NudgeBee: The agentic ops platform for cloud, SRE, DevOps, support and FinOps teams

Agents you can safely run in production. Across all of operations, not just incidents.

NudgeBee's Task-Scoped Micro-Agents (Task Bees) take on repeatable ops work one task at a time, from incidents to cost, Kubernetes, cloud and databases. Approved once, trusted bee by bee, the same way every run.

  • Gated and guardrailed: approved once; scoped functions and four checks on every step
  • Consistent: the same steps every run, logged and replayable
  • Flexible deployment: supports multi-cloud, hybrid and air-gapped; available self-hosted
  • Bring your own models: frontier or open-weight, routed per task by DAIM for accuracy and cost
  • Memory and knowledge graph: bCortex: multi-tier memory and a live map of services and dependencies
Request a Scoped Demo

Install the open-source agent

helm install nudgebee oci://ghcr.io/nudgebee/charts/nudgebee

The cloud program grew. New applications multiplied. The team didn't. The toil did.

Most of what your cloud, SRE, support and FinOps teams do each week is repeatable, and most of it is still done by hand. The tools tell you what happened; nothing acts on it. After an AI coding demo, your platform team built a prototype agent, and security review stopped it. Security was right to.

  1. “Headcount is flat, the estate isn't.”

    The same five questions in Slack every week

    Dev Self-ServiceTicket Triage

    Answer in the thread, with evidence

    2–3×engineer capacity; about 8 FTE-equivalents freed

  2. “Cloud spend is up; the savings sit in a spreadsheet.”

    Rightsizing recommendations nobody applies

    RightsizerJanitor

    Ship the change as a gated PR

    30–40%lower spend, applied not recommended

  3. “Incidents escalate to the people you can least spare.”

    300 alerts, 5 matter; MTTR in hours

    AI-SREAlert Triage

    A cited root cause, the fix attached

    70%lower MTTR; 68% fewer L3 escalations

  4. “Upgrades, patches and audits slip on manual pre-work.”

    The next upgrade waits on a hand sweep of API deprecations

    UpgradeCVE PatchDriftAudit Evidence

    The pre-work, done before anyone opens a ticket

    70%fewer Kubernetes tickets

  5. “The board wants an AI plan; security won't sign an open‑ended agent.”

    A LangGraph‑plus‑MCP prototype that never passed the change board

    Any Task Bee

    One job, a known blast radius, approved once

    Onceapproved; trust raised per bee, from Analyze only

The gap was never the model. It was scope, approval, audit, accuracy and cost. That is what NudgeBee is.

Production-safe

We don't give agents a shell. We give them typed, scoped work, and you approve it once.

Security reviews a Task Bee the way it reviews a runbook: once, at onboarding, with its maximum blast radius on the table. After that the policy travels with the workflow, not the prompt. Only your team moves the dial.

What security is asked to approve

  1. An agent with a shellPicks its own commands
    A Task-Scoped Micro-Agent (Task Bee)Runs a fixed list of steps

  2. An agent with a shell: Anything the shell can reach

    Can call

    A Task Bee: A fixed function list, each tagged with an action type

  3. An agent with a shell: Chosen by the model as it goes

    Steps

    A Task Bee: A fixed list; the model never picks a new one

  4. An agent with a shell: Unknown until it runs

    Blast radius

    A Task Bee: Known before it runs

  5. An agent with a shell: Every action, or not at all

    Approved

    A Task Bee: Once, like a runbook

  6. An agent with a shell: A chat transcript

    Record

    A Task Bee: Every step logged and replayable

Persona Bees group related Task Bees and inherit these limits. System Bees act only when a bee calls them.

What you deploy

Task‑Scoped Micro‑Agents (Task Bees)

One job. A fixed list of steps. Approved once.

A Task Bee is an agent that does one job. It follows a fixed list of steps, calls only the functions on its list and runs inside the limits security approved. The model reasons inside a step; it never decides which step comes next.

Ready in the catalog, or convert your own runbooks

Alert TriageRCARightsizerK8s UpgradeJanitorDrift& more

Where Task Bees come from →

RCA Bee Example

Finds the cited root cause of a firing alert · from the catalog

Trigger
HighErrorRate alert in prod
Can call
Read alertService mapLogsMetricsPost to channelPropose change6 functions and nothing else
Ceiling
Config changes Ask me first in prod
Owner
On-call SRE; never above their RBAC
Same 5 steps, every run
  1. 1Read alert
  2. 2Walk map
  3. 3ReasonThe model reasons here
  4. 4Post + ticket
  5. 5Propose fixAsk me first
Alert
checkout-api · 503s on 8% of requests
Step 3 found
ConfigMap payment-gateway-config changed at 14:02
Step 5 proposes
Roll back the ConfigMap change Waits for approval

The steps never change. Only the evidence does.

Consistent

Why Task Bees don't drift

A Task Bee is autonomous inside a fixed list of steps and nowhere else. Three mechanisms keep it doing the same job the same way, every run.

Typed actions

One of 8 action types per function, so its blast radius and gate are known before it runs.

  1. 1Observe and analyze
  2. 2Records and PRs
  3. 3Alerting
  4. 4Workload
  5. 5Capacity
  6. 6Config
  7. 7Access
  8. 8One-way

Off until an admin allows them

Durable, replayable runs

Every step is recorded on Temporal; a crashed run resumes where it stopped.

  1. 1
  2. 2
  3. ✕Crash
  4. 3Resumes
  5. 4
  6. 5
↻ Any run can be replayed

Certified models, with fallback

DAIM certifies each new model release against the ops task set before it's used.

  • New releaseCertifying
  • Certified modelIn the pool
  • On regressionFalls back

Every step, four checks · the most restrictive result applies

  1. Scopein scope for this bee
  2. Owner RBACnever above the owner
  3. Trust dialallowed in this environment
  4. Admin ceilingunder the type's ceiling
  • Runs
  • Asks in the thread
  • Held, reason logged
Before agents go live

Built to pass every review. Autonomy is earned per bee.

Security, platform, infrastructure and finance each ask one question. The trust dial answers the first: set per bee and per environment, raised only where the scorecard shows it was right, never past the admin ceiling.

The trust dial per bee, per environment

  1. Analyze only

    Reads, reasons and reports; changes nothing.

    Every new bee starts here

  2. Asks first

    Proposes each change with its evidence; runs it on approval.

    Promoted where it was right

  3. Runs on its own

    Autonomous inside its fixed steps, where you allowed it.

    Still logged and reversible

On every mode

  • Safe by default
  • Never above its owner
  • Rollback built in
  • Full audit trail
  • Secrets stay out
  • Kill switch

For security

Safe in production

Approved once, trusted bee by bee.

  • A fixed function list per bee
  • 8 action types; blast radius known first
  • Four checks before every step
What a Task Bee is →

For platform and sre

Consistent

Same steps, same checks, every run.

  • Reasoning stays inside a step
  • Durable, replayable runs on Temporal
  • Certified models, with fallback
Why Task Bees don't drift →

For infra and compliance

Flexible deployment

Your environment. Nothing leaves.

  • Cloud, hybrid, on‑prem or air‑gapped
  • Outbound-only; zero data egress
  • SOC 2 Type II and ISO 27001
See where it runs →

For finance

Costs less to run

Your models. A bill that stays flat.

  • Bring your own models and contracts
  • DAIM routes on accuracy, cost, latency
  • Priced on the estate, not tokens
See the cost model →
Three ways to start

Where your Task Bees come from

Start with ours. Bring yours. Build the rest.

Most teams start with the catalog, convert the runbooks they already trust and build only what's missing. All three end in the same Task Bee: typed, scoped, gated and approved once.

1

Use ours

A catalog of Task Bees, ready as they are or adapted

First run in hours

Incidents

  • Alert Triage
  • Alert Noise
  • RCA
  • Remediation
  • Rollback
  • Scribe
  • & more

Cost

  • Workload Rightsizer
  • PVC Rightsizer
  • Cloud Cost
  • Cost Anomaly
  • Janitor
  • & more

Kubernetes

  • K8s Upgrade
  • Helm Chart
  • CVE Patch
  • Cert
  • Health
  • SLO
  • & more

Cloud and compliance

  • Drift
  • IAM Drift Scan
  • CIS and Posture
  • RBAC Audit
  • Audit Evidence
  • & more

Databases

  • RDS Alarm Triage
  • Blocking & Long-Query Sweep
  • Deadlock
  • Plan Regression
  • Replica Lag
  • Storage Headroom
  • & more

Use one as it ships, or adapt it: change the steps, re-scope, re-dial. The action types travel with it.See how they group into Persona Bees →

2

Convert your SOPs and runbooks

Your runbooks become Task Bees

First run in minutes
  1. IngestConfluence, Markdown, scripts, tickets
  2. Type each stepan action type per step
  3. Attach guardrailsscope, dial, limits, rollback
  4. Run iton alerts, schedules or from Slack

runbook · OOMKilled pods

  1. 1.Check the OOMKilled event and the pod's memory graph.
  2. 2.Work out why: a limit set too low, a leak or a recent deploy?
  3. 3.Raise the memory limit in a PR, with the graph attached.
  4. 4.Roll the deployment once someone approves.

b-oomfixIllustrative

  1. 1Read the OOMKilled event and memory historyObserve and analyzeRuns
  2. 2Diagnose why the pod was OOMKilledThe model reasons hereObserve and analyzeRuns
  3. 3Open a PR with the new limit and the evidenceRecords and PRsRuns
  4. 4Roll the deployment with the new limitWorkloadAsk me first

Not a prompt that reads your SOP. Your SOP runs, under policy.Published customer result5× more automations by the same team

3

Build your own

For the Task Bee that doesn't exist yet

Your IDE or the canvas

Describe it

Every Monday 09:00, find workloads over-provisioned for 14 days in prod-eks-1, open a PR with new requests, post to #platform.

NudgeBee drafts the typed workflow: steps, action types, triggers, approvals.

Drag it

Steps, conditions, approvals and rollback on a canvas. Your scripts, Terraform, Ansible, REST and MCP tools become steps.

Code it

In Claude Code, Cursor or Codex, against NudgeBee's tools and MCP. Register it with its function list and action types.

However you build it, it runs on the platform: guardrails, bCortex and DAIM from day one.What it inherits →

Used, converted or built: the same typed, scoped, gated Task Bee, approved once.

The journey

Start small. Remove one task at a time. Grow the crew.

Each team member gets their own crew of Task Bees. When several bees work one area, they are grouped into a Persona Bee for that function.

  1. Day 130-day pilot

    1–2 bees

    Trust dial
    Analyze only
    Who
    One engineer

    Output scored against what your engineer would do

  2. Week 230-day pilot

    4 bees

    Trust dial
    Asks first in prodRuns on its own in non‑prod
    Who
    One engineer

    Your first runbook becomes a Task Bee

  3. Month 2

    9 bees

    Trust dial
    Runs on its own nights and weekends
    Who
    The team

    Related bees grouped into a Persona Bee, like AI‑SRE

  4. Ongoing

    15+ bees

    Trust dial
    Raised per bee where scorecards show it was right
    Who
    Every team member

    Each new bee starts smarter through bCortex

Tasks removed are measured in your pilot, against your own baseline.

When the crew grows

Persona Agents (Persona Bees)

One role. A group of Task Bees. The same limits.

When several Task Bees work one area, they are grouped into a Persona Bee: the general-purpose assistant for that function. Ask it in Slack or Teams; it investigates through its bees and answers with evidence. It inherits the bees' limits and adds none of its own.

  • Task Bee

    One job, on alerts and schedules. Runs unattended where the dial allows.

  • Persona Bee

    One role, through its Task Bees. Questions and investigations, with judgment in the loop.

Both call System Bees, specialists in one system each, which you don't use directly.

Persona Bees, ready to use. Pick one.

1 / 5

AI-SRE Persona Bee

Works beside on-call, NOC, L2/L3 and help desk

AI-SRE
  • Alert Noise
  • Alert Triage
  • RCA
  • Remediation
  • Rollback
  • Scribe
Acts only through these 6 Task Bees
In the threadExample

Why is checkout throwing 503s?

AI-SRE called Alert Triage Bee RCA Bee

ConfigMap payment-gateway-config changed at 14:02. 5-Whys chain attached, with a citation on every link.

Roll back the ConfigMapAsk me first

Published customer resultExplore AI-SRE →70% lower MTTR, 68% fewer L3 escalations
Use what's ready

Five Persona Agents (Persona Bees), ready to use

AI-SRE

Works beside on-call, NOC, L2/L3, help desk

What it does
  • Cuts alert noise before paging
  • Finds root cause, not symptoms
  • Traces errors to the commit
  • Remembers past incidents in bCortex
  • Fixes on your approval
Task Bees
  • Alert Noise
  • Alert Triage
  • RCA
  • Remediation
  • Rollback
  • Scribe

70% lower MTTR, 68% fewer L3 escalations

Explore more

AI-FinOps

Works beside FinOps, platform, finance

What it does
  • Finds waste with 501 rules
  • Shows the arithmetic behind savings
  • Applies fixes after your approval
  • Flags spend spikes same day
  • RI/SP coverage and chargeback
Task Bees
  • Workload Rightsizer
  • PVC Rightsizer
  • Cloud Cost
  • Janitor

30–40% lower cloud spend

Explore more

AI-K8sOps

Works beside platform, DevOps, cloud ops

What it does
  • Groups alerts by owning workload
  • Catches anomalies before they page
  • Plans upgrades with pre‑checks
  • Scans CIS, CVEs and misconfigurations
  • Rightsizes routine workloads on schedule
Task Bees
  • K8s Upgrade
  • Helm Chart
  • CVE Patch
  • Cert
  • Health
  • SLO

70% fewer Kubernetes tickets

Explore more

AI-CloudOps

Works beside cloud ops, security, compliance

What it does
  • Inventories every account, every cloud
  • Ranks every cloud's security findings
  • Maps dependencies across accounts
  • Fixes through native cloud APIs
  • Shows cost and incidents together
Task Bees
  • Drift
  • CIS and Posture
  • RBAC Audit
  • Audit Evidence

Audit evidence on demand; drift caught between audits

Explore more

AI-RDS-Ops

Works beside DBAs, app developers, on-call, FinOps

What it does
  • Escalates with evidence already gathered
  • Catches slow queries on sweep
  • Explains every deadlock
  • Spots plan regressions early
  • Answers developers without prod access
Task Bees
  • RDS Alarm Triage
  • Deadlock
  • Blocking & Long-Query Sweep
  • Plan Regression
  • RDS Cost
  • Alarm Coverage

Root cause in under 10 minutes, posted where the alert firedPilot target vs your baseline

Explore more

Every Persona Bee starts in Analyze only, never exceeds its owner's RBAC and can be extended with your own Task Bees.

Build new ones

Build it with Claude Code.Run it on NudgeBee.

An agent your team builds in an afternoon works on a test incident. Production needs a platform around it: months to build, then years of upkeep and model churn. Build it as a Task-Scoped Micro-Agent (Task Bee) and it runs on that platform from day one.

Your Task Bee on NudgeBee compared with building your own agent
LayerYour Task Bee on NudgeBeeBuild your own agent framework + MCP + frontier model
Your use caseYou buildThe job, its steps, your runbookYou buildThe prompt, the tools, the glue code
PlatformThe NudgeBee platform · inherited on day oneYou build it, then keep it running
GuardrailsScope, 8 action types, four checks per step, kill switchA permissions model, an approval flow and a CAB story
Knowledge and memorybCortexKnowledge graph and multi-tier memory, shared by every beeA graph database, a memory store and retrieval
Model routingDAIMBest model per task, any provider; new models certified firstOne pinned model, re-tested every time a vendor ships
Durable runsTemporal: crash-safe, resumable, with rollbackA workflow engine, retries and rollback
Integrations78 systems, plus any MCP serverEach one's auth, rate limits and upkeep
Identity and auditRBAC, SSO, scoped identity; every step loggedAn audit trail security will accept
Time and upkeepWeeks to production; upkeep and models are oursMonths to build, years of upkeep and model churn

Build what only your team knows. Inherit the rest.

Start from the Task Bee catalog and the 5 Persona Agents (Persona Bees) that already work, extend them with your own, and keep the platform's enterprise controls, guardrails and scale.

Integrates into what you already run

Connects to 78 named systems across cloud, 19 observability backends, ticketing, ChatOps, source control and identity, read in place with no re-instrumentation. It doesn't replace your tools; it makes them do more, and it's extensible to any MCP server. Setup is days, not quarters.

NudgeBee
Supports multi-cloud,
hybrid cloud and on-premises

AWS

EKS EKS Fargate AWS Fargate ECS ECS Lambda AWS Lambda

Azure

AKS AKS Container Apps Container Apps App Service App Service Functions Azure Functions

Google

GKE GKE Cloud Run Cloud Run

On-prem

OpenShift OpenShift Rancher Rancher
Works with your existing observability & monitoring stack

Metrics

Prometheus Prometheus Chronosphere Chronosphere VictoriaMetrics VictoriaMetrics Mimir Mimir

Logs

Loki Loki Logstash Logstash Datadog Datadog Splunk Splunk

Traces

Cloud Trace Cloud Trace eBPF eBPF OpenTelemetry OpenTelemetry ClickHouse ClickHouse Jaeger Jaeger

Native cloud services

CloudWatch AWS CloudWatch Azure Monitor Azure Monitor Cloud Logging Cloud Logging

Monitoring

Zabbix Zabbix SolarWinds SolarWinds ScienceLogic ScienceLogic Nagios Nagios
Integrates with
enterprise user tools

Messaging

Slack Slack MS Teams MS Teams G Chat Google Chat Email Email

Ticketing

ServiceNow ServiceNow GitHub Issues GitHub Issues Jira Jira

Code Repos

GitHub GitHub GitLab GitLab

EKS, AKS, GKE + on-premises Kubernetes supported. New integrations added regularly. See all 78 integrations.

Request Integration
Flexible deployment. Nothing leaves.

Built for multi-cloud, hybrid and regulated estates.

  • One platform, four ways to run it
  • One outbound-only agent per cluster; no inbound ports
  • In VPC, on-prem and air-gapped, telemetry, prompts and credentials never leave your environment
  1. SaaS

    The same platform, run for you

  2. VPC / BYOC

    In your account on AWS, Azure, GCP or OCI

    Nothing leaves
  3. On-prem

    On your own Kubernetes

    Nothing leaves
  4. Air-gapped

    Signed, versioned bundles

    Nothing leaves

Your environment VPC, on-prem or air-gapped

  • Collectors
  • Memory (bCortex)
  • Self-hosted models
  • Your observability and APM stack
NudgeBee agentOutbound only
no inbound ports

Collectors, memory and self-hosted models stay inside. Nothing leaves.

Runs on

  • AWS
  • Azure
  • GCP
  • OCI
  • EKS
  • AKS
  • GKE
  • OpenShift
  • Rancher
  • Self-managed
The specialists

System Agents (System Bees)

48 sub-agents, each fluent in one system. You don't work with them directly: they act only when a Task Bee or Persona Bee calls them, within that caller's limits.

Task or Persona BeeSystem Beeone system

Kubernetes and cloud 16

  • Kubectl
  • K8s Debug
  • Helm
  • Argo CD
  • Events
  • AWS Debug
  • Azure Debug
  • GCP Debug
  • CloudWatch
  • Terraform
  • Resource Search
  • Service Dependency
  • Security
  • Recommendation
  • Remediation
  • Automation Builder

Observability 14

  • Prometheus
  • Grafana
  • Loki
  • Logs
  • Traces
  • Jaeger
  • Elasticsearch
  • Datadog
  • New Relic
  • Splunk
  • Last9
  • Chronosphere
  • Visualization
  • Unified Search

Data and workflow 18

  • Postgres
  • MySQL
  • MSSQL
  • Oracle
  • Redis
  • ClickHouse
  • Kafka
  • RabbitMQ
  • GitHub
  • Code
  • Jira
  • Ticket
  • PagerDuty
  • Slack
  • Docs
  • Knowledge Base
  • Runbook
  • Web Search

bCortexthe enterprise context layer

Agents that know your estate, not just your logs.

A prototype agent pastes raw logs into a prompt and guesses. bCortex gives every Persona Bee, Task Bee and custom agent your service map, memory and runbooks. Fix a wrong answer once and every agent stops making it.

70–80%

lower AI cost than one frontier model doing the same workGraph lookups replace log dumps. Open-weight models carry routine volume. Frontier models get only the hard reasoning.Indicative; method on request.

  • Knowledge graph

    Live topology, owners, dependencies and recent changes.

  • Multi-tier memory

    Facts, decisions and corrections per tenant, agent, app and env.

  • Retrieval over your docs

    Runbooks, SOPs, KBAs and past incident write-ups.

  • DAIM model router

    Picks the model per task. Re-routes when a model changes.

Memory you own. Stored in your PostgreSQL, exportable to JSON or Markdown.

Context sent to AI-SRE ExampleOOMKilled · payments-api · prod-eks-1
Service mapcheckout-webpayments-apipayments-dbowner: team-payments
Recent changePR #4127 batch size 200 → 800, merged 6h ago
MemoryOOM after a batch-size change is a limit issue, not a leak. Raise memory, keep the PR.correction saved after INC-1182 · team-payments, all envs
Runbookpayments/oom-after-deploy.md, steps 2–4
Model routeopen-weight for triage, frontier for root cause
One correction, made once AI-SREAlert TriageRemediationScribeyour custom bee

Always-on agents make token cost a running cost. Context size is what keeps it flat.

DAIMthe dynamic adaptive intelligent model router

The right model for every step.

Agentic ops is always-on: hundreds of runs a night. On one frontier model, per token, the bill grows with every run. DAIM sends each step to the model that does it best.

  • Accuracygrounded context and the best model per task
  • Costno per-token bill for the always-on load
  • Latencysmall models answer the routine steps
StepA task

Agents reference a task, never a model ID

DAIM

Scores every step on

  • Accuracy
  • Cost
  • Latency
  • Availability
  • Frontier models get only the hard reasoning
  • Falls back on regression

New release? Certified against the ops task set before it enters the pool, up to four a year

Hard reasoningFrontier models

On the contract you already have

The always-on loadOpen-weight models, in-network

Gemma, Qwen, Nemotron, Granite for classification, summarization, PromQL/LogQL; sovereign-ready

Bring your own model9 provider routes; no new vendor, no lock-in

  • Anthropic
  • Bedrock
  • Azure OpenAI
  • OpenAI
  • Gemini
  • Vertex AI
  • SageMaker
  • Hugging Face
  • Any OpenAI-compatible (vLLM, Ollama, TGI)

Published customer results

70%lower MTTRCited root cause, fix attached
68%fewer L3 escalationsTickets arrive with evidence attached
30–40%lower cloud spendRightsizing shipped as gated PRs
5×more automations by the same teamRunbooks become Task Bees

Published customer results; indicative ranges validated in your first 30 days. See the case studies →

Multicloud complexity does not slow down when your team does. NudgeBee's SRE and AIOps agents absorb routine operations autonomously so our teams focus on high-value engineering. Their extensive library of specialist agents gives Rackspace the building blocks to rapidly create custom agentic workflows at scale.
Nirmal RanganathanCTO, Global Public Cloud, Rackspace
Role paths

Start with your function. The same runtime takes the next one.

VP / Director of Cloud or Platform

The estate grows faster than the team

AI-CloudOpsAI-K8sOps

2–3× engineer capacity

VP / Director of SRE

MTTR in hours; alert noise driving attrition

AI-SRE

70% lower MTTR

VP / Director of DevOps

Upgrades, CVEs, certs and drift slip because the pre-work is manual

AI-K8sOps

70% fewer Kubernetes tickets

Head of Support / NOC

The same questions every week; nights and weekends uncovered

AI-SRE

2 decisions left for a human by morning

VP / Director of FinOps

Recommendations nobody applies; anomalies found at month end

AI-FinOps

30–40% lower cloud spend

Head of Database / Data Platform

"It's slow" lands on the DBA team with no query, no plan and no evidence. Developers can't see production.

AI-RDS-Ops

50%+ of DB incidents root-causedPilot target

Scope a 30-day pilot on one function.

Your 30-day pilot is Day 1 to Week 4 of the journey. Bring one runbook to the pilot.

  1. Week 1Connect and map; one persona, three bees, one cluster or account, all in Analyze only.
  2. Weeks 2–3Compare each bee's output with what the team would have done; raise the dial in non-prod where it was right; convert one runbook.
  3. Week 4Scorecards against the measures you set on day one; promote the best bees; choose the edition.

From you: read access to connected tools, one owner per bee, a channel, 30 minutes a week.

GitHub Repo
Zero telemetry One Helm command
helm install nudgebee oci://ghcr.io/nudgebee/charts/nudgebee
Scope a pilot Talk to an engineer
Start a free trial
Frequently asked

Questions security and ops teams actually ask

For your security team, VP of Engineering and SRE lead.

Book a demo
As Cloud SaaS, in your own VPC (BYOC), on-prem or air-gapped. It runs on EKS, AKS, GKE, OpenShift, Rancher or self-managed Kubernetes, on linux/amd64 and arm64.
Nothing, in VPC, on-prem or air-gapped deployments: collectors, memory and self-hosted models stay inside. Each cluster runs one outbound-only agent, with no inbound ports.
No. There is zero data egress: tools are queried in place over their APIs, and your observability and APM stack stays as it is. Models are never trained on your data.
Sign-in uses SSO (SAML, or OIDC with Okta, Entra ID, Auth0, OneLogin or Google), LDAP or Teleport. Access is controlled with RBAC and a scoped service identity per agent, and tenant isolation is enforced at ingestion and at query.
SOC 2 Type II and ISO 27001. Every run, step, approval and config change is recorded in an audit log you can export. SOC 2 Type IIISO 27001
You do. The knowledge graph and memory live in your own PostgreSQL, and you can export them to JSON or Markdown at any time.
NudgeBee is a production-safe agentic ops platform for cloud, SRE, DevOps, support and FinOps teams. Its Task-Scoped Micro-Agents (Task Bees) each do one job the same way every run, and Persona Agents (Persona Bees) group them by function: incidents, cost, Kubernetes, cloud and databases. It doesn't just detect problems: it triages, investigates and executes fixes through PRs, runbooks and automations with full enterprise guardrails.
A Task Bee, or Task-Scoped Micro-Agent, is a NudgeBee agent that does one job. It follows a fixed list of steps, calls only the functions on its list and runs inside the limits security approved; the model reasons inside a step but never decides which step comes next. Security approves it once, the way it reviews a runbook.
A Persona Bee, or Persona Agent, groups the Task Bees that work one function and inherits their limits. Five are ready to use: AI-SRE for incidents, AI-FinOps for cloud and Kubernetes cost, AI-K8sOps for Kubernetes operations, AI-CloudOps for AWS, Azure and GCP, and AI-RDS-Ops for databases on Amazon RDS.
Only at a trust level you set, under the admin ceiling, never on day one. Every new bee starts in Analyze only, and Access and One-way changes default to Off. Every change is a change set with rollback, and every run, step and approval is in the audit log with the approver named.
When self-hosted, NudgeBee sends zero telemetry, and credentials are encrypted at rest with AES-256-GCM under a key you hold. Because the implementation is readable and runs entirely inside your cluster, you can verify this for yourself.
Both. NudgeBee runs as Cloud SaaS, or self-hosted in your own VPC, on-prem or air-gapped for strict data residency requirements. It's SOC 2 Type II and ISO 27001 certified, and models are never trained on customer data.
The Community edition is free: you deploy and run it yourself, on unlimited clusters. Enterprise Support starts at $500 a month, billed annually and priced by environments and clusters. Enterprise Platinum, a commercial license for Cloud SaaS or self-hosted with full implementation, is priced on environments, clusters and accounts. See pricing
No. NudgeBee is priced on the environments, clusters and cloud accounts it covers. There are no metered AI credits, no per-investigation fee and no agent-runtime meter, so the bill does not climb as agents do more.
The ones you choose. NudgeBee works with Anthropic Claude, Google Gemini and OpenAI GPT, and with self-hosted open-weight models such as Gemma, Llama, Nemotron, Qwen and DeepSeek. The DAIM model router sends each step to the model that does it best, so small models answer the routine steps.
DAIM, the dynamic adaptive intelligent model router, certifies new releases against the ops task set before they enter the model pool, and falls back on regression. Agents reference a task, not a model ID, so model churn becomes an upgrade you receive, not a re-testing project.
You bring your own model with no metered AI credits, so there's no per-investigation tax. The knowledge graph and memory keep token usage low, so running agentic ops doesn't blow up your model bill.
NudgeBee automates alert triage and root cause analysis by correlating logs, metrics, traces and recent deployments, then recommends or executes fixes via PRs and runbooks. Published customer results: 70% lower MTTR, 68% fewer L3 escalations.
Yes. NudgeBee's AI-FinOps Persona Bee analyzes real CPU, memory and storage utilization and executes rightsizing via PRs with approval automations. It flags spend anomalies and abandoned resources across clouds; customers typically achieve 30–40% cost reduction.
Yes. NudgeBee layers on top of what you already run. It integrates with 78 systems including Prometheus, Grafana, Datadog, Splunk, CloudWatch, Jira, GitHub and Slack. Most setups are live in days with no changes to existing pipelines.
Datadog tells you something is broken. NudgeBee tells you why and opens a PR with the fix, sitting on top of your existing observability stack. It also adds FinOps and an automation builder for ops automation beyond incident response.
Yes. The full implementation is readable: the Persona Bees, the Task Bees and the Helm charts you deploy. You can self-host it in your own cluster and run it in production internally for free, at any scale. The two-cluster / two-cloud-account limit applies to the hosted Cloud SaaS free tier.