What it is

HolmesGPT is an open-source site reliability engineering agent for production incident investigation. It is a CNCF Sandbox project written in Python under Apache-2.0. It lives in the cloud-native DevOps and observability ecosystem, and it works with Kubernetes, VMs, cloud providers, databases, and SaaS platforms.

The concrete problem it solves is slow incident response when evidence is spread across many tools. Engineers must check metrics, logs, alerts, tickets, runbooks, and cluster state before finding a root cause. HolmesGPT uses an agentic loop to query those live sources and investigate incidents, including operator mode that can find problems in the background.

Key capabilities

• HolmesGPT uses an agentic loop to query live observability data from multiple sources and identify root causes.
• Operator mode runs in Kubernetes, performs health checks against connected data sources, sends findings to Slack, and can open GitHub pull requests.
• It keeps large payloads out of context windows with server-side filtering, JSON tree traversal, and tool output transformers.
• It prevents OOM kills with per-tool memory limits, streaming large results to disk, and automatic output budgeting.
• It connects to Prometheus, Grafana, Datadog, Kubernetes, AKS, AWS, Azure, ArgoCD, Crossplane, Confluence, Coralogix, Atlassian Rovo, and custom REST API toolsets.
• It supports bidirectional alert integrations with AlertManager, PagerDuty, OpsGenie, and Jira, and works with OpenAI, Anthropic, Azure, Bedrock, and Gemini LLM providers.

Who uses it and how

• SRE teams use it to investigate production incidents by querying logs, metrics, alerts, tickets, runbooks, and cloud or cluster state.
• Operators use scheduled health checks and deployment verification to monitor services, catch regressions, and verify new versions.
• Incident teams use alert integrations to pull alerts from AlertManager, PagerDuty, OpsGenie, or Jira and return findings to the same systems.

Getting started

Use the installation and documentation pages at holmesgpt.dev. Operator mode runs in Kubernetes, while normal use works with VMs, bare metal, cloud services, or containers.

When to use it — and when not to

Use HolmesGPT when you want an open-source agent that investigates incidents across Kubernetes and non-Kubernetes stacks and connects to existing observability, alerting, and ticketing tools. Avoid it if you need a mature project with few open issues, because it is two years old and has 432 open issues. Self-hosters must operate the agent, configure LLM provider access, and connect each data source.