Oncall Investigator — Development agent for Claude Code
Investigates one production alert with read-only telemetry tools and returns a grounded diagnosis with evidence links and ONE proposed next step.
How to install Oncall Investigator
Installs to ~/.claude/agents/ryanlisse-sre-oncall-agent-oncall-investigator.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/RyanLisse/sre-oncall-agent/HEAD/.claude/agents/oncall-investigator.md -o ~/.claude/agents/ryanlisse-sre-oncall-agent-oncall-investigator.md Restart Claude Code, or start a new session, for it to be picked up.
What Oncall Investigator does
name: oncall-investigator description: Investigates one production alert with read-only telemetry tools and returns a grounded diagnosis with evidence links and ONE proposed next step. Never executes a mitigation. Use when an alert fires or someone reports something broken. tools: Read, Grep, Glob model: sonnet
You are the first responder for one production service. Same standing orders as `ONCALL_SYSTEM` in `src/prompts.ts`.
Query the data first, then theorize. Read lessons for the ma
Alternatives in Development
- Incident Runbook Templates — Production-ready templates for incident response runbooks covering detection, triage, mitigation, re 31.9k ★
- Review Concurrency — Reviews code changes for concurrency defects found by multi-thread interleaving reasoning: race conditions, vi 432 ★
- Oncall Guide — On-Call Guide Agent 353 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Oncall Triage
Read-only incident investigator. Use when an alert fires or something is broken in a running environment. Gath
Infra Telemetry
Observability and IR specialist. SIEM (Wazuh-class) management, agent enrollment, alert triage, telemetry corr
AIOps Manager
Owns AIOps — anomaly detection and correlation over observability telemetry, alert-noise reduction (grouping,
Pipeline Investigator
Investigates and fixes ONE failing Prefect pipeline cluster — reads the run logs, confirms the cause against t
Aiskills Incident Investigator
Investigates live production incidents end to end — triages impact and start time, draws the blast radius, mit
Concern Investigator
Given a proposal concern (not yet a ticket), investigates the codebase via search_docs → graphify → registry →
Related Skills
Cloudtrail AI Investigator
AI agent that investigates AWS CloudTrail logs in plain English: writes SQL, runs it on Athena, explains suspi
n8n Agentic AI SOC
Playbook-driven AI SOC for a network. Kibana detection rules trigger an n8n agent that reads a live Confluence
AWS AI Analysis Agent
Serverless agent that reviews AWS Glue Jobs and Lambdas with Claude Haiku on Amazon Bedrock: findings with pro