AIOps MCP
by Elvisaryan
README.md
# 🛰️ AIOps MCP — Multi-Agent Incident Intelligence
> **Production incidents in 10 seconds, not 60 minutes.** A drop-in MCP server + dashboard that turns any LLM — Claude, Claude Code, ChatGPT, Cursor, Continue — into an autonomous incident-response copilot.
[]() []() []() []() []() []() []()
---
## Why AIOps MCP?
Every production incident starts the same way: an engineer opens five tabs at 2 a.m. — CloudWatch, Grafana, GitLab, Confluence, the customer DB — and spends 40-60 minutes *gathering context* before they can even begin fixing the problem. That hour costs $1,000-$10,000/minute in lost revenue for a P1.
We built AIOps MCP for engineers who are tired of being the human glue between observability tools. It treats incident investigation the way Slack treats messaging or k8s treats containers — as something the platform should handle, not a thing humans should do by hand. Inspired by the way Resolve.ai and pager-replacement tooling are reshaping on-call, but built **MCP-native** so it speaks the same protocol every modern LLM client already speaks.
Under the hood: six specialized agents, an LLM-driven supervisor, an opinionated synthesis prompt, and a topology engine that knows what depends on what.
---
## What You Get
| Capability | Description |
| --- | --- |
| 🤖 **6 specialized agents** | Log, Infra, Change, Docs, Impact, Audit — run in parallel, not sequence |
| 🧠 **MCP-native** | Plug into Claude Desktop, Claude Code, Cursor, Continue, or any MCP client over stdio or HTTP |
| 🔌 **Multi-LLM** | Claude, GPT, Gemini, local models via OpenRouter — pick your brain, we coordinate |
| 📊 **MCP Dashboard** | Chat + live agent traces + topology + log viewer in one tab — like Claude.ai for incidents |
| 🕸️ **App topology** | Interactive service graph with blast-radius propagation for connected-impact analysis |
| 📎 **Manual + auto logs** | Paste, upload, or auto-pull from CloudWatch / Datadog / Splunk / Loki / Grafana |
| 🧾 **Full audit trail** | Every agent step, LLM prompt, and one-click action logged — compliance-ready |
| 🎫 **Auto-Jira** | Incident, RCA, evidence, action log — created and updated by the Audit Agent |
| 🚀 **One-click actions** | Rollback / restart / scale / flag-flip — vetted, parameterized, reversible |
| ⚙️ **8 env vars total** | Production deployment with mocks-by-default — no creds, no problem |
| 🐳 **Docker-ready** | `docker compose up` and you have the full stack |
| 🔐 **Zero-trust by default** | Per-agent secrets, PII scrubbing on LLM prompts, immutable audit log |
---
## Two Installation Paths
| | **MCP Plugin** (recommended for LLM users) | **Self-hosted CLI** (for SREs/platform teams) |
| --- | --- | --- |
| Best for | Solo engineers wiring it into Claude Code / Claude Desktop / Cursor | Teams running AIOps MCP as shared infrastructure |
| Install | `claude mcp add aiops -- aiops mcp-stdio` | `pip install -e .` then `aiops serve` |
| Transport | stdio | HTTP + MCP-over-HTTP + dashboard at `:7878` |
| Config | Single `.env` next to `aiops` binary | `.env` + `configs/topology.yaml` + Docker |
| Dashboard | Optional (`aiops dashboard`) | Always on at `http://host:7878` |
| Multi-user | Single user | RBAC via Cognito / Okta / OAuth2 |
Pick based on the team you're solving for. Both paths use the same agent engine.
---
## Quick Start (60 seconds)
```bash
git clone https://github.com/<you>/aiops-mcp.git
cd aiops-mcp
cp .env.example .env # leave it empty for full mock mode
pip install -e .
aiops serve # MCP + HTTP + dashboard on :7878
```
Open <http://localhost:7878> and ask: *"Why is checkout slow?"*
### Or just Docker
```bash
docker compose up
```
---
## The Six Agents
Grouped by what they actually do in an incident:
### Observe (data gatherers)
| Agent | Sources | What it answers |
| --- | --- | --- |
| 🪵 **Log Agent** | CloudWatch, Datadog, Splunk, ELK, Loki | "What errors fired in the last 30 min?" |
| 📊 **Infra Agent** | Grafana, Prometheus, Datadog Metrics, CloudWatch | "Is the DB at 98% connections? Is upstream healthy?" |
| 🚢 **Change Agent** | GitHub, GitLab, ArgoCD, Jenkins | "Who deployed what, when?" |
### Reason (context + impact)
| Agent | Sources | What it answers |
| --- | --- | --- |
| 📚 **Docs Agent** | Bedrock KB / pgvector / Pinecone over runbooks, postmortems, ADRs | "Have we seen this before? What's the runbook?" |
| 💸 **Impact Agent** | DynamoDB, Snowflake, BigQuery, Mixpanel | "Who's affected? How much revenue is at risk?" |
### Act (close the loop)
| Agent | Sources | What it answers |
| --- | --- | --- |
| 🧾 **Audit Agent** | Jira, ServiceNow, Linear | "Create the ticket, attach the RCA, link past incidents." |
---
## MCP Tools Exposed
| Tool | Purpose |
| --- | --- |
| `investigate_incident` | Full multi-agent investigation — returns RCA + suggested actions |
| `query_logs` | Search logs in CloudWatch / Datadog / Splunk / Loki / ELK |
| `query_metrics` | PromQL / Grafana / Datadog Metrics query |
| `attach_log` | Manually attach a log blob (paste or upload) to an active investigation |
| `get_topology` | Return service dependency graph + health |
| `correlate_impact` | Given a service, list downstream impact + affected customers |
| `recent_deploys` | List deploys / merges in a window |
| `find_runbook` | RAG search over runbooks and past postmortems |
| `create_jira_ticket` | Create / update Jira with full RCA |
| `execute_action` | One-click remediation (rollback / restart / scale / flag-flip) |
Every tool is callable directly from your LLM client — no UI required.
---
## The MCP Dashboard
A single-tab web UI inspired by Resolve.ai and Claude.ai for incident response:
| Surface | What it does |
| --- | --- |
| 💬 **Chat panel** | Natural-language conversation with the orchestrator |
| 🧩 **Agent trace** | Live cards showing each agent's progress, findings, and citations |
| 🕸️ **Topology graph** | Interactive node graph; click a service to see blast radius |
| 📎 **Log dropzone** | Paste / upload / fetch logs with timestamp alignment |
| ⏱️ **Incident timeline** | Every step with timestamps, audit-ready |
| 🎯 **Action panel** | One-click rollback / scale / flag-flip with explicit confirmation |
Live demo (self-host): `http://localhost:7878` after `aiops serve`.
---
## Architecture
```
┌──────────────────────────────────────────────────────┐
│ LLM CLIENT (Claude Code / Desktop / ChatGPT / ...) │
└────────────────────────┬─────────────────────────────┘
│ MCP (stdio or HTTP)
▼
┌──────────────────────────────────────────────────────┐
│ AIOps MCP SERVER (:7878) │
│ ┌──────────────────────────────────────────────┐ │
│ │ SUPERVISOR ORCHESTRATOR │ │
│ │ plans → fans out → synthesizes → audits │ │
│ └──┬─────────┬─────────┬────────┬────────┬─────┘ │
│ ▼ ▼ ▼ ▼ ▼ │
│ ┌─────┐ ┌──────┐ ┌──────┐ ┌──────┐ ┌──────┐ │
│ │ LOG │ │INFRA │ │CHANGE│ │ DOCS │ │IMPACT│ │
│ └──┬──┘ └──┬───┘ └──┬───┘ └──┬───┘ └──┬───┘ │
│ │ │ │ │ │ │
│ ▼ ▼ ▼ ▼ ▼ │
│ ┌──────────────────────────────────────────┐ │
│ │ ADAPTERS (mock-by-default, swappable) │ │
│ └──────────────────────────────────────────┘ │
│ │ │ │ │ │ │
│ ▼ ▼ ▼ ▼ ▼ │
│ CloudWatch Grafana GitHub Vector Snowflake │
│ Datadog Promet. GitLab pgvector BigQuery │
│ Splunk Datadog ArgoCD RunbookKB DynamoDB │
│ │
│ ▼ │
│ ┌─────────────────────────┐ │
│ │ SYNTHESIS ENGINE │ │
│ │ (Claude Opus 4.7) │ │
│ └────────────┬────────────┘ │
│ ▼ │
│ ┌─────────────────────────┐ │
│ │ AUDIT AGENT → Jira │ │
│ └─────────────────────────┘ │
└──────────────────────────────────────────────────────┘
│
▼
┌──────────────────────────────────┐
│ MCP DASHBOARD (web UI) │
│ Chat · Trace · Topology · Logs │
└──────────────────────────────────┘
```
You pick the model; AIOps MCP handles coordination.
---
## Configuration — ~8 env vars total
All config is via environment variables. Defaults work with **mock data** so you can run it instantly.
| Variable | Required | Purpose |
| --- | --- | --- |
| `ANTHROPIC_API_KEY` | for real LLM | Supervisor + Synthesis (Claude Opus 4.7) |
| `AIOPS_PORT` | no | HTTP / MCP port — default `7878` |
| `AIOPS_DATA_DIR` | no | SQLite, uploads, topology cache — default `./data` |
| `AIOPS_MOCK_MODE` | no | Auto-on when no integrations set |
| `DATADOG_API_KEY` *or* `SPLUNK_TOKEN`+`SPLUNK_HOST` *or* AWS creds | optional | Pick the log source you have |
| `GRAFANA_URL` + `GRAFANA_TOKEN` | optional | Metrics |
| `GITHUB_TOKEN` *or* `GITLAB_TOKEN` | optional | Deploys |
| `JIRA_HOST` + `JIRA_EMAIL` + `JIRA_TOKEN` | optional | Audit ticketing |
That's it. See `.env.example` for the full annotated list.
---
## Plug Into Any LLM Client
| Client | Setup | Config file |
| --- | --- | --- |
| **Claude Desktop** | Merge `mcpServers` block into `claude_desktop_config.json` | `configs/claude-desktop.json` |
| **Claude Code** | `claude mcp add aiops -- aiops mcp-stdio` | `configs/claude-code.json` |
| **ChatGPT (custom GPT)** | Point at `http://your-host:7878/openapi.json` | `configs/chatgpt-openapi-stub.json` |
| **Cursor** | Add to `~/.cursor/mcp.json` (same format as Claude Desktop) | `configs/claude-desktop.json` |
| **Continue.dev** | Add to `~/.continue/config.json` MCP section | `configs/claude-desktop.json` |
| **Custom / any HTTP client** | POST to `:7878/mcp` (JSON-RPC 2.0) | n/a |
Every tool the dashboard uses is also callable from the LLM client. The dashboard is just another MCP consumer.
---
## With / Without AIOps MCP
| Capability | Without | With AIOps MCP |
| --- | --- | --- |
| Time to RCA | 40–60 min, 5 tabs | ~10 sec, one prompt |
| Investigation cost | 1 engineer-hour per P1 | 1 LLM call |
| Documentation | Manual Jira write-up after the fact | Auto-generated mid-incident |
| Knowledge retention | Lost when the senior leaves | Permanent in RAG corpus |
| On-call escalation reason | "I don't know who deployed what" | Change agent already answered |
| Impact estimation | Slack the BI team | Impact agent in 2 seconds |
| Action execution | SSH, kubectl, prayer | One-click, audited, reversible |
| Connected-impact view | Mental model in someone's head | Live topology graph |
---
## Repository Layout
```
aiops-mcp/
├── README.md # this file
├── .env.example # annotated env var template
├── pyproject.toml
├── requirements.txt
├── Dockerfile
├── docker-compose.yml
├── server/
│ ├── main.py # CLI entry: aiops serve | mcp-stdio | dashboard
│ ├── mcp_server.py # MCP protocol (stdio + HTTP)
│ ├── api.py # FastAPI HTTP API + dashboard host
│ ├── orchestrator.py # Supervisor: plans + fans out
│ ├── synthesis.py # Final LLM correlation call
│ ├── topology.py # Service graph + impact propagation
│ ├── config.py # Env loading + mock fallback
│ └── agents/
│ ├── base.py
│ ├── log_agent.py
│ ├── infra_agent.py
│ ├── change_agent.py
│ ├── docs_agent.py
│ ├── impact_agent.py
│ └── audit_agent.py
├── dashboard/
│ └── index.html # single-page UI (vanilla JS + vis-network)
├── configs/
│ ├── claude-desktop.json
│ ├── claude-code.json
│ ├── chatgpt-openapi-stub.json
│ └── topology.example.yaml
├── docs/
│ ├── INSTALLATION.md
│ ├── INTEGRATIONS.md
│ └── MCP-USAGE.md
└── tests/
└── test_basic.py
```
---
## Documentation
| When to read | Doc |
| --- | --- |
| First-time install on a new host | [`docs/INSTALLATION.md`](docs/INSTALLATION.md) |
| Wiring into Claude / ChatGPT / Cursor / Continue / custom | [`docs/INTEGRATIONS.md`](docs/INTEGRATIONS.md) |
| Building your own MCP client against this server | [`docs/MCP-USAGE.md`](docs/MCP-USAGE.md) |
| Architecture deep-dive (v1 + v2 roadmap) | [`docs/aiops-architecture.md`](../Downloads/aiops-architecture.md) |
---
## License
MIT — see `LICENSE`. Use it, fork it, run it, ship it.
---
## Support
- 🐛 Issues / RFCs: GitHub Issues
- 💬 Discussions: GitHub Discussions
- 🏢 Enterprise support (multi-region, SLA, custom adapters): open an issue with `enterprise` label
Built by people who've carried the pager.