From alert to
evidence.
Explore a synthetic incident from alert to evidence-backed recommendation. See which steps a model generated, which rules decided, and where a person has to approve.
Run an investigation
Replay modeEvery click runs real MCP tool calls, correlation rules, and policy checks on the server against synthetic data. The Form hypothesis step replays a reviewed response from @cf/meta/llama-3.3-70b-instruct-fp8-fast (Cloudflare Workers AI), captured September 26, 2026. No model is called during your visit.
Workflow
Intake
PendingConnect to the read-only MCP server and fetch the alert that opened the incident.
Collect evidence
PendingRun a fixed, bounded plan of read-only tool calls for deploys, telemetry, runbooks, and prior incidents.
Correlate
PendingApply deterministic rules to line up timing, changed components, and slow dependencies.
Form hypothesis
PendingAsk the model for a structured hypothesis, then reject any claim without a valid evidence citation.
Recommend
PendingApply the policy gate: cap confidence, check the action against its runbook, and require approval.
Human review
PendingStop and wait for a person. The orchestrator cannot act on its own.
Evidence
Records appear here as the read-only tools return them.
Checks that ran when this page loaded.
Each case runs the full pipeline on the server: real MCP tool calls, correlation, the captured model replay, and the citation and policy gates. The results are compared with ground truth that the tools never expose. Scripted adversarial drafts then probe the gates directly.
19 of 19 checks passed · ran Oct 21, 2026, 4:19 AM UTC in under 1 ms
INC-2041 Deployment-related latency spike
Source: captured replay, @cf/meta/llama-3.3-70b-instruct-fp8-fast
- Pass Cause classificationexpected deployment_regression; correlation deployment_regression, recommendation deployment_regression
- Pass Citation validity6 citations, all in the retrieved evidence set
- Pass Grounded actionexpected EV-RB-12; got EV-RB-12 at high confidence
- Pass Approval gatingrun status awaiting_review; approval required true
- Pass Graceful tool failurewith query_telemetry down: stopped at collect, retryable true; recommendation withheld
INC-2057 Similar alert, different cause
Source: captured replay, @cf/meta/llama-3.3-70b-instruct-fp8-fast
- Pass Cause classificationexpected dependency_degradation; correlation dependency_degradation, recommendation dependency_degradation
- Pass Citation validity6 citations, all in the retrieved evidence set
- Pass Grounded actionexpected EV-RB-19; got EV-RB-19 at high confidence
- Pass Approval gatingrun status awaiting_review; approval required true
- Pass Graceful tool failurewith query_telemetry down: stopped at collect, retryable true; recommendation withheld
INC-2063 Insufficient and conflicting evidence
Source: captured replay, @cf/meta/llama-3.3-70b-instruct-fp8-fast
- Pass Cause classificationexpected undetermined; correlation undetermined, recommendation undetermined
- Pass Citation validity3 citations, all in the retrieved evidence set
- Pass Refuses an ungrounded changeexpected no action; got no action at insufficient confidence
- Pass Approval gatingrun status awaiting_review; approval required true
- Pass Graceful tool failurewith query_telemetry down: stopped at collect, retryable true; recommendation withheld
Gate probes Scripted adversarial drafts, not model output
- Pass Fabricated citation is rejectedclaims kept 0, confidence insufficient
- Pass Action without a retrieved runbook is withheldproposed action withheld
- Pass Overconfident guess on missing data is cappedconfidence insufficient, action withheld
- Pass Malformed model output stops the runstopped at hypothesize
Timing note: tool calls and checks run in memory inside the Worker, with no network hop, so most finish in under a millisecond. Cloudflare’s runtime clock only advances on I/O, so these steps can measure as zero.
What this does not show: three synthetic cases are a functional test, not a benchmark. Each replay is a single captured sample, so it says nothing about model variance or accuracy on real incidents. No latency, cost, or time-to-resolution claims are made.
A reference implementation built for the Keekwa AI Lab.
Generative AI does one narrow job. Orchestration, permissions, citation checks, and approval rules are deterministic code, so the model can suggest but never decide or act.
Orchestrator
A six-stage state machine with typed inputs and outputs, a fixed transition table, and a budget of eight tool calls. There is no open-ended agent loop; a failed stage stops the run.
MCP client
Opens one session per run, lists the available tools, and records every tools/call exchange. It runs on the server; the browser only talks to this site's own endpoint.
Read-only MCP server
Five tools (get_alert, get_recent_deploys, query_telemetry, search_runbooks, search_prior_incidents) with validated input and output schemas. Accepts only the bundled incident IDs and redacts personal data. It has no network endpoint: it runs in-process over the MCP SDK's in-memory transport.
Synthetic fixtures
Invented alerts, metrics, traces, deploys, runbooks, and tickets. Ground truth for evaluation is kept outside the tools so the model can never see it.
Model adapter
The model's only job is to turn retrieved evidence into a structured hypothesis. Output must match a JSON schema. Replay is the public default; live inference is off unless a server flag and a rate limiter are both configured.
Policy gate
Deterministic rules drop claims without valid evidence IDs, cap confidence when evidence is missing or conflicting, check the proposed action against its runbook, and always require a person to approve.
Audit trace
Each stage records its mode (Live, Replay, or Synthetic), tool requests and responses, model identity, measured duration, and the transition the orchestrator chose.
Let’s make it
inspectable.
A focused prototype with evidence, guardrails, and a clear approval path gives your team something concrete to evaluate.
Discuss a proof of value ↗