Ongrid is an operations agent for infrastructure that answers questions, investigates alerts, and executes actions from a chat client. It reasons over metrics, logs, traces, topology, source code, and an indexed knowledge base, calling tools as it goes and returning a grounded answer rather than a transcript of its steps.
A coordinator agent dispatches work to specialists for site reliability, network, and database questions. When an alert fires, an investigator spawns a root-cause worker and writes the cause back into the chat channel. Root-cause analysis walks the topology, correlates metrics, logs, and traces through PromQL, LogQL, and TraceQL, and pins the explanation to a line of source code. Risky actions sit behind an approval gate, and the bash sandbox plus more than 26 read-only inspection tools are audited on every call.
Edge hosts dial out over a single outbound tunnel, so no inbound port is opened on a managed machine, and a browser-based SSH session reaches a host through that same reverse tunnel without keys or a jump box. Kubernetes clusters are enrolled through the edge, with workload and event inspection, upgrade management, and cluster resources mirrored into the topology graph. Network devices are discovered from edge hosts, verified over SNMP, polled for interface state, and mapped to the hosts they link.
The server is self-hosted and brings up the manager, its database, Prometheus, Loki, Tempo, Grafana, and Qdrant together, with the option to point at an existing observability stack instead. Chat channels include Slack, Telegram, Larksuite, DingTalk, WeCom, and webhooks, each with its own locale. Models are supplied by the operator, with hot routing between them. The backend is Go, and the interface is TypeScript and React.
Features
- Coordinator and specialists: a coordinator dispatches to site-reliability, network, and database sub-agents
- Auto-investigation on alert: an investigator spawns a root-cause worker and reports the cause back into chat
- Root-cause analysis: topology traversal with correlated metrics, logs, and traces, pinned to a source line
- Zero inbound ports: edge hosts dial out, so no listening port is opened on a managed machine
- Browser SSH: a reverse-tunnel shell into any enrolled host, audited, without keys or a jump box
- Read-only host tools: a bash sandbox and more than 26 inspection tools, each call audited
- Kubernetes lifecycle: cluster enrolment, workload and event inspection, upgrades, and topology mirroring
- Network device management: neighbour discovery from edge hosts, SNMP verification, and interface polling
- Workflow builder: triggers, agents, tools, conditions, and notifications wired into editable automations
- Knowledge vault: runbooks, notes, incident history, and repositories indexed for both people and agents
- MCP servers: external MCP servers registered and exposed to chat agents and workflows
- Approval gate: risky actions held behind a visible policy boundary before production systems change
