• 

  2

• 

  4

• 

  3

• 

  1

• 

  5

Incident Intelligence Agent

From production incidents to evidence-backed root causes.

The Problem

When production systems fail, engineers often spend more time investigating the incident than fixing it. Relevant clues are scattered across logs, historical incidents, service documentation, and runbooks. Engineers must manually connect these signals, identify the underlying failure, and determine the safest next step.

This process is slow, repetitive, and heavily dependent on institutional knowledge. Every minute spent debugging can mean prolonged downtime, disrupted customers, and lost business.

What if an AI agent could investigate incidents the way an experienced SRE does—connecting evidence, learning from past failures, and explaining why a failure likely occurred?

Our Solution

Incident Intelligence Agent is an AI-powered DevOps/AIOps platform designed to accelerate incident investigation and root-cause analysis (RCA).

Instead of simply summarizing logs or generating generic troubleshooting advice, it combines agentic workflows with hybrid retrieval to investigate incidents using relevant historical evidence, technical documentation, and operational runbooks.

The goal is simple: help engineers move from “Something is broken” to “Here is the evidence, the likely root cause, and what to investigate next”—with less manual effort.

How It Works

• Agentic investigation: LangGraph orchestrates the investigation workflow, enabling the agent to gather relevant context and reason through the available evidence.
• Hybrid retrieval: Combines semantic vector search with PostgreSQL full-text search to retrieve relevant incidents and operational knowledge.
• Ranked evidence: Reciprocal Rank Fusion (RRF), recency-aware ranking, and fallback retrieval help surface useful context from multiple sources.
• Tool-enabled workflows: FastMCP exposes investigation tools that allow the agent to interact with its operational knowledge and supporting systems.
• Evidence-backed analysis: The system uses retrieved context to support its findings and provide traceable citations.
• LLM flexibility: LiteLLM provides an integration layer for supported language models.
• Evaluation and observability: RAGAS and Langfuse support retrieval-quality evaluation and tracing of AI workflows.

Built With

The backend uses FastAPI, LangGraph, FastMCP, PostgreSQL, and pgvector. The retrieval pipeline combines vector similarity, PostgreSQL full-text search, Reciprocal Rank Fusion, and recency-aware ranking. LiteLLM handles model integration, while Langfuse and RAGAS support observability and evaluation.

The frontend is built with Next.js, providing an interface for interacting with the incident investigation workflow.

Engineering Challenges

Retrieving the right evidence

A purely semantic search can miss exact error messages, service identifiers, and technical terms. Keyword search alone can miss incidents described in different language. Combining both approaches helps balance semantic similarity with exact-term matching.

Making AI investigations traceable

A plausible-sounding answer is not necessarily a correct diagnosis. The system is designed to ground its analysis in retrieved operational evidence, provide citations, and support evaluation rather than relying solely on an LLM's general knowledge.

Connecting agents to operational tools

An investigation workflow needs more than a single prompt. LangGraph structures the workflow, while FastMCP provides a tool integration layer, making the architecture easier to extend as additional data sources and capabilities are introduced.

Building toward production readiness

A useful prototype must also address database migrations, persistent knowledge, API reliability, model-provider configuration, deployment, and observability. These considerations shape the platform's architecture and its path toward real-world use.

What I Learned

Building this project strengthened my understanding of agentic AI, hybrid information retrieval, vector databases, tool calling, workflow orchestration, and LLM observability. More importantly, it reinforced a key engineering lesson: useful AI systems depend as much on evidence quality, system design, and evaluation as they do on the language model itself.

The Vision

Incident Intelligence Agent is being developed toward a broader vision: making incident investigation faster, more consistent, and less dependent on manually searching disconnected systems.

The long-term direction is to connect more operational signals, improve diagnostic confidence, evaluate recommendations against real incident outcomes, and help engineering teams resolve failures with greater speed and clarity.

Less time searching. Better evidence. Faster incident resolution.

Built With

• docker
• fastmcp
• langfuse
• langgraph
• litellm
• llm
• mcp
• python
• ragas