Rootline

• 

• 

• 

Inspiration

Data incidents are rarely difficult because the fix itself is complicated. They are difficult because finding the cause requires engineers to connect information scattered across schemas, pipelines, lineage, dashboards, queries, and ownership records.

We wanted to explore a simple question:

What if an AI agent could investigate a data incident the way an experienced data engineer would?

That idea became Rootline.

Rootline is an AI data incident investigator that uses DataHub as its organizational context layer. Instead of asking an LLM to guess what went wrong, Rootline gives the agent access to real metadata, schemas, lineage, ownership, and query context through DataHub MCP.

Our goal was simple: find what went wrong, prove why, show what is affected, fix it, verify the fix, and remember what was learned.

What We Built

Rootline follows a four step workflow:

Select → Investigate → Fix & Verify → Remember

When an incident is selected, Rootline uses DataHub MCP to investigate the affected dataset. It retrieves the relevant metadata, examines schema changes, follows lineage, gathers evidence, and determines the most likely root cause.

The agent then generates a grounded remediation and validates the result rather than simply claiming that the fix worked.

Finally, Rootline writes the verified resolution back into DataHub.

This creates something we call Institutional Memory Replay.

When a similar incident happens later, Rootline can search the knowledge it previously stored in DataHub, find the relevant resolution, and use that knowledge instead of starting the investigation from scratch.

In other words:

DataHub gives the agent context. Rootline investigates, acts, verifies, and remembers.

How We Built It

Rootline is built with:

• Next.js 14 + TypeScript for the frontend
• FastAPI + Python for the backend
• DataHub as the organizational metadata and context layer
• DataHub MCP Server for agent access to DataHub
• Pydantic for structured backend models
• DataHub Write APIs for storing verified investigation knowledge

The agent currently uses DataHub MCP operations for searching metadata, retrieving entities and schema fields, traversing lineage, retrieving dataset queries, searching previous investigation documents, and writing verified resolutions back into DataHub.

We also built a controlled incident scenario on top of the official DataHub hackathon dataset so the investigation and verification flow could be demonstrated deterministically.

What We Learned

The biggest lesson was that context matters as much as intelligence for AI agents.

A general purpose LLM can reason about a data problem, but without knowing the actual schema, lineage, ownership, and relationships inside an organization's data stack, it cannot reliably investigate a real incident.

DataHub changes that equation by providing the agent with structured organizational context.

We also learned that an agent should not simply say:

“I think this is the problem.”

It should be able to show why it reached that conclusion, what evidence supports it, what systems are affected, and whether the proposed fix actually worked.

That led us to make evidence, verification, and write back first class parts of Rootline.

Challenges

One of our biggest challenges was making the experience both simple and technically deep.

DataHub exposes a huge amount of useful information, but showing everything at once would make the product difficult to understand. We therefore designed Rootline with a simple surface layer for anyone investigating an incident, while keeping MCP calls, DataHub URNs, lineage, scoring factors, SQL, and raw responses available for technical users.

Another challenge was ensuring that Rootline did not simply simulate an agent workflow. We wanted the demo to use the real DataHub MCP connection, perform actual DataHub operations, verify the remediation, and write the resolution back into DataHub.

Why Rootline

Most incident response workflows stop after finding a possible cause.

Rootline closes the loop:

Investigate → Explain → Fix → Verify → Remember

The result is an AI agent that doesn't just investigate the current incident, but can make the next incident easier to solve because the organization's previous knowledge is already available in DataHub.

Rootline doesn't just solve incidents. It remembers how they were solved.

Built With

• agents
• ai
• datahub
• fastapi
• nextjs
• pydantic
• python
• typescript