Investigate incidents with multi-agent SRE workflows
AURA is a production-tested SRE agent platform, run in your own security boundary, that investigates incidents across your cloud and observability tools.
0.2.17Add to Favorites
Why it matters
Deploy production-ready SRE agent teams that investigate incidents by correlating logs, metrics, traces, and infrastructure state across your observability stack, then recommend remediation actions within operator-defined security boundaries.
Outcomes
What it gets done
Correlate failures across Kubernetes, Prometheus, logs, and traces to identify root causes
Coordinate specialist agents to investigate payment failures, latency spikes, and deployment issues
Require human approval before executing sensitive infrastructure changes
Export OpenTelemetry traces for every model call, tool execution, and orchestration decision
Source
Get it from source
Spark does not host a copy of it.
Open sourceReports
Agent outcome reports
No reports yet
Overview
Aura
AURA is a production-tested SRE agent platform that connects AI models to your real observability, cloud, and ticketing tools through MCP servers, inside your own security boundary. Agent teams, prompts, tools, and approval policies are defined in reviewable TOML, and every model and tool decision can be exported as OpenTelemetry traces. It supports OpenAI, Anthropic, Bedrock, Gemini, Ollama, and OpenRouter models interchangeably. Use it to stand up an incident-investigation agent that reasons over your actual infrastructure and observability tools, including in air-gapped or regulated environments.
What it does
AURA is a production-tested SRE agent platform that connects AI models to production tools and infrastructure within operator-defined boundaries, handling the guardrails, APIs, state management, streaming, failure handling, and observability that connecting an LLM to real systems requires. It began as Mezmo's internal harness for operating its own SaaS, is still used by Mezmo's engineering and SRE teams for production operations, runs in other teams' production environments outside Mezmo, and powers thousands of agent sessions a month inside Mezmo's hosted observability platform. The whole agent system - models, specialist agent teams, per-agent prompts, tools, approval policies, and guardrails - is defined in reviewable, versionable TOML configuration. It runs OpenAI, Anthropic, Bedrock, Gemini, Ollama, or OpenRouter models interchangeably, switching providers with a config change or assigning different models to different roles, and can coordinate multi-agent workflows with dependency-aware task execution, parking oversized tool results on disk for selective retrieval rather than flooding context. Agents can load task-specific Agent Skills instructions only when needed, be served through an OpenAI-compatible API so existing clients like LibreChat and OpenWebUI work unchanged, interoperate with other agents over A2A, or be embedded directly as AURA's Rust core inside another application. Sensitive tool calls can be put behind human approval - via webhook or in-conversation - with denial, timeout, and transport failures all handled fail-closed, and every model call, tool call, and orchestration decision can be exported as OpenTelemetry traces for end-to-end investigation.
Install it with:
curl -fsSL https://raw.githubusercontent.com/mezmo/aura/main/scripts/install.sh | bash
then aura init to choose a model provider and write an initial config, and aura to start the agent.
When to use - and when NOT to
Use it to stand up an SRE or operations agent that investigates real incidents against your actual observability, cloud, and ticketing tools - correlating traces, logs, metrics, and deployment history - while keeping model, tool, storage, and telemetry destinations inside your own security boundary, including air-gapped or highly regulated environments where model providers and MCP servers are locally reachable. It is not a black box: credentials only stay out of prompts when referenced from designated authentication fields, and environment substitution used directly in prompt-bearing fields does place those values into model context, so configuration needs the same review discipline as any other production system. Enabled client-side tools and STDIO processes can also initiate additional network traffic unless a system-level network policy prevents it.
Capabilities
Through compatible MCP servers, AURA agents can inspect cloud resources, logs, metrics, and operational state on AWS, Azure, and GCP; query Datadog, New Relic, and Prometheus metrics, monitors, and traces; inspect Kubernetes clusters, workloads, and events; inspect Docker containers and Kafka clusters/topics/consumer groups; search and work with GitHub/GitLab repositories, issues, and pull or merge requests; search and maintain runbooks in Confluence and Notion; search and update Jira issues; investigate PagerDuty incidents, on-call schedules, and escalations; and analyze Mezmo logs, exports, and telemetry pipelines. Tools themselves are discovered from any compatible MCP server over Streamable HTTP, SSE, or STDIO, and agents can ground responses through Qdrant or AWS Bedrock Knowledge Bases.
How to install
Install via the published install script (above), which downloads release artifacts and verifies their checksums. AURA can then run as a local interactive chat assistant from the terminal, as a daemon (aura webserver) wired to monitoring systems, as the published mezmo/aura Docker container, as a Kubernetes workload via the included Helm chart, or embedded as a library by linking AURA's Rust core directly into another application.
Who it's for
SRE and platform engineering teams who want an incident-investigation agent that reasons over their own observability and infrastructure tools inside their own security boundary, with reviewable configuration, swappable model providers, and human approval gates on sensitive actions. Apache-2.0 licensed.
Source README
AURA
AURA is a production-tested SRE agent platform you can deploy in minutes.
In this demo, AURA investigates a payment failure by correlating Mezmo traces and logs, Prometheus latency, and Kubernetes deployment history. Three specialist agents identify an N+1 regression introduced by productcatalogservice 1.13.2, recommend rolling back to 1.13.1, and provide recovery checks and engineering follow-up.
Quick Start · Integrations · Documentation · Roadmap · Explore · Community
Connect your stack through guided setup, and AURA's preconfigured team of agents starts investigating incidents using the models you already rely on. From there, customize existing agents or add new ones to fit your infrastructure and SRE workflows.
AURA handles the guardrails, APIs, state management, streaming, failure handling, and observability needed to connect AI models to production tools within operator-defined boundaries.
Proven in Production
AURA began as Mezmo’s internal harness for operating our own SaaS. Our engineering and SRE teams still use it for production operations today, and teams outside Mezmo run AURA in their own production environments.
AURA also powers thousands of agent sessions each month in Mezmo’s hosted observability platform.
Quick Start
Install AURA on Linux or macOS with the install script. It downloads published release artifacts and verifies their checksums.
curl -fsSL https://raw.githubusercontent.com/mezmo/aura/main/scripts/install.sh | bash
Create a ready-to-run local agent:
aura init # Choose an LLM provider and initial model, and write the initial config file
Start the agent:
aura
Why AURA
- Operate inside your own security boundary. Run AURA in your infrastructure, including air-gapped and highly regulated environments, with control over model, tool, storage, and telemetry destinations.
- Define the entire agent system in reviewable TOML. Keep models, specialist agent teams, per-agent prompts, tools, approval policies, and guardrails together in configuration that can be versioned and reviewed.
- Use different model providers without rebuilding workflows. Run OpenAI, Anthropic, Bedrock, Gemini, Ollama, or OpenRouter; switch providers with a configuration change or assign different models to different roles.
- Put sensitive actions behind human approval. Require webhook or in-conversation approval before configured tool calls execute, with denial, timeout, and transport failures handled fail-closed.
- Trace every model, tool, and orchestration decision. Export OpenTelemetry traces for requests, LLM turns, tool calls, and multi-agent execution so each result can be investigated end to end.
Extensible Runtime
- Connect tools and RAG. Discover tools from compatible MCP servers over Streamable HTTP, SSE, or STDIO, and ground agents through Qdrant or AWS Bedrock Knowledge Bases.
- Build multi-agent workflows. Coordinate specialist agent teams with dependency-aware task execution while parking oversized tool results on disk for selective retrieval.
- Add reusable Agent Skills. Load task-specific Agent Skills instructions and supporting files only when they are needed.
- Interoperate or embed. Connect AURA with other agents over A2A or embed its Rust core directly in your application.
- Use existing clients and SDKs. Serve agents through an OpenAI-compatible API so clients such as LibreChat and OpenWebUI work unchanged, or run them locally through the AURA CLI.
Production Safety
Production controls define an operator-managed boundary around AURA:
- Runs in your infrastructure, including air-gapped environments when model providers and MCP servers are locally reachable.
- AURA sends agent prompts and tool data to the model providers, MCP servers, approval services, storage backends, and tracing destinations you configure. Enabled client-side tools and STDIO processes can initiate additional network traffic unless system-level network policy prevents it. Mezmo CLI product telemetry is separately disclosed and controlled.
- Sensitive tool calls can require explicit human approval.
- Credentials supplied through environment variables or secret mounts remain outside prompts only when referenced from designated authentication fields; environment substitution in prompt-bearing fields places their values into model context.
- Tool, model, and orchestration activity can be exported as OpenTelemetry traces.
See the complete security and data-handling model, including telemetry defaults, permission boundaries, prompt-injection risks, and supply-chain verification.
Integrations
Through compatible MCP servers and built-in integrations, AURA agents can work with:
| Integration | What agents can do |
|---|---|
| Argo CD | Inspect applications, sync status, and hook logs, and re-run syncs |
| AWS | Inspect cloud resources, logs, metrics, and operational state |
| Azure | Inspect cloud resources, deployments, monitoring, and operational state |
| ClickHouse | Query system tables for disk, merge, and replication health |
| Confluence | Search and maintain operational runbooks |
| Dash0 | Query hosted OpenTelemetry traces, metrics, and logs |
| Datadog | Query metrics, monitors, dashboards, and traces |
| Docker | Inspect containers, images, logs, and runtime state |
| GCP | Inspect cloud resources, logs, metrics, and operational state |
| GitHub | Search code and work with repositories, issues, and pull requests |
| GitLab | Search code and work with repositories, issues, merge requests, and pipelines |
| Grafana | Query dashboards, alert rules, logs, and metric data sources |
| Jira | Search and update issues, projects, and workflows |
| Kafka | Inspect clusters, topics, consumer groups, and message flows |
| Kubernetes | Inspect clusters, workloads, events, and logs |
| Linear | Search and update issues, projects, and cycles |
| Mezmo | Analyze logs, exports, and telemetry pipelines |
| New Relic | Query metrics, logs, traces, alerts, and dashboards |
| Notion | Search and maintain operational runbooks |
| PagerDuty | Investigate incidents, on-call schedules, and escalations |
| Prometheus | Query metrics and alert status |
| Qdrant | Retrieve runbooks and reference material from vector collections |
| Slack | Read incident channels and post investigation updates |
| Temporal | Run agent investigations as steps in durable workflows |
| Windows Server | Inspect services, drives, processes, and resource usage |
Ways to Run AURA
- As a local chat assistant. Run AURA interactively from your terminal.
- As a service. Run
aura webserveras a daemon and connect it to monitoring systems to trigger agent workflows. - As a container. Run the published
mezmo/auraDocker image. - As a Kubernetes workload. Deploy AURA with the included Helm chart.
- As a library. Embed AURA's Rust core directly in your own application.
Explore AURA
- Browse agent configurations and advanced quickstarts
- Browse the annotated configuration reference
- Run a Kubernetes SRE agent
- Learn the full AURA CLI
- Use AURA's streaming API
- Develop AURA or contribute
Community
Join the AURA Slack community to ask questions, share what you are building, and help shape the roadmap.
Package Hosting
Package repository hosting is graciously provided by Cloudsmith, the only fully hosted, cloud-native, universal package management solution - letting your organization create, store, and share packages in any format, to any place, with total confidence.
FAQ
Common questions
Discussion
Questions & comments · 0
Sign In Sign in to leave a comment.