The open-source, self-hosted platform that ingests alerts, investigates them autonomously, orchestrates incident response, and routes to the right responder — so your team spends less time triaging noise and more time resolving what matters.
Alga is actively developed and not yet production-ready. Use at your own risk. Monitor AI token usage closely when autonomous investigation features are enabled. See the README for current status.
Ingest alerts from any webhook source (Grafana, Prometheus, custom scripts). Automatic fingerprint-based deduplication ensures you never get paged twice for the same issue. Alerts are correlated by deployment events and alertname within configurable time windows, then routed to the right destination via first-match rules.
Every alert can trigger an autonomous investigation. Alga's scheduler atomically assigns work to an online agent (Hermes or OpenClaw), which receives the full alert context, queries the knowledge base, searches its own memories of past incidents, and produces a structured root-cause analysis — all visible to operators in real time through investigation threads.
When an alert warrants it, the agent or an operator promotes it to an incident. Incidents follow a formal lifecycle (detected → triaging → active → mitigated → resolved → closed) with ICS command roles (Incident Commander, Communications Lead, Responder), SLA tracking, automated escalation, Google Meet war rooms, and structured post-mortems.
Multi-layer schedules with follow-the-sun support, overrides, and structured handoffs ensure the right person is always reachable. Escalation policies loop through tiers until someone acknowledges. Pager-load metrics help balance the load across your team.
Open-source and self-hosted — MIT licensed, runs on your infrastructure. No per-user pricing, no data leaving your control.
AI that actually investigates — not just alert routing. Autonomous agents query your knowledge base, search past incidents, and produce structured findings before a human even looks at the alert.
Memory that compounds — pgvector-backed episodic memory means every resolved investigation makes the next one faster. Agents get smarter the longer they run.
Incident response that's structured — formal ICS roles, SLA tracking, and automated escalation borrowed from emergency management, not ad-hoc chat rooms.
Deduplication that works — partial unique indexes at the database level enforce one-open-alert-per-fingerprint. No race conditions, no duplicates, ever.
Built for scale — Valkey-backed agent presence and leader election, cross-replica SSE fan-out, and a three-level RabbitMQ retry topology with dead-lettering.
git clone https://github.com/hahnavi/alga.gitcd alga./setup.sh # generates .env with random secretsdocker compose up -d
Open http://localhost:3000 and complete the setup wizard to create the initial admin account (email, password, and full name). The wizard is only available the first time, before any admin exists.
