Ongrid: Open-Source AI Agent Automates Full-Cycle Incident Response

What Is Ongrid

Ongrid is an open-source AI Agent for operations, released in late May 2024. Its goal is to let an Agent understand infrastructure, find root causes automatically, and even remediate issues — all within Feishu, DingTalk, or WeCom. The architecture splits into two components: Manager (installed on a server) and Edge (installed on each managed host). Edge initiates only outbound connections; no inbound ports (22, 80, 443) need to be open, which suits high-security environments. Monitoring stack (Prometheus, Loki, Tempo, Grafana) is bundled and pre-configured; the Agent writes its own PromQL queries so operators do not have to.

Core Features

Automated Alert Investigation

When an alert fires, Ongrid launches an investigation workflow: it collects metrics, logs, and trace data, enriches them with topology and device information, and posts a evidence-backed analysis report with next-step suggestions back to the chat group. Operators open the chat and already see a completed investigation report.

Topology Map for Impact Analysis

Service, cluster, and device dependencies are rendered as a topology graph. On alert arrival, the graph shows which services are affected and the blast radius. Kubernetes resources can be attached to the same graph.

Model Flexibility

The Agent is model-agnostic; users supply their own API keys. Supported domestic models include GLM, DeepSeek, and Kimi; international models include Anthropic, OpenAI, and Gemini. Models can be hot-swapped. Data stays on-premise, so picking a domestically accessible model satisfies compliance.

Read-Only by Default with Approval Gates

Host tools exposed to the Agent are read-only: a bash sandbox plus 26 inspection utilities, each call audited. Any write operation requires human approval before execution. This guardrail is essential because few teams trust AI to mutate production directly; investigation can be autonomous, but changes stay under human control.

Kubernetes Cluster Management

Clusters are registered via Edge; workloads, events, and upgrades become visible. Cluster resources are automatically linked into the topology graph. Teams running multiple clusters no longer need to switch kubectl contexts.

Unified Monitoring Dashboard

Host health, logs, traces, and alert status live in a single workbench. The Agent pulls data from here, and humans view the same data, eliminating discrepancies.

Workflow Orchestration

A visual canvas lets users connect triggers (scheduled or event-based), conditions, Agent nodes, and notifications to build automation flows without code. For example, "on alert, run investigation, push result to chat" is assembled by dragging nodes.

Shared Knowledge Base

Runbooks, notes, historical incident records, and entire code repositories can be ingested; Ongrid builds an index. Both humans and the Agent query this knowledge base during investigations, turning dormant documentation into active context.

Skill Catalog for Repeatable Operations

Recurring inspection and troubleshooting steps can be packaged as skills, stored in a catalog, and reused or shared across the team. Over time, the catalog becomes the team's codified operational experience.

Additional Capabilities

Root cause analysis can pinpoint a specific source-code line when the codebase is indexed in the knowledge base.

Web-based terminal provides SSH access to any host via Edge's reverse tunnel — no key distribution or jump hosts required; all sessions are audited.

IM integration supports Feishu, DingTalk, and WeCom; each channel can have its own language setting.

MCP servers can be registered, making their tools directly callable by the Agent.

Quick Start

Requirements: Ubuntu 22.04+ (Debian 12, RHEL 9 also work), Docker 24, Docker Compose v2, 2 GB RAM, 10 GB disk. Installation steps:

wget https://github.com/ongridio/ongrid/releases/download/v0.12.0/ongrid-v0.12.0-linux-amd64.tar.xz
tar -xf ongrid-v0.12.0-linux-amd64.tar.xz && cd ongrid-v0.12.0-linux-amd64
sudo ./install.sh

For ARM hosts, replace amd64 with arm64 in the package name. Two caveats: Manager only supports Docker Compose deployment (no systemd package), and container images are pulled from docker.cnb.cool during install, so the machine must reach that registry. If GitHub is unreachable, a domestic CDN mirror is provided:

wget https://ongrid.cloud/dl/ongrid-v0.12.0-linux-amd64.tar.xz

After installation, open the web UI, create an admin account, provide an LLM API key, and the stack is up. To add more hosts, generate an Edge install command from the UI and run it on the target machine.

Suitable Scenarios

Small teams without 24/7 on-call; let the Agent finish triage so humans only review conclusions.

Large, dispersed fleets where opening inbound ports on every host is undesirable; Edge's outbound-only model fits.

Existing Prometheus/Grafana users who still investigate manually; Ongrid's built-in stack works out of the box and can also ingest external alerts.

Teams managing multiple Kubernetes clusters who want a single pane for workloads, events, and upgrades.

Organizations with accumulated runbooks and incident records that go unused; feeding them into the knowledge base makes them searchable for both people and the Agent.

Author's Perspective

AI is advancing rapidly; AI-driven operations will become a mainstream trend. Given AI's prowess in coding and code analysis, automating operations is a logical next step. Ongrid's read-only-first plus approval-gate design is prudent — few would let AI mutate production directly. Even so, the author admits hesitation about running such a system in production today because of occasional AI hallucinations. However, flagship-grade products in this category are likely to emerge soon.

Open Source Repository

https://github.com/ongridio/ongrid