# Sentinel -  Autonomous System Health Guardian

> An autonomous AI-powered infrastructure monitoring system that leverages multi-agent collaboration, Retrieval-Augmented Generation (RAG), Natural Language to SQL (NL2SQL), LangGraph orchestration, and the Model Context Protocol (MCP) to detect, diagnose, remediate, and analyze system incidents.

---

## Overview

Modern IT environments generate massive volumes of logs, alerts, and operational data. During incidents, engineers often need to correlate logs, consult runbooks, query monitoring databases, and determine appropriate recovery actions under time pressure.

Sentinel demonstrates how autonomous AI agents can collaborate to streamline this workflow.

Instead of relying on a single large language model, Sentinel distributes responsibilities across specialized agents. Each agent focuses on a specific task—monitoring, diagnosis, remediation, or infrastructure analytics—while CrewAI coordinates collaboration and LangGraph manages the overall incident response workflow.

The project combines modern AI engineering techniques including Retrieval-Augmented Generation (RAG), Natural Language to SQL (NL2SQL), Model Context Protocol (MCP), and LangSmith observability into a unified autonomous operations platform.

---

# Features

- Multi-agent architecture built with CrewAI
- Autonomous infrastructure monitoring
- Retrieval-Augmented Generation (RAG) using ChromaDB
- Natural Language to SQL (NL2SQL) analytics
- SQLite-backed infrastructure database
- LangGraph orchestration with verification and retry logic
- MCP Server exposing infrastructure tools
- LangSmith tracing and observability
- Safety guardrails for simulated remediation
- Structured outputs using Pydantic models

---

# System Architecture

Sentinel consists of four specialized AI agents working together to automate the incident response lifecycle.

<img width="1536" height="655" alt="Sentinel_Agent_Hierarchy" src="https://github.com/user-attachments/assets/e9decc0e-659a-411f-ad52-15bd74126ff7" />


---

# AI Agents

## Monitor Agent

The Monitor Agent continuously analyzes infrastructure logs to identify abnormal system behaviour.

**Responsibilities**

- Retrieve recent system logs
- Detect critical incidents
- Produce structured incident summaries

---

## Diagnostician Agent

The Diagnostician Agent determines the most probable root cause of an incident using Retrieval-Augmented Generation.

Rather than relying solely on model knowledge, the agent retrieves relevant operational procedures from the Sentinel Operations Runbook before generating a diagnosis. This grounding process improves factual consistency and reduces hallucinations.

---

## Remediation Agent

The Remediation Agent proposes recovery actions based on the diagnosis.

Generated recommendations are passed to the verification stage before the workflow is considered complete.

---

## Data Intelligence Agent

The Data Intelligence Agent enables engineers to query operational data using natural language.

Example:

> Which server has the most ERROR logs?

The agent converts the request into SQL, executes it against the infrastructure database, and returns a grounded response.

---

# Workflow

CrewAI coordinates collaboration between specialized agents, while LangGraph manages workflow execution and recovery.

```
Monitor
   │
   ▼
Diagnose
   │
   ▼
Remediate
   │
   ▼
Verify
   │
   ▼  
 ┌─┴─────────────┐
 │               │
 ▼               ▼
END        Retry Diagnosis
```

If verification fails, LangGraph automatically routes execution back to the Diagnostician Agent for another remediation cycle.

---

# Retrieval-Augmented Generation (RAG)

The Diagnostician Agent uses ChromaDB as an enterprise knowledge base.

Workflow:

```
Incident
    │
    ▼
Vector Search
    │
    ▼
Relevant Runbook Sections
    │
    ▼
Grounded Diagnosis
```

This approach enables responses to be based on retrieved operational documentation rather than solely on the language model's internal knowledge.

---

# Natural Language to SQL (NL2SQL)

The Data Intelligence Agent converts natural language into executable SQL queries.

Example:

**Question**

```
Which server has the most ERROR logs?
```

Generated SQL

```sql
SELECT l.server_id,
       s.hostname,
       COUNT(*) AS error_log_count
FROM logs AS l
LEFT JOIN servers AS s
ON l.server_id = s.server_id
WHERE l.log_level = 'ERROR'
GROUP BY l.server_id, s.hostname
ORDER BY error_log_count DESC
LIMIT 1;
```

This enables infrastructure analytics without requiring engineers to write SQL manually.

---

# Model Context Protocol (MCP)

Sentinel implements an MCP server as the unified interface between AI agents and infrastructure resources.

Available tools include:

- `get_system_logs()`
- `query_knowledge_base()`
- `query_database()`
- `execute_system_command()`

This separation improves modularity and provides a standardized interface for agent-tool interactions.

---

# Safety Guardrails

To demonstrate safe autonomous remediation, Sentinel simulates command execution.

High-risk commands are automatically blocked whenever the infrastructure is under critical database load.

Examples include:

- reboot
- shutdown
- rm -rf

No real infrastructure modifications are performed.

---

# Observability

LangSmith provides end-to-end tracing of:

- Agent execution
- Tool invocation
- Retrieval events
- SQL generation
- LLM interactions
- Workflow execution

This makes the complete decision-making process transparent and simplifies debugging.

---

# Technology Stack

| Category | Technologies |
|----------|--------------|
| Language | Python 3.12 |
| Multi-Agent Framework | CrewAI |
| Workflow | LangGraph |
| LLM | OpenAI GPT-5.5 |
| RAG | LangChain + ChromaDB |
| Database | SQLite |
| Observability | LangSmith |
| Protocol | FastMCP |
| Validation | Pydantic |

---

# Project Structure

```
src/sentinel
├── config
├── flows
├── models
├── services
├── tools
├── crew.py
├── mcp_server.py
└── main.py
```

---

# Current Limitations

- Uses simulated infrastructure instead of live production systems.
- Verification logic is rule-based rather than driven by real monitoring telemetry.
- SQLite is used for demonstration purposes instead of enterprise monitoring platforms.
- Remediation actions are intentionally non-destructive.

---

# Screenshots

<img width="2940" height="4208" alt="screencapture-smith-langchain-o-e34996d4-d5ca-413c-9dee-b331fec67794-projects-p-dd1a047b-ebd6-4b67-b758-b8126598eb03-2026-08-08-00_14_39" src="https://github.com/user-attachments/assets/5daa3bb9-d105-4b80-9813-4149a8d19784" />
<img width="2940" height="3700" alt="screencapture-smith-langchain-o-e34996d4-d5ca-413c-9dee-b331fec67794-projects-p-dd1a047b-ebd6-4b67-b758-b8126598eb03-2026-08-08-00_15_49" src="https://github.com/user-attachments/assets/c90d6a62-acb8-4a41-8082-90b37f1a4db2" />



---

# Author

**Iram Ishtiaq**

Master of Computer Science (Artificial Intelligence)

Python • Agentic AI • Multi-Agent Systems • RAG • LangGraph • CrewAI • Machine Learning

---

## Acknowledgements

This project was developed as part of an assignment.