A curated, evidence-oriented map of AI agents for DevOps, SRE, AIOps, incident response, and root-cause analysis (RCA).
This list is for engineers deciding what to build or evaluate, researchers tracking the field, and maintainers looking for reproducible systems—not just another collection of AI links. Product capabilities are mapped to the incident lifecycle, while evidence and maturity are recorded separately.
Last reviewed: 2026-07-31 · Catalog version: 0.2.0
Contents
- Start here
- Scope and labels
- Field signals
- Open-source systems
- Commercial products
- Benchmarks and environments
- Research papers
- Tools, protocols, and datasets
- Foundations
- Model capability and economics
- Related awesome lists
- Contributing
- License and disclaimer
Start here
| Goal | Recommended starting point |
|---|---|
| Understand production RCA | Google SRE: Effective Troubleshooting → RCAgent → Why Do AI Agents Systematically Fail at Cloud RCA? |
| Try an open-source investigator | HolmesGPT, IncidentFox, or OpenSRE |
| Evaluate an agent | Evaluation guide → SREGym → OpenRCA → Cloud-OpsBench |
| Design adaptive agent workflows | ReAct → ADAS → MaAS → Scaling Agent Systems |
| Compare commercial products | Product landscape |
| Build safely | Safety and autonomy and taxonomy |
| Track changes over time | Field signals and the generated catalog report |
Scope and labels
Included resources materially support at least one stage of the operational loop:
detect → triage → localize → diagnose → plan → mitigate → verify → learn
The detailed definitions are in docs/taxonomy.md. Short labels used here:
- Maturity:
GA,Preview,Active OSS,Research, orEarly. - Evidence:
E3reproducible external evaluation;E2published methodology or artifacts;E1technical documentation/demo;E0claim only. Evidence is not product quality. - Autonomy:
L0assist only;L1recommend;L2execute with approval;L3bounded automatic execution;L4broad autonomy. See safety guidance. - Company/steward: the organization currently publishing or stewarding the resource; it does not imply sole authorship.
Commercial capabilities below are vendor-reported unless an independent evaluation is linked. Inclusion is not endorsement.
Field signals
The fast-changing part of this repository is summarized in docs/field-signals.md. The current signals are:
- evaluation is moving from static answers toward live, stateful environments and complete trajectories;
- evidence acquisition and inter-agent communication remain major failure modes, not merely model-size problems;
- causal/topology grounding is being measured as a way to reduce investigation search and tool cost;
- open-source systems increasingly combine background alert ingestion, parallel investigation, memory, and post-RCA workflows;
- project status changes quickly—archived systems and vendor lifecycle changes must be tracked, not silently forgotten.
The machine-generated catalog report exposes coverage by type, lifecycle, evidence level, maturity, and common tags.
Open-source systems
| Project | Company / steward | Primary scope | Maturity | Why it matters |
|---|---|---|---|---|
| HolmesGPT | CNCF Sandbox; created by Robusta.dev | Kubernetes/cloud investigation, RCA | Active OSS | Broad observability integrations, CLI/API/operator modes, and an explicit investigation workflow. |
| kagent | kagent project | Kubernetes-native agent framework | Active OSS | CRD-based agents and tools for Kubernetes, Istio, Helm, Argo, Prometheus, Grafana, and Cilium. |
| K8sGPT | K8sGPT project | Kubernetes diagnostics and triage | Active OSS | Analyzer-based cluster scanning with multiple model backends and explainable findings. |
| IncidentFox | IncidentFox | Incident investigation and RCA | Active OSS | Self-hostable multi-agent investigation with alert, log, and service context. |
| OpenSRE | OpenSRE project | Memory-first SRE investigation | Early | Explores episodic memory, knowledge graphs, and parallel investigation subagents. |
| Aurora | Arvo AI | Multi-cloud incident investigation | Active OSS | Self-hosted agents, sandboxed tools, infrastructure graph, alert ingestion, and post-RCA actions. |
| Grafana MCP server | Grafana Labs | Telemetry access for agents | Active OSS | A maintained MCP interface for dashboards, metrics, logs, traces, incidents, and on-call data. |
| Prometheus MCP server | Giant Swarm | Prometheus access for agents | Active OSS | Gives agents structured query and metadata access without custom glue code. |
| Observability MCP | Red Hat Observability | Prometheus observability tools | Active OSS | MCP tooling oriented toward Kubernetes and Prometheus investigation. |
| Kubernetes MCP server | Containers project | Kubernetes operations | Active OSS | Exposes Kubernetes resources and operations to MCP clients; use with strict RBAC. |
| PyRCA | Salesforce | Causal RCA library | Active OSS | Implements classical causal graph discovery, scoring, and RCA methods useful beneath agents. |
| MicroRCA | Elastisys / research project | Microservice RCA | Research OSS | A foundational topology-and-telemetry RCA baseline for microservices. |
Commercial products
This compact view names the actual product and company. Status and access can vary by region, plan, and date; follow the official link for current availability. A fuller feature/evidence matrix is in docs/product-landscape.md.
| Product | Company | Primary scope | Status | Official sources |
|---|---|---|---|---|
| AWS DevOps Agent | Amazon Web Services | Cross-account/cloud investigation, RCA, remediation planning | GA | Product · Docs · Architecture |
| Azure SRE Agent | Microsoft | Azure operations, diagnosis, mitigation orchestration, custom subagents | GA | Product · Docs |
| Gemini Cloud Assist Investigations | Google Cloud | Parallel cloud investigation using logs, metrics, configs, and assets | Preview | Docs · Technical overview |
| Bits AI SRE / Bits Investigation | Datadog | Autonomous monitor investigation, hypotheses, root-cause summary | GA | Product · Docs · Architecture |
| New Relic SRE Agent / Autopilot | New Relic | Investigation, response workflows, and observability automation | Commercial rollout | SRE Agent · Autopilot docs · iRCA |
| AI Troubleshooting Agent | Splunk, a Cisco company | Metrics/logs/traces investigation and remediation plan | Commercial | Overview · Docs |
| Dynatrace Intelligence / Davis AI | Dynatrace | Predictive, causal, generative, and agentic observability | GA | Product · Docs · RCA |
| AI SRE | Rootly | On-call investigation using telemetry, code changes, and incident history | Commercial | Product |
| AI Production Engineer | Resolve AI | On-call investigation, RCA, resolution, and operational tasks | Commercial | Product · Deep dive |
| Investigations | incident.io | AI investigation inside an incident management workflow | Commercial | Product · Launch article |
| ITOM / ITSM AI Agents | ServiceNow | Alert/incident workflows, diagnosis, and bounded operations | Commercial | ITOM docs · ITSM docs |
| L1 Agent / Root Cause Analysis | BigPanda | Event correlation, first-line triage, incident RCA | Commercial | L1 Agent docs · RCA |
| AI-powered RCA / Assistant IQ | Logz.io | Telemetry investigation and root-cause analysis | Commercial | Product · Docs |
| Olly | Coralogix | Natural-language telemetry analysis and RCA summaries | Commercial | Docs |
Benchmarks and environments
| Resource | What it tests | Scale / distinctive feature | Links |
|---|---|---|---|
| Cloud-OpsBench | End-to-end cloud incident diagnosis and remediation | 452 cases, 40 root-cause types, snapshot/digital-twin design | Paper |
| SREGym | Interactive SRE agents in realistic environments | 90 live problems; 21-problem Lite subset; fault/noise injection | Paper · Code |
| AIOpsLab | Building and evaluating autonomous cloud agents | Reproducible microservice incidents and agent interface | Paper |
| ITBench | SRE, security, and FinOps agents | 94 scenarios; exposes the large gap between demos and end-to-end resolution | Paper |
| OpenRCA | Root-cause localization on real systems | 335 failures and 68 GB of multimodal telemetry across three systems | Paper · Code/data |
| RCAEval | Microservice RCA with telemetry | 735 failure cases, multiple systems, and reproducible metric/log/trace baselines | Paper · Code/data |
| Kubernetes AI Agent Benchmark | Kubernetes troubleshooting agents | Community benchmark and task harness | Code |
| SRE-bench | Agentic SRE tasks | Early community benchmark; treat results as preliminary | Code |
| SRE Skills Bench | Operational agent skills | Early benchmark initiative; incident response coverage is evolving | Code |
| Terminal-Bench | General terminal-based agent ability | Useful supporting signal, but not a DevOps RCA benchmark | Site · Code |
Reproducible testbeds
- OpenTelemetry Demo — instrumented microservice system with feature flags and fault scenarios.
- GoogleCloudPlatform/microservices-demo — Online Boutique cloud-native reference application.
- DeathStarBench — microservice benchmark suite with realistic service graphs.
- Chaos Mesh and LitmusChaos — controlled fault injection for generating evaluation episodes.
Research papers
DevOps, AIOps, and root-cause agents
- RCACopilot: Web Service Root Cause Analysis via Large Language Models (2023) — early industrial design combining diagnostic information collection, ranking, and report generation.
- RCAgent: Cloud Root Cause Analysis by Autonomous Agents with Tool-Augmented LLMs (2023/2024) — tool-augmented agent loop and one of the central references for LLM-based cloud RCA. ACM version.
- Exploring LLM-based Agents for Root Cause Analysis (2024) — studies agent design and observability-tool interaction for RCA.
- Cloud Atlas: Efficient Fault Localization for Cloud Systems using LLMs (2024) — combines LLM reasoning with cloud-system context for localization.
- AIOpsLab: A Holistic Framework to Evaluate AI Agents for Enabling Autonomous Clouds (2025) — agent–environment interface, workload orchestration, fault injection, and evaluation.
- ITBench: Evaluating AI Agents across Diverse Real-World IT Automation Tasks (2025) — end-to-end SRE, CISO, and FinOps scenarios with sobering baseline resolution rates.
- Flow-of-Action: SOP Enhanced LLM-Based Multi-Agent System for Root Cause Analysis (2025) — injects standard operating procedures into a multi-agent workflow.
- OpenRCA: Can Large Language Models Locate the Root Cause of Software Incidents? (2025) — a large, multimodal, real-system RCA benchmark and baseline study.
- RCAFlow: Retrieval-Augmented Generation for Root Cause Analysis (2026) — connects retrieval and structured RCA workflows.
- Stalled, Biased, and Confused: Failure Modes of LLM Agents in Cloud Incident Diagnosis (2026) — taxonomy and analysis of investigation failures.
- Why Do AI Agents Systematically Fail at Cloud Root Cause Analysis? (2026) — highlights partial observability, evidence acquisition, and stopping/commitment failures.
- Cloud-OpsBench: Benchmarking AI Agents for Cloud Operations (2026) — scalable environment snapshots and broad incident coverage.
- LATS-RCA: Language Agent Tree Search for Root Cause Analysis (2026) — explores explicit search over diagnostic trajectories.
- Towards In-Depth Root Cause Localization with Agentic Reasoning (2026) — moves from coarse service localization toward deeper causal explanation.
- Causely: A Causal Intelligence Layer for Enterprise AI (2026) — controlled study of how causal/topology grounding changes diagnosis accuracy, latency, tool calls, tokens, and cost; results are first-party and should be independently replicated.
- Large Language Models for Agentic NetOps and AIOps (2026) — survey organized around autonomy, evidence traces, assurance contracts, workflow evaluation, canaries, and rollback-aware safety.
Agent architecture, search, and scaling
- ReAct: Synergizing Reasoning and Acting in Language Models (2022) — the basic reasoning/action/observation loop behind many operational agents.
- Reflexion: Language Agents with Verbal Reinforcement Learning (2023) — reflection and episodic feedback without parameter updates.
- Automated Design of Agentic Systems (2024) — searches over executable agent designs rather than hand-selecting one fixed workflow.
- AFlow: Automating Agentic Workflow Generation (2024) — optimizes workflows represented as code through iterative search.
- Multi-agent Architecture Search via Agentic Supernet (2025) — treats candidate multi-agent architectures as paths in a supernet and adapts architecture to tasks.
- Towards a Science of Scaling Agent Systems (2025) — empirical laws for when additional agents help or hurt, emphasizing task properties and coordination overhead.
Classical and causal RCA foundations
- MicroRCA: Root Cause Localization of Performance Issues in Microservices (2020) — topology-aware anomaly propagation baseline.
- PyRCA: A Library for Metric-based Root Cause Analysis (2023) — practical library and benchmark of causal/graph-based methods.
- A Goal-Driven Survey of Root Cause Analysis (2025) — organizes RCA by goal, signals, assumptions, and evaluation rather than by model name.
- RCAPapers — a broader paper index when this intentionally selective list is not enough.
Tools, protocols, and datasets
Agent-to-system interfaces
- Model Context Protocol — standard interface for connecting models to tools and contextual data.
- Agent2Agent Protocol — interoperability protocol for communicating agents.
- OpenTelemetry — vendor-neutral traces, metrics, and logs; the natural observation layer for portable agents.
- Prometheus HTTP API and Grafana HTTP API — foundational structured observability interfaces.
Incident and operational data
- OpenRCA data — multimodal failure data and benchmark tooling.
- Loghub — public log datasets for log parsing and anomaly research; not an end-to-end agent benchmark.
- AIOps Challenge datasets — historical anomaly/RCA data used by AIOps research.
Foundations
DevOps and SRE
- Site Reliability Engineering — focus on monitoring distributed systems, effective troubleshooting, incident management, automation, and postmortems.
- The Site Reliability Workbook — practical SLOs, alerting, incident response, and operational implementation.
- Google Cloud Architecture Framework: Operational Excellence — operational readiness and lifecycle framing.
- Incident Command System — useful background for roles, escalation, and coordination during high-severity incidents.
Agent engineering
- Anthropic: Building Effective Agents — practical distinction between workflows and agents, with compositional patterns.
- LangGraph, AutoGen, Semantic Kernel, and CrewAI — general orchestration frameworks; inclusion here does not imply DevOps-specific quality.
- OpenAI Agents SDK — agent primitives, handoffs, guardrails, sessions, and tracing.
Safety and reliability
- NIST AI Risk Management Framework — general AI governance and risk vocabulary.
- OWASP Top 10 for LLM Applications — prompt injection, excessive agency, sensitive information, and supply-chain risks.
- SLSA — software supply-chain integrity relevant to agent-generated changes and tools.
Model capability and economics
General model rankings are supporting signals, not substitutes for an RCA benchmark.
- Artificial Analysis Intelligence Index — composite capability index; always record its version and date.
- Artificial Analysis methodology — explains benchmark composition and weighting.
- Artificial Analysis API — useful for a versioned model-cost/latency dashboard.
- SWE-bench — software engineering capability; relevant to repair, less so to observation and diagnosis.
- LiveBench — contamination-aware general model evaluation.
- HELM — transparent, multi-metric evaluation framework.
For operational agents, track at least: task success, root-cause precision and ranking, evidence quality, calibration/abstention, time and tool calls, cost, latency, recovery from misleading observations, safety violations, and human effort. See docs/evaluation.md.
Related awesome lists
- awesome-devops-ai — broad AI × DevOps tools and resources.
- awesome-ai-sre — AI-assisted SRE resources.
- awesome-sre-agents — SRE agent ecosystem.
- awesome-LLM-AIOps — research-heavy LLM-for-AIOps collection.
- awesome-harness-engineering — engineering patterns around agent harnesses.
- awesome-sre — broad SRE foundations.
Contributing
Contributions are welcome. Please read CONTRIBUTING.md before opening a pull request. Every addition must state:
- the operational stage it supports;
- who publishes or maintains it;
- maturity and evidence level;
- why it is distinct from existing entries;
- an official or primary source—not only a launch tweet or aggregator.
The companion machine-readable index is catalog/resources.yaml, validated against catalog/schema.json.
License and disclaimer
To the extent possible under law, this curation is released under CC0 1.0. Linked projects, papers, names, and trademarks retain their own licenses and rights.
This list is informational. Validate security boundaries, data handling, permissions, and rollback behavior before allowing any agent to operate production systems.