Ongrid is a self-hosted operations agent that investigates and operates infrastructure from chat apps such as Slack, Telegram, Larksuite, DingTalk, and WeCom. It reads metrics, logs, and traces, walks the service topology to find the blast radius of a problem, correlates the signals into a root cause, and can pin that cause to a line of source code.
A coordinator agent dispatches work to specialist sub-agents for SRE, network, and database tasks. When an alert fires, an investigator starts a root-cause analysis (RCA) worker and writes the result back to the chat. Risky actions sit behind approvals and a write gate, and host tools are read-only by default: a bash sandbox plus more than 26 inspection tools, with every call audited.
Hosts connect through an edge component that dials out, so no inbound ports are opened on them. The same tunnel provides an audited browser SSH session to any host without keys or a jump box. The full stack ships with Prometheus, Loki, Tempo, and Grafana wired in, and the agent writes the queries. Kubernetes clusters enroll through the edge component for workload inspection and upgrades, and network devices are discovered from edge hosts and verified over SNMP.
Models are your choice, with hot routing across Anthropic, OpenAI, GLM, DeepSeek, Gemini, and Kimi.
Features
- Coordinator and specialist agents: a coordinator routes work to SRE, network, and database sub-agents
- Alert-driven investigation: alerts start an RCA worker that reports the cause back to chat
- Root-cause analysis: correlates metrics, logs, and traces across the topology and links the cause to source code
- Zero inbound ports: the edge component dials out, so hosts expose no SSH or web ports
- Browser SSH: reverse-tunnel shell into any host, with every session audited
- Built-in observability: Prometheus, Loki, Tempo, and Grafana wired in, queried by the agent
- Two-way chat channels: Slack, Telegram, Larksuite, DingTalk, and WeCom, with a locale per channel
- Read-only host tools: a bash sandbox and more than 26 inspection tools, each call audited
- Approval gate: risky actions wait for approval before they change production systems
- Workflow builder: wires triggers, agents, tools, conditions, and notifications into editable automations
- Knowledge vault: indexes runbooks, notes, incident history, and repositories for search by people and agents
- Kubernetes and network devices: enrolls clusters, manages upgrades, and maps hosts to network devices over SNMP
