Operate is a self-hosted AI SRE: an AI agent platform that detects, investigates, and resolves production issues. It runs a four-agent pipeline (Context, Root Cause, Verification, and Resolution) that connects to your logs, database, and codebase, then produces an evidence-backed root cause and a draft pull request for human review.

An AI SRE is an AI system that does the work of a site reliability engineer: watching production for errors and regressions, investigating alerts, finding root causes, and proposing fixes. Operate is a self-hosted AI SRE, so it runs inside your own infrastructure with read-only access and a mandatory human approval gate.

How does Operate find the root cause of a production issue?

When triggered from chat (Slack, MS Teams, and other tools) or by an automated alert, Operate pulls traces from log providers like Datadog, CloudWatch, GCP Cloud Logging, and SolarWinds, queries your MongoDB, PostgreSQL, or MySQL database in read-only mode, and reads your codebase via git including blame and diff. A Context Agent gathers signals, a Root Cause Agent proposes a cause with a confidence score, a Verification Agent independently checks the reasoning with a different model, and a Resolution Agent drafts a fix as a pull request.

Does Operate ship code automatically without a human?

No. Operate stops at a draft pull request. A human engineer must review and merge; nothing ships without approval. Every agent step is auditable so reviewers can see the evidence and reasoning behind each finding.

How is Operate deployed?

Operate is deployed as a Docker image into your existing infrastructure with no new cloud accounts. It runs on port 8080 under the /operate path, requires MongoDB and Redis, and uses an App ID from operate.bettrsw.com. It connects via read-only adapters to logs, databases, and observability stacks, and clones your repo at startup via an init container so agents have full git history.

Which integrations does Operate support?

Operate's context layer spans 60+ integrations across 14 categories: source control (GitHub, GitLab), logs (Datadog, CloudWatch, GCP Cloud Logging, SolarWinds), databases (MongoDB, PostgreSQL, MySQL, read-only), error tracking (Sentry, Rollbar), APM (New Relic, Grafana, OpenTelemetry), CI/CD (GitHub Actions, Jenkins, Vercel), feature flags (LaunchDarkly, Statsig), cloud infrastructure (AWS, GCP, Azure, Kubernetes), queues (Kafka, SQS, RabbitMQ), incident management (PagerDuty, incident.io), issue tracking (Jira, Linear, Asana), support (Zendesk, Intercom), status pages, and docs (Confluence, Notion). Triggers: Slack, MS Teams, and other chat tools for on-demand RCA, plus the observability stack for proactive monitoring. AI providers: Anthropic Claude, OpenAI/Azure Codex, enterprise models, or self-hosted open-source LLMs.

How does Operate avoid hallucinated root causes?

Operate uses a two-model verification step. The Root Cause Agent proposes a cause with specific evidence; the Verification Agent, running on a different model to avoid correlated errors, independently evaluates the reasoning. Speculative or unsupported conclusions are rejected before reaching the team.

Why not just point an LLM at our logs ourselves?

An LLM has no inherent knowledge of your logs, schemas, services, or known-bad patterns. Operate provides the connectors, permissions, query layer, repo context, multi-agent verification, and operational runtime that turn a generic model into a reliable production-investigation system.

Engineering teams that lose 30–40% of capacity to unplanned investigation: support escalations, error alerts, performance regressions. With Operate, support and product teams can trigger an RCA from Slack, MS Teams, or whatever chat tool they use, and only loop in engineers when a decision needs to be made.

← All repos

github

hashicorp/vault

Pick an open issue and Operate will investigate its root cause.

1,253 open issues

#32036 VAULT_TOKEN leakage in Vault docker testcluster environment using version v0.25.1.
docker
cryptosec
#32035 Vault Agent aborts evaluation of all temlates and reschedules all if one fails
bug
agent
#32034 Vault Kubernetes Auth Missing JWT Operation on UI
ui
bug
auth/k8s
#32031 Vault agent template render with 'writeToFile' and 'pkiCert’ changes files on disk on every render cycle causing file watchers reloading services
bug
agent
#32030 Clarify changelog fragment workflow for contributors
enhancement
#32026 Missing request ID in audit entries for help requests
bug
core/audit
#32022 Vault Agent auto-auth re-authentication appends headers instead of replacing existing header keys
bug
agent
auth/kerberos
#32021 [Plugin Portal] Plugin Submission - Salesforce Secrets Engine
ecosystem/plugin
#32018 Reading CRL from Vault CLI as DER may output an invalid CRL file
bug
secret/pki
theme/cli
#32016 "/usr/local/bin/docker-entrypoint.sh: line 97: setcap: not found" in docker logs of vault
bug
docker
#32013 Vault 2.x billing fails with "lz4: bad magic number"
bug
core/metric
#32008 Code quality observations (0 high priority)
#32006 Potential sensitive files found in repository
#32003 [Feature Request] PKI Engine: Rate Limiting per CN/SAN to prevent Raft storage exhaustion (DoS vector)
enhancement
secret/pki
#32001 AWS Secrets Engine IAM user creation fails with tag-enforcing SCPs because tags are applied after CreateUser
enhancement
secret/aws
#31995 Vault Agent: auto-auth self-healing not wired for proxy/cache requests (missing channel assignment in `command/agent.go`)
bug
agent
#31992 OSS-Fuzz integration — Go fuzz tests for Shamir Secret Sharing
cryptosec
ci
#31990 "Not valid after" is not honored when generating root certificate or sign intermediate certificate
ui
bug
secret/pki
#31987 PKI ACME: acmeFinalizeOrderHandler lacks per-order locking — concurrent finalize double-issues and orphans a cert from order-keyed tracking
bug
secret/pki
data-race
#31986 api: Logical.writeRaw cancels the response body's context before the caller reads it (same defect as #18658, write/patch path)
bug
clientapi
#31972 Vault KV UI — Critical UX Issue: "Manage" Button Accessible Inside Folders Allows Accidental Engine Disable
ui
secret/kv
#31970 2.0.1 docker-entrypoint.sh broken
agent
k8s
docker
regression
#31954 CIDR notation in NO_PROXY is not evaluated
bug
core/cli
#31941 Failed to bind with current password "data 52e"
bug
secret/ldap
#31938 Release version v2.0.0 required for vault/api
dependencies
#31934 Hide secrets recover tab without enterprise license
ui
enhancement
#31933 snapshot restore functionality broken
bug
#31925 PKI: enforce_hostnames=false does not allow underscores in DNS SANs
bug
secret/pki
#31924 Separate permission for creating orphan tokens
enhancement
core/token
#31919 Vault 2.0.0 Docker image fails to start: unable to set CAP_SETFCAP effective capability
bug
docker
regression