [Tool - ID] citation pointing back to the command output that supports it. The final answer also has to explain the literal symptom the engineer reported, not a related one.
It investigates freely. It changes nothing without you.
Two modes, drawn at the tool layer, not left to the model's judgement.
Reads
Investigates without asking
Read-only diagnostics run without asking, so the hunt for a root cause is never slowed by a prompt.
Writes
Gated behind your approval
Every create, update and delete is classified at the tool layer and gated behind explicit human approval.
No self-granted access
The agent is forbidden from modifying IAM or RBAC to grant itself access it lacks.
It does the work, not you
It never asks you to go and run commands yourself.
Untrusted by default
All tool output is treated as untrusted input, a deliberate prompt-injection defence.
Approvals arrive where the team already works:
Slack
Microsoft Teams
Google Chat- Signed link
It remembers your environment
Most AI incident tools start every investigation from zero. NudgeBee ships an event-sourced memory system with nine layers, spanning your team's preferences, the failure patterns it has already seen, the decisions made previously, and the policies it has to respect.
The effect compounds. An agent that has investigated your checkout service twenty times knows which alerts are noise, which dependency usually fails first, and what the team decided last time. Memory is scoped per tenant and stays inside your own deployment.
Nine layers of context
Disabled by default
Enabled per tenant
Free Community edition
From a log line to the exact commit
NudgeBee correlates a production log line or stack trace back to the exact source line, then to the git commit and its author, using ripgrep and git blame.
In fix mode it goes further. It designs the change and drives it all the way to a pull request you can merge, reworking against a build-verification gate if it has to.
- 1Design the change
- 2Apply it
- 3Build-verification gate
- 4Rework up to 3 times
- 5Open a ready-to-merge PR
The error location is frequently not where the fix belongs, so tracing continues to the boundary where the fault was actually introduced.
Nine specialist agents handle this, across GitHub and GitLab:
- Orchestrator
- Router
- Code
- ErrorRCA
- PerformanceDebugger
- SecurityAuditor
- CodeFixer
- CodeReview
- PRFollowup
Less noise before an investigation even starts
Owner-level deduplication and a 0 to 100 score cut alert fatigue, so on-call incident response starts on the signal that matters.
OOM detection
Triggers at 92% container and 95% node memory.
Scored and ranked
Every event gets a 0 to 100 score that accounts for severity, whether the environment is production, duplicate history, SLO impact, anomaly signals, restart counts and config changes. Scores map to P0 at 80 and above, P1 at 60, P2 at 40, P3 below that.
Time-based escalation
Around 70 named alert types auto-escalate based on how long they have persisted.
Written back to your pager
Root-cause analysis is written back onto the originating PagerDuty or ZenDuty incident automatically.
It works with your stack, it does not replace it
NudgeBee queries your existing observability backends in place, in their own native query languages. Metrics, logs and traces are not shipped out to a third party.
Prometheus
Grafana
VictoriaMetrics
Datadog
New Relic
Dynatrace
Splunk Observability
Chronosphere
Last9
Observe
Elasticsearch
Loki- SigNoz
Jaeger- Grafana Tempo
ClickHouse
OpenTelemetry
Azure App Insights
PagerDuty
ZenDuty
Jira
ServiceNow
GitHub
GitLab- Slack
- Microsoft Teams
- Google Chat
Discord
19 or more observability platforms, queried in native dialects including PromQL, LogQL, KQL, NRQL, Grail DQL, SignalFlow, OPAL and Elasticsearch DSL.
Browse all 78 integrationsRuns in your cluster. Nothing leaves.
Self-hosted
Runs inside your own Kubernetes cluster.
Zero telemetry
Nothing phones home.
Outbound only
The in-cluster agent dials out over a single WebSocket. No inbound ports, no exposed Kubernetes API server, no VPN.
Encrypted and signed
Credentials encrypted at rest with AES-256-GCM. Agent messages signed with Ed25519.
Air-gap ready
Embeddings can run fully on-device and the model can be self-hosted in your VPC, so air-gapped deployment is viable.
Readable source
Read the implementation, with a free Community edition.
See it under real incident load
AI-SRE case study
Top-10 e-commerce platform ends $180K/hr peak-season outages with agentic AI-SRE
3,000+ daily alerts correlated into actionable incidents, automated runbooks executed, and 61% of issues resolved without a human ever getting paged.
Read the case study
AI SRE FAQ
Frequently asked questions
For the engineer evaluating it and the security team signing it off.
Book a DemoAn AI SRE is an autonomous agent that investigates production incidents the way a site reliability engineer would. It queries observability data, runs diagnostic commands, correlates signals across services, and returns a root cause with supporting evidence, rather than simply alerting that something is wrong.
Traditional AIOps platforms cluster and correlate alerts to reduce noise. An AI SRE goes further: it actively investigates, running real diagnostic commands against your infrastructure and reasoning about the results, then produces a cited root cause and a proposed remediation instead of a ranked alert list.
Only with explicit approval. Read-only diagnostics run freely, but every create, update or delete is classified at the tool layer and gated behind human approval delivered in Slack, Teams, Google Chat or a signed link. Autonomous remediation is available for scheduled workflows with guardrails and dry-run.
No. NudgeBee queries your existing backends in place using their native query languages, across 19 or more platforms including Prometheus, Datadog, New Relic, Loki, Elasticsearch and Jaeger. Metrics, logs and traces stay where they are and are not shipped to a third party.
Whichever you choose. NudgeBee supports nine provider routes including AWS Bedrock, OpenAI, Azure OpenAI, Google AI, Vertex AI, SageMaker, HuggingFace and Anthropic. There is no model lock-in, and embeddings can run on-device for air-gapped environments.
Yes. NudgeBee is self-hosted in your own cluster with zero telemetry, the in-cluster agent connects outbound only, and embeddings can run fully on-device. You will need a model endpoint reachable from your environment, which can be a self-hosted or in-VPC model.
Yes. The full implementation is readable: the agent architecture, the prompts and the quality gates. You can self-host it in your own cluster and run it in production internally for free, on a free Community edition covering up to two clusters or cloud accounts.
With the memory module enabled, yes. It stores nine layers of context per tenant, covering recurring failure patterns, previous decisions, team preferences and policy constraints, so investigations improve as it sees more of your environment. All memory stays inside your own deployment.
Three planners. ReWOO builds a full dependency graph up front and runs independent steps in parallel. ReAct reasons one action at a time inside specialist sub-agents. A newer hybrid, available behind a feature flag, runs parallel actions while holding several candidate root causes open and testing them against evidence.
There is a free forever tier covering up to two clusters or cloud accounts, with no credit card required. Paid plans start at $2,000 per month for AI-SRE on 2 to 4 clusters. Full details are on the pricing page.
AI SRE is one of four assistants on the same platform
One platform, one knowledge graph. Add another assistant with no new install and no re-integration.
Free forever · No credit card
Point it at a real incident.
Free forever on up to 2 clusters. No credit card. Self-hosted, so nothing leaves your environment.