Siclaw
AI-powered SRE platform — read-only infrastructure diagnostics with deep investigation, security governance, and team collaboration
Last verified:
What is Siclaw?
Siclaw is an open-source AI agent platform designed for Site Reliability Engineering (SRE) and DevOps teams. It performs read-only infrastructure diagnostics by gathering evidence, forming hypotheses, validating them in parallel, and returning clear root-cause analysis without directly changing your environment. Users describe problems in plain language via terminal, web UI, or team chat channels, and Siclaw investigates automatically.
The platform features a 4-phase hypothesis-driven investigation engine: context collection, hypothesis generation, parallel validation with up to 3 sub-agents, and root-cause conclusion. Every investigation feeds into Siclaw's memory system, making it smarter with each incident. Key capabilities include security-first read-only investigation by default, alert-driven channel integrations, an AI-generated skill system with review workflow, cron-based health patrols scheduled in natural language, and team workspaces for shared investigations.
Siclaw integrates natively with Kubernetes and supports messaging platforms (Slack, Discord, Telegram, Lark), observability tools (Prometheus, Grafana, Elasticsearch, Loki via MCP), alerting systems (PagerDuty, Alertmanager via MCP), and dev tools (GitHub, GitLab via MCP). It extends to any system via Model Context Protocol. The tool is built for production environments requiring controlled execution, multi-user management with SSO/OAuth2, and isolated AgentBox sandboxes for team collaboration.
Siclaw is ideal for SRE teams, DevOps engineers, and infrastructure teams who need deep incident investigation without risking production changes. It excels at diagnosing Kubernetes issues like CrashLoopBackOff, detecting anomalies through monitoring integration, and building institutional knowledge for recurring incidents. The platform is open source and can be deployed locally in seconds via npm.
Siclaw pricing
Pricing model: Freemium
Siclaw is completely free and open source. No paid tiers or subscription plans. Users can install globally via npm install -g siclaw and run locally with siclaw local (Web UI at localhost:3000) or use CLI mode with siclaw. Enterprise features like SSO/OAuth2, multi-workspace support, and isolated AgentBox sandboxes are included in the open-source version. No credit card required.
Siclaw pros
- Open source and free to use
- Read-only by default for production safety
- Hypothesis-driven 4-phase investigation engine
- Learns from every incident via memory system
- Parallel validation with 3 sub-agents
- Structured root cause with evidence and confidence scores
- Natural language cron patrols for health checks
- Native Kubernetes integration
- Multiple channel support (Slack, Discord, Telegram, Lark)
- Model Context Protocol for extensions
- Team workspaces with shared investigations
- SSO/OAuth2 multi-user management
- Isolated AgentBox sandboxes per team
- AI-generated diagnostic scripts with review workflow
- Alert-driven automatic investigation triggers
- Web UI with real-time streaming updates
- CLI mode for personal use
- Session history and investigation reports
Siclaw cons
- Requires Node.js 22 or higher
- CLI-based setup may challenge non-technical users
- Write operations require manual approval gates
- Primarily focused on Kubernetes environments
- New project with v0.1.4 (early version)
- Limited enterprise support documentation
- MCP integrations require additional configuration
- Self-hosted deployment responsibility
- No cloud-hosted SaaS option available
Frequently asked questions about Siclaw
What is Siclaw?
Siclaw is an open-source AI agent platform for SRE teams that performs read-only infrastructure diagnostics. It investigates incidents by gathering evidence, forming hypotheses, validating them in parallel, and returning clear root-cause analysis without directly changing your environment.
Is Siclaw safe to use in production?
Yes, Siclaw is read-only by default and never modifies your cluster. It gathers evidence and forms hypotheses without making changes. Controlled execution is available when needed but requires explicit approval gates and command whitelists.
How does the investigation engine work?
Siclaw uses a 4-phase hypothesis-driven engine: Phase 1 collects context via diagnostic commands, Phase 2 generates hypotheses, Phase 3 validates hypotheses in parallel with up to 3 sub-agents, and Phase 4 produces a structured root-cause conclusion with evidence and confidence scores.
What channels can I use to trigger investigations?
Siclaw supports multiple channels: terminal/CLI, web UI at localhost:3000, and team chat platforms including Slack, Discord, Telegram, and Lark. You can also trigger investigations from alerts via PagerDuty or Alertmanager integration.
Does Siclaw support Kubernetes?
Yes, Kubernetes has native integration. You import a kubeconfig first with /setup command, then Siclaw can inspect your cluster. It excels at diagnosing Kubernetes issues like CrashLoopBackOff in seconds.
How does Siclaw learn from incidents?
Every investigation feeds Siclaw's memory system. The platform learns from each incident so subsequent investigations are smarter. This builds institutional knowledge especially valuable for recurring incidents.
Can I extend Siclaw to integrate with my tools?
Yes, Siclaw extends to any system via Model Context Protocol (MCP). Built-in integrations include Kubernetes, Prometheus, Grafana, Elasticsearch, Loki, PagerDuty, Alertmanager, GitHub, and GitLab. You can add custom integrations through MCP.
How do I install Siclaw?
Install globally via npm: npm install -g siclaw, then run siclaw local for Web UI at http://localhost:3000 or siclaw for CLI mode. Requires Node.js >= 22. Create a workspace directory first: mkdir -p ~/siclaw-work && cd ~/siclaw-work.
What is the skill system?
The skill system allows AI to generate diagnostic scripts with a review workflow. You can fork and share skills across teams. Skills are managed through the web UI where you can create, review, and publish them for team collaboration.
Is there a cloud-hosted version?
No, Siclaw is self-hosted and open source. You run it locally on your infrastructure using npm. All features including team workspaces, SSO/OAuth2, and isolated AgentBox sandboxes are available in the self-hosted open-source version.