ongridio/ongrid

An ops AI Agent that understands your infrastructure, finds the root cause, and fixes it — right from Slack, Telegram, Lark or DingTalk.

📌 What is Ongrid?

Ongrid is an open‑source AI‑powered operations assistant that lives in your infrastructure. It connects to Slack, Telegram (and other messengers) and lets you ask questions or react to alerts. Behind the scenes a set of coordinator and specialist agents use large language models to:

  • discover the topology of your hosts, containers and network devices,
  • correlate metrics, logs and traces to pinpoint the root cause of an incident,
  • suggest concrete remediation steps, and
  • optionally execute safe, audited commands (e.g., a reverse‑tunnel SSH shell) after an approval gate.

The platform is built with Go for the backend, TypeScript/React for the UI, and ships with a full observability stack (Prometheus, Loki, Tempo, Grafana). You can plug in any LLM that offers an API – Anthropic, OpenAI, Gemini, DeepSeek, etc.

🚀 Core Features (as listed in the README)

Feature What it does
Coordinator + Specialist agents A central dispatcher routes requests to domain‑specific sub‑agents (SRE, networking, databases, etc.).
Auto‑investigate on alert When an alert fires, an investigator agent automatically launches a root‑cause analysis (RCA) and posts the findings back to chat.
Root‑cause RCA Traverses the discovered topology, correlates metrics/logs/traces, and points to the exact code line or config that caused the problem.
Zero inbound ports Edge agents initiate outbound connections only; no need to open SSH/HTTP ports on your hosts.
Browser SSH Provides a reverse‑tunnel, key‑less shell that is fully audited and can be accessed from the web UI.
One‑command self‑host install.sh provisions the whole stack (backend, UI, observability) in a single step.
Built‑in observability Prometheus, Loki, Tempo and Grafana are pre‑wired; the agent writes its own queries for metrics, logs and traces.
Bring‑your‑own model Supports Anthropic, OpenAI, GLM, DeepSeek, Gemini, Kimi, with hot‑routing between providers.
Two‑way IM channels Slack, Telegram, Larksuite, DingTalk, WeCom and generic webhooks let you both send commands to and receive results from the agents.
Read‑only host tools A sandboxed Bash environment with 26+ inspection utilities; every call is logged for auditability.
Kubernetes lifecycle Enroll clusters, inspect workloads/events, manage upgrades, and map Kubernetes resources into the topology graph.
Network device management Discovers neighboring devices via Edge hosts, validates with SNMP, polls interfaces, and links hosts to network gear.

🛠️ Quick Install (from the README)

# Choose the binary that matches your server CPU architecture
wget https://github.com/ongridio/ongrid/releases/download/v0.18.2/ongrid-v0.18.2-linux-amd64.tar.xz
# or the ARM64 variant
# wget https://github.com/ongridio/ongrid/releases/download/v0.18.2/ongrid-v0.18.2-linux-arm64.tar.xz

tar -xf ongrid-v0.18.2-linux-*.tar.xz && cd ongrid-v0.18.2-linux-*
sudo ./install.sh   # runs the full stack (backend, UI, observability)

For users in mainland China a CDN mirror (https://ongrid.cloud/dl/...) is provided.

🎯 Typical Use Cases

  1. Alert‑driven auto‑investigation – An alert from Prometheus triggers the Incident Investigator, which gathers topology, runs RAG searches over runbooks, and posts a concise RCA to the originating Slack channel.
  2. On‑demand troubleshooting – An operator asks the bot “Why is service X latency high?”; the coordinator routes the query to the SRE specialist, which pulls metrics, logs, traces, and returns a step‑by‑step explanation.
  3. Controlled remediation – After an RCA, the bot can propose a fix (e.g., restart a pod). The proposal goes through an approval/write‑gate UI where a human reviews and authorises the change before the agent executes it.
  4. Kubernetes lifecycle management – Enroll a new cluster via the Edge component, view workloads, schedule upgrades, and automatically map the cluster into the global topology view.
  5. Network topology mapping – Edge agents discover network neighbours, verify them with SNMP, and visualise host‑to‑device links for impact analysis.

📚 Documentation & Community

  • Full docs: https://ongrid.cloud/docs
  • Join the community on Telegram or Slack (badges in the README).
  • Contributions are welcome – see CONTRIBUTING.md.

📄 License

The code is released under AGPL‑3.0. Brand assets have a separate trademark license (TRADEMARK.md).

TL;DR

Ongrid is a self‑hosted, AI‑driven SRE platform that lets you ask large‑language‑model‑powered agents to investigate incidents, browse your observability data, and even execute safe remediation—all from familiar chat tools. It bundles the required infrastructure (Go backend, React UI, Prometheus/Loki/Tempo/Grafana) and integrates with any LLM provider you prefer.

Related

  • Project
    omnara-ai/omnara

    Omnira is an open‑source, self‑hostable platform for running AI agents on any LLM model and any machine. It provides a REST API, TypeScript SDK, and CLI to launch agents, stream events, and handle approvals. Features include model‑agnostic support, built‑in and custom tools, reusable skills, persistent memory, sub‑agents, multi‑tenant RBAC, scheduling, and integrations with Slack, Discord, GitHub, webhooks, and more. You can try it via Omnira Cloud or run it locally with Docker Compose; the Apache 2.0‑licensed code keeps all agent data in your own Postgres.

  • Project
    onyx-dot-app/onyx-foss

    Onyx is a self-hosted knowledge and context layer that connects to over 50 applications to provide AI agents with secure, relevant access to your organization's internal data.

  • Project
    CyberStrikeus/CyberStrike

    CyberStrike is an open‑source AI agent that turns any LLM (Claude, GPT, Gemini, etc.) into an autonomous penetration‑testing platform. It adds a security‑focused “intelligence layer”, ships 13+ specialised agents and 7,600+ signed security‑skill files, supports 150+ AI providers (including offline models), and can orchestrate real tools locally or on remote Bolt servers. A TUI, optional web UI, and built‑in HackBrowser complete the workflow.

  • Project
    Tencent/AI-Infra-Guard

    AI‑Infra‑Guard (A.I.G) is an open‑source, Docker‑deployable platform for red‑team security testing of AI services. It scans live LLM endpoints, AI‑agent workflows, and model‑control‑plane code for CVEs, jailbreak susceptibility, and agent loss‑of‑control risks, exposing results via a web UI and REST API.