AlertINT

Infrastructure incidents, decoded.

Quickstart · Docs · Discussions · Design partners wanted

AlertINT turns infrastructure alerts into investigated incidents and serves them to the AI tools you already use, over MCP — a self-hosted agent that runs inside your own network.

_{Illustrative incident. The services, times and cause are invented.}

How it works

1. Groups an alert storm into one Situation.
2. Investigates with read-only evidence: recent changes, logs and metrics. A verification round challenges the draft before the finding is posted.
3. Notifies through an evolving Slack thread or selected ntfy pushes per Situation.
4. Hands off the full record to Claude Code, Codex or any MCP client. Corrections captured there steer the next triage of the same failure.

Read-only by design. Local state. You bring the LLM key.

At a glance

Area	Supported today
Alert sources	Alertmanager, Zabbix
Read-only evidence	Prometheus, Loki, Zabbix, Sentry, change-event webhooks (deploys, config, flags)
Correlation rules	Open YAML schema, built-in baseline pack, your own local packs
LLM	Anthropic, or a self-hosted OpenAI-compatible endpoint (vLLM, SGLang, Ollama, LM Studio)
Delivers to	Slack, ntfy, stdout JSON, and MCP clients (Claude Code, Codex, Cursor, Windsurf)
Runs as	Single Go binary, Docker image, or signed Helm chart
State	Local SQLite with a hash-chained, verifiable audit log

Get started

Docker Compose bundles AlertINT with Prometheus and Alertmanager:

git clone https://github.com/alertint/alertint-agent && cd alertint-agent
cp .env.example .env   # set the ALERTINT_* tokens and your LLM key
docker compose -f docker/docker-compose.yaml --env-file .env up

Then fire the built-in drill. It plants a fake deploy, sends synthetic alerts through the real ingress, and prints the finding:

docker compose -f docker/docker-compose.yaml exec agent \
  /alertint drill --config /etc/alertint/config.yaml

Other installs:

• Kubernetes: signed Helm chart on Artifact Hub, see the Helm guide.
• Binary: go install github.com/alertint/alertint-agent/cmd/alertint@latest

Next, connect an MCP client and point Alertmanager or Zabbix at the agent. The Quickstart walks through every step.

Documentation

• Quickstart · Configuration
• Architecture · Situation workflow · Incident memory
• Integrations · Scope and limits · FAQ
• Changelog
• ntfy notifications: configurable mobile updates through ntfy.sh or a self-hosted server, independently of Slack.

The docs/ folder is the source of alertint.com/docs. Documentation PRs are welcome, see CONTRIBUTING.md.

Design partners wanted

Running Alertmanager or Zabbix in production? We're looking for a few teams to run AlertINT on a real stack and tell us honestly whether the findings hold up. Read what we'd ask and reply there, or email ernests@alertint.com.

Community

• Questions and ideas: GitHub Discussions
• Bugs: Issues
• Security: never in public, see SECURITY.md

License

Fair Source under FSL-1.1-ALv2. Free to use, modify and self-host at any scale. The only restriction is offering it as a competing commercial product. Each release becomes Apache 2.0 two years after publication.