Mezmo Agentic SRE
The alert fires.Your SRE agent investigates.
The SRE agent starts the root cause analysis. Opens the investigation to find the evidence, a confidence score, a suggested fix, and a timeline. Your team decides which tools it uses and which calls need approval.
An AI SRE agent built on open source. Mezmo's SRE agent runs on AURA, our open-source agent (Apache 2.0). Each alert it works produces an AI Investigation: one record of what it checked and found.
Example AI Investigation record. A pipeline alert on checkout-api error rate triggered it at 02:14:07 and it completed at 02:16:41. Root cause: the connection pool on checkout-api was exhausted after deploy 4.18.2 lowered max connections from 50 to 10, with confidence 0.87. Evidence: a log pattern "Timeout acquiring connection from pool" rose to 1,248 events from 96, deploy 4.18.2 reached checkout-api at 02:09, and checkout to orders p95 latency rose to 1.12 seconds. Suggested resolution: restore max connections to 50 and roll out checkout-api, a write that waits for human approval.
Connection pool exhausted on checkout-api after deploy 4.18.2 lowered max_connections from 50 to 10.
Timeout acquiring connection from pool after <N> ms1,24896 before
Deploy 4.18.2 reached checkout-api02:095 min before
checkout → orders p95 latency1.12 s210 ms before
Where on-call starts today. The page arrives with a symptom. The first stretch of the incident goes to questions the alert doesn't answer.
Which service? The alert names a symptom, not a cause.
Since when? Someone builds a time window by hand.
What changed? Deploys, configs, and logs get checked one tool at a time.
AI Investigations
The investigation is underwaybefore you open it
Point an in-stream pipeline alert at Mezmo AURA Investigation. When it fires, AURA starts collecting evidence, so whoever opens the investigation sees what has already been checked.
A finished record holds the linked alert, the evidence, a confidence score, the root cause, a suggested fix with remediation steps, and a timeline. Any MCP client reads it with get_ai_investigation.
AI Investigations is enabled per account. Talk to us to turn it on.
Example AI Investigations list with one active investigation. payments-api latency is investigating, started 2 minutes ago. checkout-api error rate completed with confidence 0.87 and a suggested fix to restore max connections to 50. auth-service 5xx responses completed with confidence 0.64 and a suggested rollback of a token TTL config change.
Suggested: restore max_connections to 50 and roll out checkout-api.
Suggested: roll back the token TTL config change from 23:40.
- 1
An alert fires
An in-stream alert on a pipeline source or processor notifies Mezmo AURA Investigation.
Mezmo platform - 2
The agent gathers evidence
Workers query your systems with the tools you assigned. Mezmo MCP returns clustered log patterns instead of raw lines.
AURA + Mezmo MCP - 3
A root cause, with the evidence behind it
The record fills in with evidence, a confidence score, a suggested fix, and a timeline.
AI Investigation - 4
Changes wait for a person
Calls you gate hold until someone approves. A denial goes back to the agent with the reason.
AURA
Example approval gate. The operations worker's reads ran straight through: get pods at 02:16:52 and fetch logs at 02:16:55 were allowed. At 02:17:03 it called k8s apply configmap on checkout-api, which matched the pattern k8s:apply_* and is held for a person. If approved, the call runs. If denied, the call does not run and the agent is told why. If nobody decides within 5 minutes, it fails closed.
Human in the loop
Reads run.Writes wait.
Give each worker the access it needs. AURA gives every worker its own tool list, and approval gates hold the calls you name until someone decides.
A denial goes back to the agent with the reason, so it explains instead of retrying. If a request times out or the approval channel fails, the gated call doesn't run. For policy across agents, Slack approvals, and decision records, add Mezmo Governance. It works with agents beyond AURA.
Investigate before acting
Give the agent read access to gather evidence and recommend a fix.
Approve selected changes
Add the required write tools, and gate the calls that need a human decision.
Expand deliberately
Review how a workflow performs before allowing specific routine calls to run under policy.
Recorded runs
See AURA investigatereal environments
These AURA walkthroughs show the task, connected tools, and configuration behind each run.
Find an unnoticed crash loop
A health check finds a pod in CrashLoopBackOff without starting from a named incident.
Explore the AURA examples Vague reportTurn a vague report into a root cause
A report without a service name or time range leads the logs worker to build a window and investigate the failure.
Explore the AURA examples ServerlessDebug a Lambda timeout
AURA connects through an AWS MCP proxy, finds the relevant log group, and checks the timeout.
Explore the AURA examples In-clusterInstall in Kubernetes with Helm
See AURA and a Kubernetes MCP server run in a cluster with read-only controls.
Watch the walkthroughExample AURA session. Asked why checkout is returning 500 errors, the orchestrator routes work to a logs worker and a Kubernetes worker. The logs worker calls Mezmo's root cause analysis tool over the last 30 minutes, which reduces 41,902 log lines to 6 clusters. The Kubernetes worker lists pods; the 38,214-token result goes to the scratchpad instead of the prompt, and a grep pulls back 412 tokens. The finding: pods are healthy, and connection timeouts begin at 02:09, right after deploy 4.18.2.
Engineered context
Telemetry that fitsin a context window
One log export can be larger than a model's context window. Mezmo MCP clusters logs before the agent reads them, and AURA keeps oversized tool output on disk until the agent needs a piece of it.
Clustered log patterns
Mezmo MCP deduplicates and clusters logs over a time window and returns the patterns, not every line.
Large results stay on disk
With the scratchpad on, AURA writes oversized tool results to disk. The agent reads back only the part it needs.
Start from what changed
Mezmo Insights flags changed log patterns, metric anomalies, and trace findings, and the agent queries them over MCP. Explore Insights
AURA, open source
AURA runs the work.You control the config.
The agent behind every investigation is open source. AURA is written in Rust, licensed Apache 2.0, and configured in TOML. Read the code, run it in your own infrastructure, and see exactly what it did.
Deploy on your termsRun AURA locally, in a container, or as a Kubernetes workload.
Choose your modelConfigure OpenAI, Anthropic, Gemini, Bedrock, OpenRouter, or a local Ollama instance.
Connect your toolsUse compatible MCP servers for systems such as Kubernetes, Prometheus, Grafana, GitHub, PagerDuty, and Mezmo.
Trace agent activityExport OpenTelemetry traces for model calls, tool calls, and orchestration activity.
# An SRE orchestrator with two scoped workers [agent] name = "sre-orchestrator" [agent.llm] provider = "anthropic" [mcp.servers.mezmo] transport = "http_streamable" [mcp.servers.k8s] transport = "http_streamable" url = "http://k8s-mcp:8080/mcp" [orchestration] enabled = true [orchestration.worker.logs] description = "Query and cluster logs" mcp_filter = ["mezmo:*"] [orchestration.worker.operations] description = "Changes to running services" mcp_filter = ["k8s:*"] # Writes wait for a person [hitl] require_approval = ["k8s:apply_*", "restart_*", "delete_*"]
Get started
Two ways to start
Pick the path that matches where your telemetry lives today.
Already sending telemetry to Mezmo?
Turn on AI Investigations and point a pipeline alert at it. The next time that alert fires, the investigation starts on its own.
AI Investigations is enabled per account.
Starting fresh?
Install AURA with one command and connect the MCP servers you already run. Add the Mezmo platform when you want alert-triggered investigations.
Questions
Common questions
What is an AI SRE agent?
An AI SRE agent uses connected tools and production telemetry to investigate operational problems and propose next steps. Mezmo built AURA as an open-source SRE agent for this work. The Mezmo platform adds alert-triggered investigations and clustered telemetry context.
Can AURA change production?
Only through tools you make available to it. You limit tool access by worker and choose which calls need human approval. Approval gates do not automatically cover every write tool, so review the tool list and gate configuration before granting production access.
Which models does AURA work with?
AURA supports OpenAI, Anthropic, Gemini, Bedrock, OpenRouter, and local Ollama instances. Model providers are configured in TOML.
Where does AURA run, and where does data go?
AURA runs on infrastructure you control. It sends prompts and tool data to the model providers, MCP servers, approval services, storage backends, and tracing destinations you configure. The interactive CLI also has documented, opt-out anonymous product telemetry. Review the AURA telemetry controls when planning a deployment.
Do I have to train a model on my environment?
No. AURA queries your connected tools during an investigation. Add runbook retrieval or skills that load task instructions when a task needs them.
How is AURA different from a closed SRE agent?
You can inspect AURA's source code, review its configuration, scope each worker's tools, and export traces of its activity.
Go deeper
Watch it, read it, run it
Install AURA and debug an incident
Follow an installation and first investigation using a Grafana MCP server.
Watch the video RecipesExplore runnable examples
Start from a recipe for a specific SRE task.
Browse recipes DocsRead the AURA documentation
Find the quickstart, configuration reference, approval gates, and tracing guides.
Open the docsYour infrastructure. Your rules.Your SRE agent.
Turn on AI Investigations for your Mezmo pipelines, or start with open-source AURA.
