42 specialist agents.

Gathers evidence from live cluster state and forms a sealed hypothesis. Uses only the 15 read-only MCP tools. Every conclusion cites the exact tool call, field name, and value. Never proposes fixes.

Independent blind reviewer — receives the same raw evidence bundle but not the investigator's hypothesis. Forms its own conclusion first, then compares. Disagreements surface to you, never silently resolved.

Generates a GitOps PR from a confirmed hypothesis. Resolves the owning Git repo from ArgoCD or Flux annotations, generates a minimal patch, and opens a PR with rollback plan and verification checklist. Never applies directly to the cluster.

Scans Kubernetes workloads for privileged containers, hostNetwork access, RBAC wildcards, missing network policies, and image security issues. Assumes everything is misconfigured until proven otherwise.

Read-only Kubernetes resource efficiency analysis. Identifies over-provisioned limits, idle workloads, and namespace waste by comparing resource requests and limits to actual usage.

Pre-merge and post-deploy risk analysis. Reviews deployment changes for blast radius, resource limit correctness, image tag hygiene, and probe configuration before they reach production.

Audits operational runbooks against live cluster state. Produces a scored report with specific update recommendations for stale commands, wrong resource names, and missing steps.

Diagnoses ArgoCD sync failures, OutOfSync resources, degraded app health, hook failures, and RBAC issues. Knows the failure modes general-purpose debugging misses — admission controller mutations, TTL-less jobs, runtime label drift.

Diagnoses Flux reconciliation failures, HelmRelease errors, source controller issues, and configuration drift. Covers GitRepository auth failures, corrupt Helm release history, suspended Kustomization dependencies, and ImageAutomation branch protection conflicts.

Diagnoses Helm release failures, upgrade issues, values conflicts, chart deprecations, and plans rollbacks. Knows that helm upgrade --atomic is not always safe and that helm rollback can fail when previous resources were deleted out-of-band.

Investigates AWS incidents across ECS, Lambda, RDS, ALB, and other services using read-only describe/list commands. Knows which CloudWatch metrics to pull first and how to distinguish a code bug from an infrastructure failure in under 60 seconds.

EKS-specific diagnostics covering managed node groups, Karpenter, aws-auth ConfigMap, IRSA, and EKS add-ons. Covers the failures that look like Kubernetes problems but are actually EKS-specific: IAM misconfigurations, OIDC provider issues, add-on conflicts.

Reviews AWS IAM policies for least-privilege violations, wildcard permissions, and cross-account trust issues. Catches 'Action: *' on production roles and trust policies not cleaned up after migrations.

Diagnoses AWS VPC connectivity issues including security groups, NACLs, routing tables, VPC peering, and Transit Gateway. Has debugged asymmetric routing in Transit Gateway and NACLs blocking return traffic that security groups allowed.

Diagnoses RDS performance issues: slow queries, connection exhaustion, storage growth, failover events, and parameter group tuning. Knows that IOPS exhaustion looks identical to CPU exhaustion from the application's perspective.

Identifies AWS cost anomalies, rightsizing opportunities, and waste from Cost Explorer data. Follows the money to the owner — idle EC2 instances, NAT Gateways pushing terabytes to nowhere, RDS clusters idle since the migration.

Investigates GCP incidents across GKE, Cloud Run, Cloud SQL, and other services. Covers GKE node pool upgrade drain storms, Cloud Run cold start storms, Cloud SQL failover timing, and Load Balancer health check misconfiguration.

Reviews GCP IAM for overly broad roles, service account key age, and Workload Identity configuration. Always finds Editor on service accounts, 3-year-old service account keys, and Workload Identity silently falling back to the node's default account.

Analyzes GCP costs including committed use discounts, idle VMs, BigQuery slot waste, and networking costs. Knows that BigQuery on-demand can silently consume thousands of dollars and that Cloud NAT logging on high-traffic networks can double logging costs.

Investigates Azure incidents across AKS, App Service, Azure SQL, and related services. Covers AKS scale-out hitting subscription vCPU quotas silently, App Service CPU throttling, Azure SQL DTU exhaustion, and Load Balancer health probe aggression.

Reviews Azure RBAC for Owner/Contributor scope issues, service principal problems, and managed identity configuration. Finds Contributor at subscription scope 'because it was easier,' expired service principal secrets, and managed identities falling back to key-based auth.

Reviews Terraform plans for cost impact, blast radius, security issues, and naming violations before apply. Treats every destroy as a potential P0 until proven otherwise and every replace as something needing explicit justification.

Analyzes Terraform state for drift, orphaned resources, and import candidates. Read-only. Has debugged state corruption, untangled imported resources, and fixed drift accumulating silently for months.

Scans Terraform code for exposed secrets, overly permissive IAM, public S3/storage buckets, and unencrypted resources. Treats every permissive default as a vulnerability until it has a business justification.

Estimates monthly cost impact of Terraform changes using resource types, sizes, and regions. Catches the db.r6g.2xlarge Multi-AZ at $1,400/month and forgotten EBS volumes before they hit the bill.

Reviews Terraform module versions, deprecated providers, and breaking changes in upgrades. Tracks provider changelogs and knows which AWS provider versions broke aws_iam_policy and why pinning to ~> 4.0 without reading the upgrade guide is a mistake.

Projects capacity needs from current usage trends, growth assumptions, and headroom requirements. Uses actual utilization data and growth rates rather than rough guesses at future scale.

Reviews platform architecture decisions including control plane choices, multi-tenancy models, and developer experience tradeoffs. Has evaluated the build-vs-buy decision enough times to have a framework.

Diagnoses GitHub Actions workflow failures including syntax errors, secret references, runner issues, and flaky tests. Knows every failure mode: wrong environment secret scope, ubuntu-latest runner version bumps, matrix concurrency limits, reusable workflow default branch breakage.

Diagnoses GitLab CI pipeline failures including runner registration issues, variable scoping, artifact expiry, and pipeline configuration errors. Covers offline runners, expired deploy token credentials, needs: DAG cycles, and include: template version drift.

Manages release process including readiness checklists, go/no-go decisions, rollback criteria, and stakeholder communication. Brings discipline to releases that go wrong because staging was skipped or the support team wasn't notified.

Writes and debugs PromQL queries, reviews alert rules, identifies metric cardinality issues, and recommends recording rules. Knows that rate() needs at least 4 data points, that high-cardinality labels kill a Prometheus instance, and that alerts without a for: duration fire on single scrape failures.

Analyzes structured log patterns and writes log queries for Elasticsearch/OpenSearch, Loki, CloudWatch Logs Insights, GCP Cloud Logging, and Splunk. Writes efficient, targeted queries and knows the syntax differences between every major log platform.

Creates Grafana dashboard JSON for SRE use cases including RED method, USE method, and SLO dashboards. Builds dashboards that help engineers during incidents — not ones that look good in a demo but have 12 panels nobody understands under pressure.

Reviews alerting rules for noise, missing coverage, threshold calibration, and alert fatigue. Has silenced PagerDuty because alert fatigue made on-call meaningless, and has also missed a real outage because the alert was on the wrong metric.

Runs structured incident response including timeline, role assignments, communication, escalation, and status updates. Knows that an incident without a commander is organized panic and that stakeholder communication is as important as the technical fix.

Designs SLO and SLA definitions, error budgets, and burn rate alerts from service requirements. Knows that 99.9% availability means 8.7 hours of downtime per year and that burn rate alerts need multi-window multi-burn-rate to catch both fast burns and slow leaks.

Walks on-call engineers through unfamiliar alerts with structured questions and checklists. Doesn't just hand over answers — builds diagnostic intuition for engineers inheriting undocumented systems at 2am.

Extracts concrete prevention tasks from incident postmortems. Turns 'we need to improve alerting' into a specific GitHub issue with acceptance criteria — tasks specific enough to be assigned and completed.

Checks infrastructure and Kubernetes configurations against CIS benchmarks for Kubernetes, AWS, GCP, and Azure. Knows the difference between Level 1 (baseline) and Level 2 (defense-in-depth) controls and which ones are actually exploited.

Finds hardcoded secrets in configs, manifests, and environment variables. Reports locations only, never outputs secret values. Has found AWS keys in Kubernetes ConfigMaps and JWT signing keys in Helm values files.

Reviews container image provenance, SBOM presence, signing verification, base image age, and known CVE exposure. Treats every unsigned image from an unverified registry as unverified code execution.