DOCS

Platform overview

What Keel does, the architecture that does it, and the path from a single make all to a fully instrumented incident response pipeline.

What Keel does

  1. Detect — Prometheus evaluates alert rules against a local TSDB every 15 seconds.
  2. Route — Alertmanager fans critical alerts to the AI pipeline and Communication MCP.
  3. Triage — The supervisor agent classifies severity and assigns an incident ID. A correlation engine groups related alerts using temporal and causal signals.
  4. Investigate — The observability agent queries metrics, logs, and traces. A Neo4j knowledge graph maps blast radius. Context prioritisation selects the top three relevant services within a 4,000-token budget. An LLM synthesises the root cause analysis.
  5. Remediate — A runbook is selected — and optionally enriched by the LLM for critical incidents. An approval gate blocks auto-remediation when priority exceeds 0.8. A five-state lifecycle tracks the incident from triage through resolved.
  6. Notify — A ticket is created in Jira or ServiceNow with auto-transition to Done on closure. Slack/Teams/PagerDuty via Communication MCP. Multi-channel Slack (eight channels) plus Teams and ServiceNow are notified, with per-channel on/off flags.
  7. Resolve — Three resolution paths converge on one handler: OmniView's Mark Resolved button, Alertmanager's auto-resolve webhook, or a direct API call.
  8. Learn — The RCA is seeded into the knowledge base. Episodic memory stores the incident for similarity matching against future alerts, so recurring failures resolve faster with each iteration.
  9. Monitor — A usage report tracks tokens, cost, and latency per provider. Server-sent events stream live updates to the OmniView dashboard with a LIVE badge.

All of this happens in under a minute, with zero human intervention for known failure patterns. For anything novel or high-priority, the approval gate stops and waits for a human to sign off.

The architecture in seven layers

Keel separates responsibility across seven discrete layers. Each layer has a single job, a single set of dependencies, and a single failure profile — so you can replace any one without rewriting the others.

1. Signal generation A Python OpenTelemetry generator simulates six services across eight failure modes. 2. Telemetry collection & routing The OTel Collector receives OTLP signals and routes them to three specialised stores. 3. Telemetry stores Mimir stores metrics (90 days), Loki stores logs (30 days), Tempo stores traces (3 days) — all backed by MinIO object storage. 4. Rule evaluation & alerting Prometheus evaluates alert rules every 15 seconds and fires through Alertmanager to both the AI pipeline and the paging system. 5. AI incident response The supervisor agent runs a LangGraph finite state machine; the observability agent runs a six-step RCA pipeline; the LLM gateway governs backend calls with circuit breakers and cost caps. 6. MCP servers & integrations Model Context Protocol servers expose metrics, logs, traces, infrastructure operations, ticketing, and comms to the agents as tools. 7. Knowledge, visualisation & secrets Neo4j maps service topology, the knowledge base retains RCAs, Vault holds credentials, and the OmniView dashboard gives operators one pane of glass.

Every layer runs in its own container. The full stack spins up in 29 containers on a single docker compose up.

Further reading