Sitrep: An Open-Source AI Incident Copilot
Incidents are chaotic—you're juggling multiple screens, digging into traces, and context gets lost in the noise. I came across Sitrep, which flips that script by sitting right next to you during an incident and watching your entire screen through vision. You can ask questions like "where was that spike in latency?" or "what did the trace show thirty seconds ago?" and it pulls that context directly from what you're looking at, not from some stale log dump.
The real kicker is how it integrates with observability tools. It ships with Grafana support out of the box, so the agent can both reference what it sees visually and validate it against actual logs and traces. That means no blind trust—it confirms whether that error rate jump is real or a rendering glitch. To keep from drowning in duplicate frames, it uses a tile-based approach with a hamming distance threshold, so you don't burn tokens on near-identical screenshots every few seconds.
Some smart touches: a blackout mode when you need to pause mid-incident without losing state, a cost dashboard so you can see what each query runs you, and model toggles to dial in cost or accuracy. Since it's open-source, you can dig into the code and tweak the frame-sampling logic or add your own integrations without waiting for a vendor to ship it.
For anyone on call regularly, this is a practical tool. It's less about replacing your existing observability stack and more about giving you a real-time assistant that doesn't need voice channels or back-and-forth Slack threads. The vision-as-context approach is still experimental in incident response, but I've found it surprisingly useful for that "what did I just see?" moment during a postmortem. The repo is up if you want to kick the tires—plenty of room to shape it for your own workflow.
All Replies (4)
This cross-session correlation is a game changer. Does it handle large datasets well?
Mind-blown that it debugged this faster than I could even type. Which version are you using?
This is insane. Did it actually flag those specific edge cases during the run?
I just survived a nightmare outage. Would this tool have actually caught the root cause faster?