HolmesGPT/holmesgpt

HolmesGPT – An AI‑powered SRE assistant

What it is – HolmesGPT is an open‑source AI agent designed to help Site‑Reliability Engineers investigate production incidents and discover root causes. It talks to a wide range of observability, cloud‑native, and ticketing systems, runs an agentic loop that fetches data, reasons with a large language model, and returns a concise analysis (and even remediation suggestions).

Why it matters – Modern infra generates petabytes of logs, metrics and events. Manually correlating those sources is time‑consuming and error‑prone. HolmesGPT automates the “detect‑investigate‑remediate” cycle, can operate continuously in Operator mode to spot problems before users notice, and integrates with the tools you already use (Kubernetes, Prometheus, Grafana, Datadog, AWS, Azure, GitHub, Slack, etc.).

Core features (as described in the README)

Petabyte‑scale data handling – server‑side filtering, JSON tree traversal and streaming keep large payloads out of LLM context windows.
Memory‑safe execution – per‑tool memory limits and output budgeting prevent OOM crashes when querying huge observability datasets.
Deep integrations – built‑in toolsets for >30 data sources (Kubernetes, Prometheus, Grafana, Datadog, AWS, Azure, GCP, Elasticsearch, Loki, Kafka, MySQL/PostgreSQL, MongoDB, Sentry, ServiceNow, etc.) plus a generic REST‑API connector.
Bidirectional alert/ticket flow – fetch alerts from AlertManager, PagerDuty, OpsGenie, Jira, etc., and write findings back to the same system or to Slack/Teams.
LLM‑agnostic – works with any provider (OpenAI, Anthropic, Azure, Bedrock, Gemini, etc.) via a simple configuration.
Operator mode – runs as a background Kubernetes pod that continuously runs health‑checks, detects regressions, and notifies you (Slack, PRs, etc.).
No Kubernetes required – the CLI can be run on VMs, bare‑metal, or any container host.

How it works (high‑level)

Trigger – an alert, ticket, or a manual query starts an investigation.
Data collection – HolmesGPT calls the appropriate toolsets (e.g., Prometheus for metrics, Elasticsearch for logs, Kubernetes API for pod status) and streams the results.
LLM reasoning – the collected data is fed to the configured LLM, which produces a root‑cause hypothesis, diagnostic steps, and optional remediation actions.
Output – the result is posted back to the source system (Slack message, Jira comment, PR, etc.) and can optionally execute remediation via the Kubernetes remediation toolset.

The README includes an architecture diagram and a GIF demo of an investigation.

Getting started

Installation – detailed docs at https://holmesgpt.dev/installation/cli-installation/ cover CLI install, Docker image, or Helm chart for the Operator.
Configuration – set your LLM API key (any provider), enable the desired data‑source toolsets, and configure alert/ticket integrations (Slack, PagerDuty, etc.).
Usage – interactive mode for ad‑hoc questions, CLI commands for CI/CD troubleshooting, or the Operator for continuous health checks.

License & community

License – Apache 2.0.
Governance – CNCF sandbox project, originated by Robusta.Dev with contributions from Microsoft.
Support – Slack channel, community meet‑ups, and a DeepWiki AI badge for Q&A.
Contribution – CONTRIBUTING.md and a Code of Conduct are provided.

Bottom line – HolmesGPT is a production‑grade, extensible AI agent that brings LLM‑driven root‑cause analysis to the whole cloud‑native stack, helping SRE teams reduce MTTR and automate routine incident response.