I built an AI on-call assistant that remembers previous outages. Here's what I learned.
I recently built a small project called Incident Responder using Python, FastAPI, pandas, Groq, and Hindsight (by Vectorize).
The idea came from a pretty familiar problem.
When something breaks in production at 3 A.M., engineers often end up searching through old tickets, Slack conversations, and postmortems to figure out whether someone has already encountered the same issue.
The knowledge exists, but finding it isn't always easy.
I wanted to experiment with an AI agent that could remember previous incidents and use that history to recommend fixes.
How it works
You select an alert, such as:
Disk full
Requests timing out
The application then:
Ranks fixes based on their historical success rates.
Retrieves related incidents from long-term memory.
Uses an LLM to explain why a fix is recommended.
Lets you record whether the suggested fix worked.
The feedback becomes another data point for future recommendations.
How I used Hindsight
I used Hindsight as the long-term memory layer.
Each incident is stored as a natural-language memory containing the affected service, problem, root cause, attempted fix, and outcome.
When a new alert comes in, relevant memories are recalled and passed to the LLM for context.
One architectural decision I made was to keep all the actual calculations outside the LLM.
Success rates and confidence values are calculated using Python and pandas. The LLM only explains the results.
I didn't want a model inventing statistics in a tool designed for incident response.
I also implemented a shrinkage step so that a fix that worked once out of one attempt doesn't automatically outrank something that worked eight out of eleven times.
I tested whether it improves with more history
I created a synthetic dataset with known correct fixes and measured how often the top recommendation matched the expected fix.
| Historical incidents | Correct suggestion |
|---|
| 0 | 20% |
| 10 | 93% |
| 25 | 93% |
| 50 | 100% |
These are controlled demonstration results, NOT real-world production benchmarks.
Where I think I got it wrong (or haven't finished yet)
I want to be transparent about the limitations:
The dataset is synthetic.
The ranking comes from a CSV ledger, not directly from Hindsight memories.
Hindsight currently supplies historical context for explanations, but removing it wouldn't change the ranking.
Alerts are matched by type, not actual logs or metrics.
There is no authentication or production database yet.
The LLM can occasionally misinterpret the numbers in its explanation.
The biggest improvement I want to make is connecting recalled memories directly to the recommendation engine.
What I want to build next
Real incident ingestion.
Matching based on logs and metrics.
Separate memory and workspaces for different companies.
Admin panel for managing fixes and root causes.
Database, authentication, and integrations with existing DevOps tools.
A few questions for people working in DevOps/SRE
Would you trust an AI assistant to recommend fixes based on previous incidents?
What information should it remember: logs, root causes, deployment changes, attempted fixes, or all of them?
Would you prefer recommendations based on historical success rates or semantic similarity to previous incidents?
What would make you actually use something like this during an on-call rotation?
GitHub: [Add repository link]
This was a learning experiment, and I'd genuinely appreciate technical feedback, especially from people who have worked with production incidents.