eve Incident Response Agent

sre is an eve incident response agent for Slack. It brings together the observability data you need to debug an alert or incident across Datadog, GitHub, Vercel, and other tools. Investigations are read-only by default.

Mention @sre, watch a channel for alerts, or invoke it from an external system with a webhook. The agent checks hypotheses against live signals and records each finding with a source link. Replies start with the answer, then the supporting evidence.

How it works

An investigation starts from one of three places.

• A Slack mention or direct message.
• A new top-level message in a watched Slack channel.
• A POST /v1/investigate webhook call.

The agent records novel, decision-relevant findings with source links. Each investigation turn has its own evidence set. The agent records each finding-and-URL pair once, then adds recorded evidence to the Slack result.

Automated runs use webhook metadata and service-authenticated tools. They do not use per-user OAuth.

Channel watch and custom skills are optional. Both store state in Vercel Blob. The Blob store is required only for these two features.

Set up the project

Click Deploy to clone the repository, create a Vercel project, and provision the connectors and storage.

For a complete CLI setup with your agent, use docs/setup-for-agents.md.

After deployment:

1. Invite the Slack app to a channel.
2. Mention @sre and confirm that the app replies.
3. To enable automated runs via a webhook, follow docs/automate-investigations.md.

Local development

1
pnpm install
2
vercel link
3
vercel env pull
4
pnpm dev

Environment configuration

Copy .env.example to .env to set local environment variables.

Automation endpoint

POST /v1/investigate accepts a title, a Slack channel, an optional description, and optional metadata. It returns 202 and starts a Slack investigation.

The endpoint uses WEBHOOK_SECRET. Send the secret with x-sre-webhook-secret or Authorization: Bearer.

Customize the agent

• Edit agent/instructions/instructions.md to change general behavior.
• Edit the built-in skills in agent/skills/ to change investigation and handoff procedures.
• Add tools or connections for other operational systems using Vercel Connect.
• Integrate with agent/channels/webhook.ts to invoke the agent from any external system (see docs/automate-investigations.md).

Create runbooks in Slack

Ask @sre to create a runbook for a recurring alert or incident. Global runbooks apply to every session. Personal runbooks apply only to the requesting Slack user and override global runbooks with the same name. The agent loads a saved runbook on a later matching request, not during the request that creates it. Private Vercel Blob storage is required to save and load runbooks.

Verify changes

1
pnpm validate
2
pnpm test

Troubleshooting

• If Slack mentions do not arrive, confirm that the trigger path is /eve/v1/slack.
• If a webhook returns 401, confirm that the caller and the deployment use the same WEBHOOK_SECRET.
• If an investigation does not start, confirm that the bot is a member of slackChannel.
• If custom skills fail to save, confirm that the private Blob store is connected.
• If Vercel tools request authorization, complete the Vercel Connect sign-in for the Slack user. Automated runs do not have a user identity, so they cannot use this connection.

Learn more

• eve documentation
• Automate investigations with generic webhooks
• Vercel Connect
• Vercel Blob

Explore more templates

• eve software factory
• eve marketing team
• eve personal agent
• All eve templates