AAIRPSTACK
In DevelopmentPhase 2 — AI Agents, Console & Connectors→

AIRPSTACK

Building Autonomous
AI Operations Engineers

AI-Powered Incident Response Platform · Built by AIRPStack Engineering

AI agents that investigate incidents, correlate telemetry, analyze logs, retrieve documentation, execute approved remediation workflows, and learn from previous outages — with humans in control of impactful actions.

View Source→DocumentationView Progress

Under construction

47%Platform

Phase 2 in active development

AI Agents, Console & Connectors

4

Phases

16

Workflow Steps

13

Core Engines

See It Work

From Alert to Triage

PagerDuty webhook → ingest → Triage Agent is live in v0.4.0. Evidence collection and remediation agents are next.

01 · PagerDuty Alert — A PagerDuty incident.triggered webhook hits POST /integrations/pagerduty/webhook. The event normalizes, dedupes, and opens an incident.

The Problem

Too Many Tools, Too Little Time

Modern IT operations teams rely on disconnected tools — ServiceNow, Grafana, Prometheus, PagerDuty, Datadog, cloud providers, and internal dashboards. Engineers spend valuable time correlating alerts, searching historical incidents, gathering evidence, and executing repetitive runbooks.

High MTTR

Mean time to resolution suffers from manual correlation

Alert Fatigue

Unrelated events flood engineers without deduplication

Lost Knowledge

Institutional expertise walks out the door with every incident

AIRP becomes the orchestration layer across these systems — reducing MTTR, improving operational consistency, and preserving organizational knowledge.

Open Source

AIRP Platform

AI-Powered Incident Response Platform — built by AIRPStack Engineering. Ingest, correlate, analyze, and manage incidents via API and Next.js console.

External links are placeholders (example.com) until public release. Screenshots and architecture below are from the live AIRP console (Triage Agent + PagerDuty + operator UI).

AIRPSTACK

AI-Powered Incident Response Platform

Built by AIRPStack Engineering

  • FastAPI
  • PostgreSQL
  • OpenAI Agents SDK
  • PagerDuty Webhooks
  • Triage Agent
  • Incident Lifecycle
  • Next.js Web UI
  • Docker Compose
View SourceArchitectureDocumentation

v0.4.0 · Triage Agent + PagerDuty webhooks + operator console

PagerDuty / external event
        │
        ▼
POST /integrations/pagerduty/webhook  or  POST /events
        │
        ▼
RawEvent → normalize → fingerprint → dedupe → Incident (open)
        │
        ▼
Triage Agent (auto on create) → category, priority, evidence plan
        │
        ▼
Operator  ──►  GET /incidents/{id}/triage  or  Next.js console

Architecture diagram

End-to-end AIRP architecture — PagerDuty ingress, ingest pipeline, Triage Agent, and the full multi-agent roadmap. See interactive flow for shipped vs planned stages.

AIRP architecture — ingestion, PostgreSQL, background analysis, operator UI, and LLM services

Operator console screenshots

Next.js console from AIRP v0.4.0 — incident list, triage status, detail with AI summary and evidence plan, and lifecycle actions. PagerDuty webhooks feed the same pipeline.

Operator console incident list with a high-severity open incident
Incident list — filters, severity, and analysis status
Incident detail with AI summary, recommendation, and event timeline
Incident detail — AI summary, timeline, and lifecycle actions
Operator console empty filter state
Console empty state when filters match no incidents

API documentation

REST endpoints (API key auth). Interactive OpenAPI is at /docs when running locally in development.

  • POST/eventsIngest → normalize → dedupe → incident
  • POST/events/rawPersist raw event only (debug)
  • GET/eventsList operational events
  • GET/events/{id}Operational event detail
  • POST/integrations/pagerduty/webhookPagerDuty v3 webhook → EventIngest (pagey.ping → 200)
  • GET/incidentsFilter by status / severity / triage_status + pagination
  • POST/incidentsCreate incident
  • GET/incidents/{id}Incident detail
  • GET/incidents/{id}/triageLatest structured triage result (category, evidence plan)
  • PATCH/incidents/{id}Update lifecycle, assignment, closure
  • POST/incidents/{id}/reopenReopen a closed incident (audit)
  • GET/incidents/{id}/eventsEvents linked to incident
  • POST/incidents/{id}/analyzeRun or retry LLM analysis
  • GET/healthLiveness
  • GET/health/readyReadiness (DB + LLM)
Full reference in README →

Demo video

End-to-end walkthrough: ingest an event, dedupe, and LLM analysis.

Coming soon

Embed when recorded

Set airpMedia.demoVideoUrl to your YouTube or Vimeo embed URL in lib/airp-project.ts.

Platform Architecture

End-to-End Incident Flow

From PagerDuty alert through AI agents, human approval, and closed-loop learning — with v0.4.0 Triage Agent live today.

PagerDuty / External Event

Shipped · v0.3.0

Alerts arrive via POST /integrations/pagerduty/webhook or POST /events through Cloudflare Tunnel.

Existing AIRP Pipeline

Shipped · v0.1.0

Normalize → fingerprint → dedupe → operational event. New events open incidents automatically.

Incident

Shipped · v0.2.0

Lifecycle management, filters, pagination, and operator console list/detail views.

╔ AI Orchestrator ╗

AI Orchestrator

In Progress · v0.4.0+

Coordinates specialized agents. Triage runs on incident create; investigation and remediation agents follow.

  • Triage Agent

    Shipped · v0.4.0

    OpenAI Agents SDK — category, priority, severity, evidence plan, and investigation rationale. GET /incidents/{id}/triage.

  • Evidence / Investigation Agent

    Roadmap · v0.5.0

    Collects metrics, logs, service health, and dependency status via MCP tools from the triage evidence plan.

  • Root Cause / Recommendation Agent

    Roadmap · v0.5.0

    Correlates gathered evidence into root cause analysis and proposed remediation steps.

RAG / Memory

Roadmap · v0.4.0+

Vector search over operational knowledge to enrich agent context.

  • Runbooks
  • Previous incidents
  • Technical documentation

MCP Tools

Roadmap · v0.5.0+

Model Context Protocol adapters for live infrastructure evidence.

  • Metrics
  • Logs
  • Linux
  • Docker
  • PostgreSQL
  • Kubernetes

Proposed Remediation

Roadmap · v0.5.0+

Structured fix recommendation attached to the incident for operator review.

Human Approval

Roadmap · v0.5.0+

Engineers approve or reject remediation before any impactful action runs.

Execute Remediation

Roadmap · v0.5.0+

Approved runbooks and MCP tools execute with full audit logging.

Verify Result

Roadmap · v0.5.0+

Confirm recovery via metrics, logs, and synthetics before closure.

Close Incident

Shipped · v0.2.0

Resolve and close with audit fields — full remediation loop expands in v0.5.0+.

Learn

Roadmap · v0.6.0+

Store outcomes and embeddings so future incidents benefit from past investigations.

v0.4.0 Agent handoff

Triage Agent

Shipped · v0.4.0

Runs automatically on new incidents — structured output with evidence_to_collect for the next agent.

Evidence / Investigation Agent

Roadmap · v0.5.0

Executes the triage evidence plan — system metrics, application logs, service health, and more.

Root Cause / Recommendation Agent

Roadmap · v0.5.0

Reasons over collected evidence and proposes remediation with confidence scoring.

Tech Stack

What AIRP Is Built With

Production-grade tooling across AI, backend, frontend, and cloud — deployed end to end, not just prototyped.

Shipping today

  • Python 3.12Platform core
  • FastAPIAsync REST API
  • PostgreSQLIncident & event store
  • SQLAlchemy + AlembicAsync ORM & migrations
  • PagerDutyInbound v3 webhook connector
  • Cloudflare TunnelSecure public webhook ingress
  • OpenAI Agents SDKTriage Agent (structured output)
  • OpenAILLM provider for triage & analysis
  • LiteLLMMulti-provider LLM layer
  • PresidioPII / secret sanitization
  • Next.jsOperator console & this site
  • TypeScriptFrontend type safety
  • Cloudflare WorkersEdge deployment (OpenNext)
  • Docker ComposeLocal full-stack runs
  • GitHub ActionsCI/CD, tests, security scans

On the roadmap

  • Grafana / DatadogAdditional alert connectors
  • QdrantVector memory (RAG)
  • CrewAI / Agents SDKMulti-agent investigation pipeline
  • MCPRemediation tool execution
  • AnthropicAdditional LLM provider
  • SlackNotifications & approvals

Development Roadmap

Building in Phases

Four deliberate phases from core incident infrastructure to continuous learning — each mapped to platform components and workflow steps.

01

Event Intake & Incidents

Ingest → normalize → dedupe → incidents, plus open/investigating/resolved/closed lifecycle, filters, and pagination (AIRP v0.2).

Complete
Event IngestionDeduplication EngineIncident Service
02

AI Agents, Console & Connectors

Triage Agent on incident create (v0.4.0, OpenAI Agents SDK); Next.js console with triage detail; PagerDuty webhooks (v0.3). Evidence and root-cause agents next.

In Progress
Triage AgentAnalysis ServiceOperator DashboardMonitoring GatewayInvestigation Engine
03

Approval & Execution Engine

Multi-agent orchestrator (triage, evidence, root cause, recommendation), human-in-the-loop approvals, and safe MCP-based remediation (AIRP v0.5.0+).

Planned
Policy EngineExecution Engine
04

Continuous Learning & Knowledge Base

RAG memory over runbooks, prior incidents, and docs (AIRP v0.4.0), plus verification, outcome tracking, and closed-loop learning.

Planned
Verification EngineLearning Engine

End-to-End Workflow

16 Steps to Resolution

From first alert to organizational learning — every step is auditable, evidence-driven, and human-gated where it matters.

01

Monitor & Detect

Receive alerts via POST /events or PagerDuty webhooks (Cloudflare Tunnel ingress).

Phase 1

02

Normalize Events

Transform heterogeneous alerts into a unified schema.

Phase 1

03

Deduplicate & Correlate

Group related events into a single incident.

Phase 1

04

Create Incident

Open incidents with lifecycle (open → investigating → resolved → closed).

Phase 1

05

Enrich Context

Attach assets, ownership, dependencies, and runbooks.

Phase 2

06

AI Understanding

Assess severity, impact, and confidence scores.

Phase 2

07

Retrieve Memory

Search historical incidents and runbooks via Qdrant.

Phase 2

08

Triage & Route

Triage Agent assesses category, priority, and evidence plan; routes to investigation when required.

Phase 2

09

Gather Evidence

Collect logs, metrics, and configuration data.

Phase 2

10

Root Cause Analysis

Reason over evidence to identify the root cause.

Phase 2

11

Remediation Plan

Generate corrective actions with rollback strategy.

Phase 3

12

Human Approval

Present evidence and await engineer approval.

Phase 3

13

Execute Runbooks

Run approved MCP tools and remediation scripts.

Phase 3

14

Verify Recovery

Confirm resolution via logs, metrics, and synthetics.

Phase 4

15

Update & Notify

Close tickets and notify stakeholders.

Phase 4

16

Learn & Improve

Store outcomes and embeddings for future incidents.

Phase 4

Complete In Progress Planned

Platform Architecture

Core Engines

13 vendor-neutral services orchestrate intake, analysis, the operator console, investigation, policy, execution, verification, and learning.

Event Ingestion

Complete

Durable POST /events intake: raw events, normalize, operational persist.

Phase 1

Deduplication Engine

Complete

Source + fingerprint linking; one incident per first-seen event.

Phase 1

Incident Service

Complete

Lifecycle, PATCH updates, filters, pagination, and PostgreSQL persistence.

Phase 1

Triage Agent

Complete

OpenAI Agents SDK agent — auto-triage on incident create: summary, category, priority, evidence plan, GET /incidents/{id}/triage.

Phase 2

Analysis Service

Complete

Background LLM analysis: severity, summary, recommendations on ingest.

Phase 2

Operator Dashboard

Complete

Next.js web UI: incident list/detail with triage status, summary, evidence plan, and lifecycle actions.

Phase 2

Monitoring Gateway

In Progress

PagerDuty v3 inbound webhooks (pagey.ping + incident.triggered → EventIngest). Grafana / Datadog next.

Phase 2

Knowledge Service

Planned

RAG memory: runbooks, prior incidents, and technical docs (v0.4.0).

Phase 2

Investigation Engine

Planned

Evidence / Investigation and Root Cause agents — execute triage evidence plans via MCP (v0.5.0+).

Phase 2

Policy Engine

Planned

Evaluates risk, maintenance windows, and safety policies.

Phase 3

Execution Engine

Planned

Runs approved remediation via MCP tools — metrics, logs, Linux, Docker, PostgreSQL, Kubernetes.

Phase 3

Verification Engine

Planned

Confirms remediation using logs, metrics, and synthetics.

Phase 4

Learning Engine

Planned

Stores outcomes, embeddings, and operational knowledge.

Phase 4

AI Orchestrator

Agent Pipeline

Triage Agent ships in v0.4.0 — structured assessment and evidence planning on every new incident. Evidence and root-cause agents follow the same handoff chain.

1 of 3 agents live
Triage AgentCompletev0.4.0
Evidence / Investigation AgentPlannedv0.5.0
Root Cause / Recommendation AgentPlannedv0.5.0

MCP Tool Domains (roadmap)

MetricsLogsLinuxDockerPostgreSQLKubernetes

Permission Profiles

Read-onlySafe remediationPrivileged remediationHuman-approved only

Guiding Principles

Built for Trust

Every architectural decision answers one question: does this make AIRP a better AI Operations Engineer?

01

Evidence before action

02

Human approval before impactful remediation

03

Every action is auditable

04

Vendor-neutral integrations

05

Security by default

06

Every incident improves future investigations