AI-SRE · Persona Bee · Runs in your cluster

The AI SRE that investigates like a senior engineer

NudgeBee's AI-SRE plans the investigation, runs real diagnostics against your own stack and returns a root cause backed by evidence. Not another alert dashboard.

  • A cited root cause, never just a symptom
  • Real commands against the stack you already run
  • Reads freely; changes nothing without your approval
Book a Demo Start free
  • Self-hosted
  • Zero telemetry
  • Bring your own model
  • Free Community edition

Investigation · prod-shop

AK

payment-gateway pods keep restarting in prod-shop. Find the root cause.

Investigation plan 6 steps · 2 in parallel

  1. RResource Search workload, owners and recent events2.1 s
  2. KK8s API pod status and restart counts1.4 s
  3. LLogs container logs before each restartRunning
  4. PPrometheus memory working set vs limit, 6 hQueued
  5. GGitHub deploys and config changesQueued
  6. CCorrelate causality chain (5-Whys) to root causeQueued
E2 found: 3 pods OOMKilled, exit code 137 at the 512Mi limit

What is an AI SRE?

An autonomous agent that investigates production incidents the way a senior engineer would: it queries your observability stack, correlates signals across services and returns a root cause backed by cited evidence.

  • ParallelIndependent diagnostic steps run at once
  • Low token costKnowledge graph, memory, prompt caching and on-device embeddings
  • Any modelEleven provider routes at zero markup, or open-weight models on your GPUs
How it works

How an investigation runs

Four stages, each one inspectable in source.

  1. 01

    Plan

    Reasons against live evidence

    • Works step by step against what it finds
    • Batches independent steps to run in parallel
    • Keeps several candidate causes open
  2. 02

    Execute

    Runs real commands

    • 62 specialist agents, 116 registered tools
    • A credential-injected sandbox
    • A router sends each query to the right agent
  3. 03

    Correlate

    Walks the dependency graph

    • Resolves findings on a live topology graph
    • Separates what is failing from what broke
    • Real dependency edges, not time windows
  4. 04

    Verify

    Three quality gates

    • A plan critic can send the plan back, up to 3 times
    • Failure reflection pivots instead of blindly retrying
    • A final critic rejects symptom-only answers

Runs

  • kubectl
  • helm
  • argocd
  • AWS · Azure · gcloud CLIs
  • PromQL
  • Loki
  • Elasticsearch
  • SigNoz
  • Jaeger
  • ClickHouse
  • Chronosphere
  • Datadog API
  • New Relic API
Root cause

It finds what broke, not where it hurts

Where the alert fires is rarely the cause. NudgeBee walks the real dependencies, then has to defend its answer step by step.

Correlates on a live topology graph

Not alerts grouped by the minute they fired

Two hops from the symptom

  • 61node types
  • 37relationship types
  • 9sources, incl. eBPF and trace spans

Every answer is a cited 5-Whys chain

Each link points to the command output behind it

  1. Symptom

    checkout-api returns 503 on ~8% of requests

    Alerts · E1
  2. Why

    Its upstream payment-gateway has 0/3 ready replicas

    K8s API · E2
  3. Why

    The containers are OOMKilled at the 512Mi limit

    K8s API · E3Logs · E4
  4. Why

    Heap fills in ~11 min; the idempotency cache never evicts

    Prometheus · E5Logs · E6
  5. Root cause

    Release v2.41.0 set IDEMPOTENCY_CACHE_TTL to 0

    GitHub · E7Config · E8

Never accepted as a root cause

  • An HTTP 404, 500 or 503
  • CrashLoopBackOff
  • “Resource Missing”
  • A bare configuration value
Compare RCA tools
Guardrails

It investigates freely. It changes nothing without you.

Two modes, drawn at the tool layer, not left to the model’s judgment.

Reads

Runs without asking

  • Read-only diagnostics need no approval
  • The hunt for a root cause never waits on a prompt
Writes

Gated behind your approval

  • Every create, update and delete is classified
  • Blast radius scored from the live dependency graph
  • Only what is safe auto-applies; the rest waits for you
  • No self-granted accessCannot change IAM or RBAC to give itself access
  • It does the work, not youNever asks you to go and run commands
  • Untrusted by defaultAll tool output is treated as untrusted input

Approvals arrive in

  • SlackSlack
  • Microsoft TeamsMicrosoft Teams
  • Google ChatGoogle Chat
  • Signed link
Then it runs the fix as approval-gated runbook automation
Code and memory

It traces faults into your code. It remembers your environment.

From a log line to a ready-to-merge pull request, with memory that compounds across investigations.

From a log line to the exact commit

With ripgrep and git blame, across GitHub and GitLab

  • Log line or stack trace to the exact source line
  • Then to the commit and its author
  • On to where the fault was introduced, not where it surfaced

In fix mode

  1. Design the change
  2. Apply it
  3. Build gate
  4. Rework, up to 3×
  5. Ready-to-merge PR

GitHubGitLab9 specialist agents

  • Orchestrator
  • Router
  • Code
  • ErrorRCA
  • PerformanceDebugger
  • SecurityAuditor
  • CodeFixer
  • CodeReview
  • PRFollowup

It remembers your environment

Event-sourced memory with nine layers of context

  • Knows which alerts are noise
  • Knows which dependency usually fails first
  • Recalls what the team decided last time

What it keeps

  • Team preferences
  • Failure patterns
  • Previous decisions
  • Policies
  • Scoped per tenant
  • Stays in your deployment
  • Off by default, enabled per tenant
  • In the free Community edition
Signal

Less noise before an investigation starts

On-call starts on the signal that matters, not on a wall of duplicate alerts.

Every event scored 0 to 100

Then ranked into a priority

  1. P080+
  2. P160+
  3. P240+
  4. P3<40

The score weighs

  • Severity
  • Production or not
  • Duplicate history
  • SLO impact
  • Anomaly signals
  • Restart counts
  • Config changes
  • Owner-level deduplicationCrash loops, OOM kills, image-pull backoffs, job failures, CPU throttling and not-ready pods become one issue per workload, not one alert per pod
  • OOM detectionFires at 92% container and 95% node memory
  • Time-based escalationAbout 70 named alert types escalate the longer they persist
  • Written back to your pagerRoot cause lands on the originating PagerDuty or ZenDuty incident
Integrations

Works with your stack. Doesn’t replace it.

It queries your backends in place, in their own query languages. Metrics, logs and traces are never shipped to a third party.

Metrics and APM

  • PrometheusPrometheus
  • GrafanaGrafana
  • VictoriaMetricsVictoriaMetrics
  • DatadogDatadog
  • New Relic
  • DynatraceDynatrace
  • Splunk ObservabilitySplunk Observability
  • ChronosphereChronosphere
  • Last9Last9
  • ObserveObserve

Logs and traces

  • ElasticsearchElasticsearch
  • LokiLoki
  • SigNoz
  • JaegerJaeger
  • Grafana TempoGrafana Tempo
  • ClickHouseClickHouse
  • OpenTelemetryOpenTelemetry
  • Azure App InsightsAzure App Insights

Incidents and code

  • PagerDuty
  • ZenDutyZenDuty
  • JiraJira
  • ServiceNowServiceNow
  • GitHubGitHub
  • GitLabGitLab

Chat

  • SlackSlack
  • Microsoft TeamsMicrosoft Teams
  • Google ChatGoogle Chat
  • DiscordDiscord

19+ platforms in native dialects

  • PromQL
  • LogQL
  • KQL
  • NRQL
  • Grail DQL
  • SignalFlow
  • OPAL
  • Elasticsearch DSL
Browse all 78 integrations
Evaluating an AI SRE

The three questions worth asking

Feature lists converge fast. What separates AI SRE tools is where they run, what they read and what they are allowed to change.

Where does it run?

In your cluster. Nothing leaves.

  • Self-hosted in your own Kubernetes cluster
  • Zero telemetry; nothing phones home
  • Outbound-only WebSocket: no inbound ports, no VPN
  • AES-256-GCM at rest, Ed25519-signed messages
  • Air-gap ready, with on-device embeddings

What does it read?

Your backends, in place.

  • 19+ observability platforms, in their own languages
  • Metrics, logs and traces stay where they are
  • Secrets scanned before any model call, then redacted or blocked
  • Your model, across eleven provider routes
  • Readable source, with a free Community edition

What can it change?

Nothing without you.

  • Every write classified at the tool layer
  • Approval in Slack, Teams, Google Chat or a signed link
  • An audit trail of who signed off on every change
  • No way to grant itself IAM or RBAC access
Proof

Proven under real incident load

“Multicloud complexity does not slow down when your team does. NudgeBee’s SRE and AIOps agents absorb routine operations autonomously so our teams focus on high-value engineering.”
Nirmal RanganathanCTO, Global Public Cloud, Rackspace

AI-SRE case study · Top-10 e-commerce platform

Peak-season outages ended with agentic AI-SRE

  • $180K/hrpeak-season outages, ended
  • 3,000+daily alerts correlated into actionable incidents
  • 61%of issues resolved without paging a human
Read the case study
AI SRE FAQ

Frequently asked questions

For the engineer evaluating it and the security team signing it off.

Book a Demo
An AI SRE is an autonomous agent that investigates production incidents the way a site reliability engineer would. It queries observability data, runs diagnostic commands, correlates signals across services and returns a root cause with supporting evidence, rather than simply alerting that something is wrong. For a look at the tools in this category and how they cut recovery time, see the best AI SRE tools for reducing MTTR.
Traditional AIOps platforms cluster and correlate alerts to reduce noise. An AI SRE goes further: it actively investigates, running real diagnostic commands against your infrastructure and reasoning about the results, then produces a cited root cause and a proposed remediation instead of a ranked alert list. For a broader category overview, see our comparison of the 12 best AI SRE tools.
A single tool usually covers one slice of the job, such as correlating alerts or putting a chat window over dashboards. An AI SRE platform covers the loop: investigation to a cited root cause, code-level analysis driven to a pull request and one knowledge graph shared with Kubernetes operations, FinOps and CloudOps. NudgeBee is the second kind, so adding another Persona Bee needs no new install and no re-integration.
Only with explicit approval. Read-only diagnostics run freely, but every create, update or delete is classified at the tool layer and gated behind human approval delivered in Slack, Teams, Google Chat or a signed link. Autonomous remediation is available for scheduled workflows with guardrails and dry-run.
No. NudgeBee queries your existing backends in place using their native query languages, across 19 or more platforms including Prometheus, Datadog, New Relic, Loki, Elasticsearch and Jaeger. Metrics, logs and traces stay where they are and are not shipped to a third party.
Whichever you choose. NudgeBee supports eleven provider routes including AWS Bedrock, OpenAI, Azure OpenAI, Google AI, Vertex AI, SageMaker, HuggingFace, Anthropic, Ollama and vLLM. There is no model lock-in, and embeddings can run on-device for air-gapped environments.
Yes. NudgeBee is self-hosted in your own cluster with zero telemetry, the in-cluster agent connects outbound only and embeddings can run fully on-device. You will need a model endpoint reachable from your environment, which can be a self-hosted or in-VPC model.
Yes. The full implementation is readable: the agent architecture, the prompts and the quality gates. You can self-host it in your own cluster and run it in production internally for free, at any scale. The 2 cluster or cloud account limit applies to the hosted Cloud SaaS free tier.
With the memory module enabled, yes. It stores nine layers of context per tenant, covering recurring failure patterns, previous decisions, team preferences and policy constraints, so investigations improve as it sees more of your environment. All memory stays inside your own deployment.
One planner, ReAct3. It reasons step by step against live evidence, batches independent diagnostic actions so they run in parallel and holds several candidate root causes open, testing each against the evidence as it arrives.
AI-SRE is included in every NudgeBee edition, alongside the other Persona Bees. The Community edition is free: you self-host it with no cluster limit. On the hosted Cloud SaaS there is a free forever tier covering up to two clusters or cloud accounts, with no credit card required. Enterprise Support starts at $500 a month, billed annually and priced by environments and clusters, and Enterprise Platinum is priced on environments, clusters and accounts. Full details are on the pricing page.
Persona Bees

One platform, five Persona Bees

Each Persona Bee is a group of Task Bees and inherits their limits. Add another with no new install and no re-integration.

Point it at a real incident.

  • Self-host at any scale
  • Nothing leaves your environment
  • No credit card
Start free Book a demo Read the source on GitHub