Agent Neo: An Incident Agent That Uses Your Existing Tools
I’ve spent most of my career on call, and most incidents go the same way. An alert fires. You open five tabs, run the same kubectl, aws, and gh commands as last time, line up timestamps by eye, and then write it all down so the next person doesn’t have to. I got tired of doing that by hand.
Agent Neo is my attempt to automate it. It’s open source under Apache 2.0.
What it is
One Go binary. No Python, no agent framework. It doesn’t ship its own integrations either. It uses what’s already on your machine (gh, kubectl, aws, ssh, database clients) and gives those to an LLM inside a fixed loop: watch, correlate, investigate, fix, and remember what worked.
brew install open-auto-intel/tap/neo
neo init # finds your tools, remotes, and cloud CLIs, writes neo.yaml
neo recon # one pass: watch everything, report what's firing
neo investigate --all # dig into it
neo serve # keep running as a service
The bug it reported about itself
Early on, Neo was reporting memory pressure on a host, over and over. Then it noticed it was able to file duplicate issues. It decided that was a bug and filed an issue about it. Then it filed 27 more, each worded a little differently, each in a different project, and each technically correct.
The fix turned into one of the sturdiest parts of the system. Every signal gets fingerprinted before an LLM ever sees it, and fingerprints are checked across every project. It hasn’t filed a duplicate since. The lesson I took from it: if something has to be deterministic, keep it out of the model. Let the LLM handle judgment and let code handle bookkeeping.
What’s next
It’s early. Right now it leans on whatever model you point it at, and the next step is making the harness around the model do more of the work. If you run infrastructure and want to try it, I’d like to hear where it falls down.