IncidentTrail
Live demo, no login

Paste the error.
Get the story.

A read-only investigation agent for small teams. It rebuilds the timeline from your logs, checks it with an AI agent, and shows what happened, what broke, and what to check next, every claim linked to evidence.

About 10 seconds a case No login, nothing to install Nothing stored, never touches prod
incidenttrail, live run on the demo incident

  
15
events in, ordered
5
findings, rule-tagged
3
tool calls, chosen live
0
changes to your systems

The agent, concretely

Not a chatbot. A loop: the model picks a read-only check, trusted code runs it, the model reads the numbers and picks again.

search_events

Filter by service, severity, signature, time window.

compare_deployment_window

Errors and health before vs after a deploy, with a no-causation caution.

inspect_health_metrics

Min, max, average over any window you name.

get_related_events

Same-service events near any event.

Budgets per run: 5 model calls, 6 tool calls, 1500 output tokens. Unknown tools and anything resembling remediation are rejected.

recurring_signatureobserved pattern

Same failure 6 times: CheckoutError, payment gateway timeout

err-001err-003err-006

Unknowns stated too: deploy diff absent, infra metrics absent. When evidence runs out, the report says so.

Show me why

Every claim carries its evidence.

Facts, hypotheses, and unknowns look different from each other, so you never have to parse a wall of prose under pressure. Click any evidence chip and the timeline jumps to that exact event and highlights it.

Built on AWS, kept small

AWS Lambda, Pythonrequests and orchestration
API Gateway HTTP APIrouting and throttling
OpenAI function calling, Bedrock path readyagent loop
CloudWatch Logs, SAM with CloudFormation7-day retention, IaC deploy

Your next incident, reconstructed.

Open the dashboard, paste the logs, read the report. About a minute, end to end.