Nothing auto-executes
Your on-call engineer wakes up to a root cause, not a graph.
Incident Copilot watches your alerts. When one fires it pulls the metrics, the logs, the code that runs the failing service, and the tickets from the last time this happened — then asks your configured AI provider what went wrong and how to fix it, and packages the answer as a Jira ticket and a draft pull request for a human to approve.
Sample incident
High error rate on checkout-api
Root cause hypothesis
Database connection pool exhausted — POOL_SIZE is still 5 in app/db.py while active connections have been pinned at the maximum for eleven minutes.
Confidence
High
Proposed fix
Draft PR
acme/api #42
Awaiting approval — nothing has been applied. OPS-1841
Illustrative. Your dashboard shows your own incidents.
Six stages, one webhook
Everything between an alert firing and an engineer having something to review. The sixth stage is the one most tools skip.
1
An alert fires
Your alerting system posts to a webhook. Grafana Unified Alerting, Alertmanager, or anything that can send JSON — no per-vendor adapter needed.
2
Context is gathered
Metrics, logs and alert rules from your Grafana; the relevant source files from your GitHub repository; tickets for the same thing from your Jira.
3
Your AI provider reasons over it
One call to whichever AI provider your organisation has configured — Claude, GPT, Gemini, or a private-hosted endpoint you control — returning structured data: a root-cause hypothesis, an honest confidence rating, and a concrete fix — or an explicit “not enough information”.
4
A fix is drafted
A code fix becomes a draft pull request in your repository. An infrastructure fix becomes a list of commands — stored and shown to you, never run.
5
It lands as a Jira ticket
Root cause, confidence, the proposed fix in full, and links to the draft PR — in the queue your on-call engineer already watches.
6
A human approves
Nothing is applied until someone signs off, and the approval is written to an append-only audit log. Approving records a decision; it does not execute one.
The part that matters at 3am
A model proposes. A person decides.
Incident Copilot has no code path that runs a command against your infrastructure, and no code path that merges a pull request. It reads, it reasons, and it writes proposals into the tools your team already reviews things in. What happens next is a human decision, recorded as one.
- Commands are stored as text and displayed. There is no code path in this product that executes them.
- Code fixes open as draft pull requests — GitHub will not merge a draft, and closing one costs a click.
- Every connector credential is encrypted at rest; the API returns whether one is configured, never the value.
- Read-only access to your systems, apart from two writes: opening a draft PR, and filing a Jira ticket.
- Who approved which fix, and when, is an append-only audit record — not a mutable column.
Connects to what you already run
Three connectors, each read-only except where it writes a proposal you asked for. They are your tools — Incident Copilot connects to them, it does not replace them.
Grafana
Metrics, logs, traces, and alert rules — through Grafana's MCP server, so Prometheus, Loki and Tempo all arrive over one connection.
GitHub
Reads the source of the failing service, and opens the draft pull request when the fix is a code change.
Jira
Finds the last time this happened, and files the packaged incident where your team already triages work.
Stop starting every incident from zero
Connect Grafana, GitHub, and Jira, point one alert at a webhook, and the next page you get comes with a root cause attached.
Get started