What it does
You give it an incident description and the questions you want answered. It runs the aggregate → pivot → trace flow to localise the regression, correlating metrics against logs and traces, and returns structured findings with Grafana deeplinks so each claim can be checked.What it reads
All of it read-only.Before you deploy
Three ways to reach Grafana
The Grafana connection is listed as optional because the second path replaces it: a self-hosted
agent pointed at your own in-cluster server needs no connection here. Add one only to use the
agent’s built-in Grafana tooling.
Ask it for
In chat, or as a run’s prompt:incident_description, questions, affected_services,
investigation_start, context and budget_seconds.
Defaults and limits
The time budget degrades rather than fails. At 70% the agent is nudged to converge; at 100% further
tool calls are refused and it reports what it has.
In a workflow
This is a specialist, not a lead. An orchestrator delegates the Grafana slice of an incident to it and synthesizes its findings with the other specialists’. Because it reads alerts as well as telemetry, it also works as the verification step after a remediation — asking whether the signal that fired has actually recovered. See Orchestration for how a step delivers work to it.What it will not do
It never writes to Grafana. It cannot silence an alert, close an incident, edit a dashboard or add an annotation. It is bounded by retention and by what its path can reach. A self-hosted agent pointed at your own in-cluster server sees exactly what that server exposes, and it reports an unreachable data source rather than working around it.Next steps
MCP Gateway
Register a remote MCP server for the third path.
Cluster Investigator
The same Grafana telemetry, combined with cluster and GPU signals.
Datadog Investigator
The same investigation shape, over Datadog.
Agent catalog
Every catalog agent, side by side.