autoOps

An autonomous SRE agent. Point it at a Kubernetes namespace and it models the estate, names the service that is broken, shows the evidence it used, and re-reads the cluster to check its own answer — or hands a human a briefing saying why it could not.

Distribution autoops-sre; the command it installs is autoops.

⚑ The bare name autoops on PyPI is an unrelated project. Install autoops-sre.

Install

uv tool install autoops-sre          # or: pip install autoops-sre
autoops version && autoops --help

Or as a container — the entrypoint is autoops:

docker pull ghcr.io/epappas/autoops:latest
docker run --rm ghcr.io/epappas/autoops:latest version

Requires Python 3.12+.

What It Does

recall -> understand -> [detect -> map topology -> map services -> localize] -> rca -> mitigate -> remember

The bracket is the investigation. Perception is deterministic and comes first: senses read the cluster's own declared state and nominate what looks broken, while metrics, traces and logs supply the evidence that either confirms a candidate or refuses it. A sense never votes on its own nomination. Diagnosis then reaches a confident answer or escalates, and says which.

autoops diagnose --namespace <ns> --results-dir ./out

exit 0 is a confident answer · exit 3 is an escalation briefing for a human · exit 4 means every sense came back without a read, so no answer above it can be trusted.

It deliberately does not act

Stage 8 emits an incident note or a remediation proposal, never a change. The one typed mutation verb that exists has an executor that raises unconditionally and is reachable from no live path — the boundary is code, not policy. It stays locked until the reasoning earns it.

The Command Surface

Seven verbs, plus version.

autoops --help and autoops <verb> --help carry the full flag surface; the CLI is the documentation of record for this distribution.

Safety

autoOps is built to run against real infrastructure, so the constraints come first.

• The model is never the authorization boundary. Every tool call passes a deny-by-default policy gate before execution, and gets a structured reason it can replan on rather than a bare refusal.
• Read-only by construction on the shipped path. A read-only policy profile plus a destructive re-check; a diagnosis cannot mutate.
• Any cluster that is not loopback is refused before a single read, until it is named in an allowlist signed out of band. That refusal lives in the loader, not in the model.
• Approvals are short-lived, target-scoped and re-checked before every target contact.
• Secrets never enter the model context or the logs.

Verifying What You Installed

Both distribution files carry PEP 740 publish attestations, generated by the release workflow over OIDC with no long-lived token:

curl -s https://pypi.org/integrity/autoops-sre/0.1.3/autoops_sre-0.1.3-py3-none-any.whl/provenance

The container image carries a BuildKit SBOM and a max-detail provenance record on its manifest:

docker buildx imagetools inspect ghcr.io/epappas/autoops:latest

Source And Support

The development repository is private, so this package page and the container package page are the public surfaces. The sdist on PyPI (autoops_sre-<version>.tar.gz) contains the complete src/ tree under the MIT licence — that is the source for this distribution.

Container package: https://github.com/users/epappas/packages/container/package/autoops

Licence

MIT.