KubeMedic
Safety-gated Kubernetes incident copilot — bounded agentic investigation, human-approved remediation, verified recovery. 100% root-cause accuracy over 35 benchmark incidents.
Overview
KubeMedic detects faults from Prometheus signals, investigates through read-only MCP tools with a hard call budget, emits a cited hypothesis, proposes one allow-listed remediation, waits for human approval, executes namespace-scoped, and verifies the recovery signal actually returned.
Problem
Kubernetes alerts identify symptoms, not causes. Under a page, an operator correlates metrics, pod state, events, logs, and config changes before acting — slow, repetitive, and risky under pressure. Agentic remediation without guardrails is worse.
Approach
Bounded investigation (read-only tools, hard call budget), evidence-cited hypotheses, an explicit human approval gate the agent cannot bypass, least-privilege execution, and post-remediation verification. Benchmarked on 7 scenarios × 5 seeds: 100% detection, 18.7s mean time-to-detect, 21.4s mean diagnosis, 58.0s mean time to verified recovery, 100% root-cause and remediation-class accuracy, 0% over-remediation on the red-herring scenario.
Impact
Shows agentic AI applied with safety engineering discipline — bounded autonomy, human gates, verification — exactly the posture production SRE tooling demands.