Your ops teammate that never sleeps.
OpsAgent watches your cloud day and night, read-only. Urgent problems reach you the moment they matter. Everything else waits for a calm morning briefing. It never changes anything.
Checks for urgent exposures every 15 minutes, day and night, and alerts you right away. Everything else waits for the morning briefing.
Built for the founding engineer who owns the cloud bill, and for the developer who inherited the infrastructure when the contractor left.
Urgent alert
Database prod-db snapshot left public
Sent to #ops right away
Morning briefing
2 IAM keys unused for 180 days
Cites the user ci-deploy and the last-used date of each key.
Storage bucket
assets-oldis publicly readableCites the bucket policy statement that grants public read.
Spend on track: $1,240 of $1,300 budget
Cites month-to-date spend and your monthly budget.
While you sleep, and when you wake
While you sleep
Urgent exposures are checked every 15 minutes.
When it's urgent
An alert in Slack, or email if Slack isn't connected.
Every morning
One short briefing, skipped when nothing changed.
How it works
Connect read-only
Create a role in one click. It can read how your cloud is set up and what it costs, and it cannot read your stored data or change anything, except what you opt into (see Security).
Checks run
Deterministic checks run against your account. Fixed rules decide what is wrong, with no AI guessing.
Briefing and alerts
A morning briefing in Slack, exceptions only and skipped when nothing changed, plus a weekly report. Urgent exposures reach you within minutes.
What it checks
Ten checks run every night. Each finding names the resource and shows the evidence, so you can confirm it yourself.
Idle resources and cost anomalies
Things you pay for that nobody uses, and spend that jumps for no clear reason.
IAM hygiene
Old access keys, users without MFA, and admin access nobody needs.
Public exposure
Storage, databases and open ports that anyone on the internet can reach.
Backup coverage
Which resources have backups, and whether the permissions to restore them are in place.
Certificate expiry
Certificates close to expiring, flagged before your users see the error.
Logging and detection gaps
Audit logs and threat detection that are switched off or incomplete.
Idle GPUs and stuck training jobs
GPU machines doing nothing, and training jobs that stopped making progress.
Leaked secrets that are still active
Secrets flagged by GitHub secret scanning whose keys are still active in your cloud.
Infrastructure-as-code drift
Resources that no longer match the code that is supposed to define them.
Deploy and pipeline health
Pipelines that keep failing and deploys that stalled halfway.
What it will never do
Write to your infrastructure
Its role has no write permissions, so it cannot change, stop or delete anything.
Read your data
It cannot read your stored data (objects, database rows, secret values); it reads configuration, metadata and billing, plus a few scoped reads you opt into, listed on the Security page.
Spam you with noise
Only urgent findings will ever interrupt you, and only on the channels you choose. Everything else waits for your morning briefing.
Resell AI
You bring your own agent or model key, and pay your AI provider directly.
OpsAgent for iOS and Android: alerts and briefings in your pocket.
Coming soonBring your own AI
OpsAgent never pays for or resells inference.
Point Claude, Cursor or any other MCP client at OpsAgent and ask about your findings in plain words. Or add your own model key for explanations and chat.
MCP serverhttps://brain.opsagent.dev/mcp
Get your ops teammate.
The alpha opens to a few teams at a time. Join the waitlist and we will email you when your spot is ready.