sre

sre is an eve incident response agent template, part of Vercel's Agent Stack, that automates Slack-based debugging of alerts and incidents using live evidence from Datadog, GitHub, Vercel, and other connected tools.

What is sre?

sre is a deployable eve agent that lives in Slack and runs on Vercel. It accepts input as a Slack mention or direct message, a new top-level message in a watched channel, or a POST /v1/investigate webhook call. For each investigation, it checks hypotheses against live signals, records decision-relevant findings with source links, and posts a Slack reply that starts with the answer followed by the supporting evidence. The template is maintained under vercel-labs and is MIT-licensed.

Key Features

• Read-only by default — Every investigation queries connected systems without making changes, so the agent is safe to run against production observability data.
• Three invocation paths — Slack mention or direct message, watched channel alerts, and an external webhook at POST /v1/investigate that returns 202.
• Evidence with source links — The agent records each novel finding-and-URL pair once per investigation turn and includes them in the Slack result.
• Automated runtime — Webhook runs use service-authenticated tools and metadata, not per-user OAuth, so monitors and CI systems can trigger investigations.
• Runbooks via chat — Ask @sre to create a runbook; global runbooks apply to all sessions, personal runbooks apply only to the requesting user, and saved runbooks load on later matching requests.
• Vercel Connect integrations — Deployment provisions a Slack connector at path /eve/v1/slack, a read-only GitHub connector, a Datadog connector, a Vercel MCP connector, and a private Vercel Blob store.
• Customizable behavior — Edit agent/instructions/instructions.md for general instructions, change skills in agent/skills/, or connect additional tools through Vercel Connect and agent/channels/webhook.ts.

Who is it for?

• Site reliability engineers — debugging alerts by asking @sre to investigate in Slack and reading evidence-backed answers.
• Platform or DevOps teams — automating first-pass incident analysis by watching a Slack channel and letting the agent gather data from Datadog, GitHub, and Vercel.
• Incident managers — building reusable runbooks for recurring alerts directly in Slack without leaving the chat interface.

What can you do with it?

• On-call engineers: mention @sre with a description of an alert and get a hypothesis-driven investigation with source links in the reply.
• Monitoring automation: call POST /v1/investigate from Datadog monitors or other systems with a WEBHOOK_SECRET to start Slack investigations without human intervention.
• Runbook maintainers: ask @sre to save a runbook for a recurring incident, then have it applied automatically on future matching requests.

How does it work?

An investigation starts from one of three places: a Slack mention or direct message, a new top-level message in a watched channel, or a POST /v1/investigate webhook. The agent records novel decision-relevant findings with source URLs, then presents them in Slack with the answer first. Automated runs use webhook metadata and service-authenticated tools instead of per-user OAuth, and the optional channel watch and custom skills features store state in Vercel Blob.

FAQ

What does sre do?

sre is an eve incident response agent that runs in Slack. When triggered by a mention, a watched channel message, or a webhook, it queries Datadog, GitHub, Vercel, and other connected tools, then posts a Slack message that starts with the answer and includes supporting evidence with source links.

Is sre easy to deploy?

The template ships with a Deploy with Vercel button that clones the repository, creates a Vercel project, and provisions the Slack, GitHub, Datadog, Vercel MCP connectors, plus a private Vercel Blob store. After deployment you invite the Slack app, mention @sre to test, and optionally configure the webhook.

How do I secure the webhook endpoint?

Set a WEBHOOK_SECRET environment variable to a long random value, for example from Node's crypto randomBytes(32). Callers must send it via the x-sre-webhook-secret header or Authorization: Bearer; a mismatch returns 401.

Can I extend sre with other tools?

Yes. You can add tools or connections for other operational systems using Vercel Connect, and integrate with agent/channels/webhook.ts to invoke the agent from any external system. Custom skills live in agent/skills/ and require the private Vercel Blob store to persist.

Does sre work without a Datadog account?

The Datadog connector is optional. Environment variables like SLACK_CONNECTOR, GITHUB_CONNECTOR, DATADOG_CONNECTOR, and SRE_VERCEL_CONNECTOR each have defaults but can be left unset if you do not use that service. The core Slack and Vercel integrations are the only ones needed for basic investigation.