Open source · MIT
Incident Investigator
LLMs collect evidence. Incident Investigator conducts investigations.
A stateful MCP server that turns vendor-neutral evidence into hypotheses, confidence scores, timelines, and explainable postmortems—without letting the chat model own the reasoning.
Why dump logs into chat fails
When production is down, pasting alerts and log snippets into an LLM feels fast—until two engineers (or two model runs) reach different root causes from the same facts. Investigations become non-reproducible. Confidence is fluency, not evidence.
Incident Investigator treats investigation as a discipline: question-driven protocol, competing hypotheses, and an audit trail a human can follow. The assistant gathers from your systems; the runtime owns what to ask next, when you have enough to conclude, and why.
How it works
Your MCP client is the field agent. Incident Investigator is the investigator.
Claude / Codex / Cursor
│
▼
Collect evidence (logs, metrics, deploys)
│
▼
Incident Investigator (MCP runtime)
├── Protocol & questions
├── Investigation graph
├── Reasoners & hypotheses
└── Confidence & sufficiency
│
▼
Structured findings & postmortem
│
▼
Your team & assistantWhat you get
MCP investigation runtime
Not an AI agent—a stateful engine your assistant calls via Model Context Protocol. Evidence in; structured findings out.
Competing hypotheses
Maintain multiple theories with explicit confidence. The runtime tracks what would change your mind—not just the loudest guess.
Question-driven protocol
Investigations follow deliberate questions: deploy before failure? DB saturated or slow? Timeline contradicts the lead theory?
Timelines & blast radius
Build ordered event sequences and understand impact scope—without dumping unstructured logs into chat.
Vendor-neutral evidence
No connectors in core. Submit evidence from Datadog, Kubernetes, logs, or tickets in neutral categories.
Postmortems & exports
Export Markdown, JSON, Mermaid, and more. Explainable conclusions you can share in blameless reviews.
Quick start
Install the binary, then wire it as an MCP server in your client. Full setup lives in the repo plugin directory.
go install github.com/stackrail/incident-investigator/cmd/incident-investigator@latestMCP configuration for Cursor, Claude Code, and Codex: plugins/incident-investigator
Works with
Documentation
All docs live on GitHub—spec, examples, and extension guides.
Need help running incidents at scale?
StackRail offers fractional DevSecOps and incident advisory for teams building production-grade systems—runbooks, observability, and response readiness alongside tools like Incident Investigator.
Explore StackRail services