siclaw

What Siclaw investigates

Siclaw is an open-source AI agent built for DevOps and SRE teams. It focuses on read-only infrastructure diagnostics: it gathers evidence, forms hypotheses, validates them, and returns a clear root-cause analysis without changing your environment directly. You describe a problem in plain language and Siclaw investigates it from the terminal, the web UI, or your team's chat channels. The project ships four specialist agents, recorded investigation sessions, and a built-in diagnostic skill set, with a hosted preview of the Portal UI available at siclaw.ai/demo. The system is read-only by default, which keeps it safe to run on a workstation. A control plane made of a Portal, a Gateway, and a shared database stores curated agents and their bound resources, such as skills, a versioned knowledge wiki, MCP servers, and credentials. Each session spawns an isolated AgentBox where the Agent Brain runs a Deep Investigation Engine against its bound capabilities, and that access stays read-only across every target it touches. This separation lets a team let an agent look at production without granting it the power to alter production, which is the property that makes an AI diagnostic tool safe to point at real infrastructure. The read-only default is the property that makes it safe to point at production, since the agent can look but cannot change the systems it inspects during an investigation.

How an investigation runs

Siclaw uses a four-phase workflow for evidence gathering, hypothesis testing, and root-cause analysis, and it learns from past incidents to improve future investigations. It supports multi-channel access from the terminal, web UI, or chat channels, and it records agent behavior such as LLM calls, tools, and tokens for export to Langfuse, Phoenix, or any OTLP backend, configured in the web UI and hot-reloaded live. Team workflows cover a shared web UI, credentials, channels, triggers, and scheduled patrols. Reusable skills turn repeated diagnostic playbooks into reviewable runbooks. The project connects external tools and data sources through MCP, so the agent can reach more of your stack as you bind more servers. Because the default mode is read-only, the agent recommends next steps rather than applying them. That posture matters for an SRE tool, where a wrong write can take down a service. Siclaw pairs investigation with traceability so the reasoning behind a recommendation is visible and replayable after the fact, and the exported traces let a team audit why the agent reached a given conclusion during an incident review. Traces exported to an observability backend mean an incident review can replay exactly which tools the agent called and which tokens were spent on a given diagnosis.

Deployment profiles

Siclaw offers three deployment profiles. The TUI mode is personal, local, and the lowest barrier. You run the agent directly in your terminal with no server and no database, and all operations stay read-only by default. The local server mode is a lightweight web UI backed by SQLite, with no MySQL and no Docker required, and it suits daily use on a laptop or VM. The Kubernetes mode targets team and enterprise use with Helm plus three container images named runtime, portal, and agentbox. For local usage the README tells you to start from a dedicated working directory because Siclaw stores most runtime data in a dot-siclaw folder relative to where you launch it. The TUI pairs with a local server in the same directory, treating the Portal Web UI as the source of truth for skills, knowledge, credentials, agents, and LLM providers. Pairing anchors on the working directory, so running the TUI from a different directory opens a different, independent workspace. Edits in the web UI are not hot-reloaded into a running TUI; you re-run it to pick up the new snapshot, which keeps the read-only snapshot model simple and predictable. The pairing model keeps the web UI as the single source of truth, so configuration drift between the terminal and the portal is avoided by design rather than by convention.

Stack and requirements

Siclaw runs on Node.js 22 or later in ESM-only mode, written in TypeScript 5.9. The agent builds on the pi-coding-agent, the portal database uses MySQL in production or SQLite locally through node:sqlite with a single DDL whose driver is chosen by the DATABASE URL scheme, and the memory database uses node:sqlite with FTS5 and bge-m3 embeddings. The frontend uses React, Vite, and Tailwind CSS. The Kubernetes client uses the Kubernetes client for Node, MCP uses the model context protocol SDK, and realtime updates use WebSocket. The project is published on npm and carries build and Node version badges. Configuration lives in the web UI for the local server and Kubernetes profiles, while the TUI reads a settings file in standalone mode or defers to the Portal when one is paired. LLM providers accept any OpenAI-compatible endpoint, so you can swap the base URL for DeepSeek, Qwen, Kimi, or a local Ollama server. The Apache license and the public documentation at docs.siclaw.ai round out a project that is open about how it is built and how it is meant to be run in practice. The choice of SQLite for local use means a single machine can run the full product without MySQL or Docker, which simplifies a first install for a small team.

Editorial conclusion

Siclaw is written in TypeScript, released under the Apache-2.0 license, and its repository was last updated on 2026-08-24.