ResponseIQ

Turn an incident log into a reviewable remediation decision.

ResponseIQ is a trust-first incident remediation copilot. It analyzes crash logs with Ollama or OpenAI, applies policy and safety checks, records rollback and proof evidence, and can validate an explicit patch in an isolated Git worktree before opening a GitHub draft PR.

Zero config. Try it now:

pip install responseiq && responseiq demo

Support ResponseIQ

If ResponseIQ is useful to you, you can support the project with any amount you choose. Every contribution is appreciated and helps keep the project moving.

How it works

# Pipe Kubernetes logs straight in — no plugin, no config
kubectl logs payment-svc --since=1h | responseiq --mode fix --target - --explain

# Or Docker
docker logs --tail 200 my-api | responseiq --mode fix --target - --explain

ResponseIQ can:

1. Filter out noise lines automatically
2. Analyze high-severity incidents with a local or hosted LLM, or use the rule-engine fallback
3. Apply Trust Gate checks before recommending or submitting remediation
4. Validate an explicit patch in a temporary isolated Git worktree
5. Open a GitHub draft PR after validation when repository, token, patch, and test commands are supplied
6. Write a REASONING.md audit log you can paste straight into your post-mortem

Without an explicit patch and validation workflow, fix produces a remediation recommendation for review; it does not claim to autonomously modify production.

What makes it different

Most log analysis tools pattern-match on error strings. ResponseIQ does something different: it reads your code.

When source mappings are configured and a stack trace identifies /app/services/auth_service.py:120, ResponseIQ can resolve that path and load relevant source context via Tree-sitter. This improves the remediation recommendation; every proposed change still requires validation and human review.

Benchmark (project-reported)

Evaluated against SWE-bench Verified — the same dataset used to rank SWE-agent, Devin, and OpenHands.

The reported result is an internal evaluation, not an independent benchmark or production success guarantee. See reports/swe_bench_eval.md for methodology and per-repo results.

Architecture

flowchart TD
    A([Log Input]) --> B[Noise Filter]
    B --> C[Concurrent Scan — asyncio.gather]
    C --> D{AI Classifier}
    D -->|HIGH / CRITICAL| E[Tree-sitter AST Source Loader]
    D -->|LOW| Z([Skip])
    E --> F[LLM Reasoning — Ollama / OpenAI]
    F --> G{Trust Gate — 7 guardrails}
    G -->|Approved| H[ProofBundle — SHA-256 sealed]
    G -->|Blocked| I([Human Review])
    H --> J[GitHub PR — githubkit]
    J --> K[PR Bot — /responseiq approve]

Features

Core pipeline

Optional integrations and extensions

Language-specific parsers

Dedicated parsers extract rich structured context — goroutine IDs, stack frames, exception chains, and framework signals — before the AI even sees the log.

Infrastructure features

Quick start

CLI — local dev or CI

# 1. Install
pip install responseiq

# 2. Configure — 3 questions, writes .env, done
responseiq init

# 3. Scan
responseiq --mode scan --target ./logs/error.log

# 4. Fix with full explanation
responseiq --mode fix --target ./logs/error.log --explain

# 5. Shadow mode — read-only triage, nothing is changed
responseiq --mode shadow --target ./logs/ --shadow-report

# 6. Watch mode — continuous tail daemon
responseiq --mode watch --target ./logs/app.log

# 7. Validate an explicit patch and open a draft PR
export RESPONSEIQ_POLICY_MODE=pr_only
responseiq --mode fix --target ./logs/error.log \
  --repo your-org/your-repo \
  --patch-file ./responseiq-fix.patch \
  --validate "pytest -q" \
  --validate "ruff check src"

When --patch-file, --repo, and at least one --validate command are provided, an approved pr_only remediation is applied in a temporary Git worktree. The original checkout is never modified. The branch is committed, validated, pushed, and opened as a draft PR. Without those options, fix remains analysis-only and returns the recommendation for review.

No LLM key? The rule-engine fallback activates automatically. responseiq init is optional.

LLM options:

# Local Ollama (free, no data leaves your machine — recommended)
LLM_BASE_URL=http://localhost:11434/v1 LLM_ANALYSIS_MODEL=llama3.2 responseiq --mode scan --target ./logs/

# OpenAI
OPENAI_API_KEY=sk-... responseiq --mode scan --target ./logs/

Pipe from anywhere:

kubectl logs -l app=api --since=1h        | responseiq --mode fix  --target - --explain
docker logs --tail 200 my-container       | responseiq --mode scan --target -
cat ./logs/app.log                        | responseiq --mode scan --target -

# Structured JSON / NDJSON
echo '{"level":"ERROR","message":"KeyError: email","service":"api"}' \
  | responseiq --mode scan --target -

Self-hosted API server

# Start server + Postgres
docker-compose up -d
curl http://localhost:8000/health

# Local dev with hot-reload
uv sync
uv run uvicorn responseiq.app:app --reload

Point your existing alert tools at POST /api/v1/incidents/ingest:

SSE streaming — get live progress events while an incident is being analysed:

curl -N -X POST http://localhost:8000/api/v1/incidents/analyze/stream \
  -H 'Content-Type: application/json' \
  -d '{"log_text": "ERROR: NullPointerException at UserService.java:42"}'
# event: started
# event: scrubbing
# event: analyzing
# event: critic
# event: trust_gate
# event: complete

MCP server — expose ResponseIQ as an AI agent tool:

pip install 'responseiq[mcp]'
responseiq-mcp          # starts stdio MCP server
# Tools: analyze_incident · get_remediation · run_trust_gate · open_pr

Try the built-in demo

git clone https://github.com/infoyouth/responseiq.git && cd responseiq
pip install responseiq

responseiq --mode scan   --target ./samples/crash.log
responseiq --mode fix    --target ./samples/crash.log --explain
responseiq --mode shadow --target ./samples/ --shadow-report

samples/ contains three real injected bugs with a pre-recorded crash log. No API key, no database, nothing to set up.

Expected scan output:

------------------------------------------------------------
  ResponseIQ Scan Report
  Target : samples/crash.log
  Status : SUCCESS
------------------------------------------------------------
  Scanned  : 3 message(s)
  Incidents: 3 found
------------------------------------------------------------
  1. [HIGH]     KeyError: 'email' in process_user_request
  2. [CRITICAL] Memory leak — _request_log unbounded growth
  3. [HIGH]     ZeroDivisionError: division by zero (reset race)
------------------------------------------------------------
  Tip: run with --mode fix to review remediation recommendations.
------------------------------------------------------------

SWE-bench

# Smoke run — 5 samples, no LLM key
uv run python scripts/swe_bench_eval.py --samples 5 --dry-run

# Full run (500 samples)
uv run python scripts/swe_bench_eval.py --samples 500

# Filter by repo
uv run python scripts/swe_bench_eval.py --repo sympy/sympy --samples 50

Outputs reports/swe_bench_eval.md and reports/predictions.jsonl (compatible with the official swebench Docker harness).

Development

uv sync
make lint    # ruff format --check + ruff check + mypy
make test    # pytest -n auto --dist=loadscope
make all     # lint + type-check + test + build + security audit

Project layout

src/responseiq/
  cli.py                        # CLI entry point (--mode scan|fix|shadow|watch)
  app.py                        # FastAPI server (webhooks + SSE streaming)
  mcp_server.py                 # MCP server — 4 agent tools (responseiq-mcp)
  ai/
    llm_service.py              # LLM calls with OTel GenAI spans + LiteLLM support
    dspy_optimizer.py           # DSPy prompt optimisation scaffold (opt-in)
  services/
    remediation_service.py      # Core LLM reasoning brain
    critic_service.py           # Second-pass critic/reviewer agent
    github_pr_service.py        # GitHub PR bot (githubkit)
    watchdog_service.py         # Post-apply error-rate monitor + auto-rollback
    conversation_service.py     # Stateful AI conversations (Redis + in-memory fallback)
  routers/
    streaming.py                # SSE streaming endpoint
  plugins/
    scan.py / fix.py / shadow.py / watch.py
    go_parser.py / nodejs_parser.py / spring_parser.py / django_parser.py / fastapi_parser.py
  utils/
    context_extractor.py        # Tree-sitter AST source loader
    multi_repo_resolver.py      # Maps container paths to local source files
    k8s_patcher.py              # Kubernetes YAML patcher (comment-preserving)
    log_scrubber.py             # PII redaction (email regex + optional spaCy NER)

Disclaimer

ResponseIQ uses generative AI to suggest infrastructure and code fixes. AI can hallucinate — syntactically correct but functionally wrong patches are possible. Review every PR or patch before merging. The Trust Gate reduces risk but is not a substitute for human review. See the MIT License — no warranty implied.

For security issues see docs/SECURITY.md.