CrisisMode is the recovery layer for your infrastructure. Monitoring tells you something is wrong. CrisisMode tells you what to do about it — safely. AI-powered diagnosis, validated recovery plans, human-in-the-loop execution with an immutable forensic trail — and now, a scale-readiness report that tells you what will break under load before it does.
Run crisismode scan with zero configuration. It detects what's running, checks health, and tells you what to look at first. No YAML, no credentials, no setup ceremony.
crisismode mcp and Claude or Cursor can check your stack's health and readiness for you
Recovery is what you need after things break. crisismode readiness is what you run before: one command that checks the failure modes that take working apps down at scale — connection limits, missing indexes, stuck transactions, slow queries — and computes how much load your stack can actually take. Every number is labeled with where it came from. Nothing is ever made up.
Connection headroom, connection-limit tiers, idle transactions, missing indexes, slow queries, serverless pooling. Each finding explains what it means in plain English, what to do about it, and where to learn more — whether you've run production for ten years or shipped your first app last week.
Ceilings are labeled declared (a configured limit), measured (observed from your live system), or typical (a cited range, explicitly not a measurement). Throughput bounds are derived from Little's law with the practical wall called out — an "at most," never a promise.
If a check can't run, it says so and tells you why — it never guesses, and gaps never move your score. This contract is enforced by torture tests that stop the database mid-run and verify CrisisMode reports honestly instead of fabricating.
CrisisMode doesn't demand a new workflow. It speaks the formats your tooling — and your AI agents — already use.
Pipe an SRE incident evidence bundle to crisismode bundle respond and get back ranked root-cause hypotheses and policy-gated recovery actions in a structured AdapterResponse — compatible with the emerging SRE incident-agent ecosystem, scored against its open compatibility benchmark.
Run crisismode mcp and Claude, Cursor, or any MCP-capable agent gets eight read-only diagnosis tools — scan, diagnose, readiness, and more. Ask your coding agent "will my stack survive launch?" and it can actually go find out. The MCP surface never mutates infrastructure.
Nagios/Icinga, Goss YAML, Sensu, and native JSON check formats work out of the box — decades of community health checks become CrisisMode signal without rewriting anything.
CrisisMode is not a general-purpose automation platform. It is the tool an organization reaches for when normal operational tooling has failed or is insufficient.
Agents inherit safety guarantees from the framework. An agent that follows the contract cannot bypass state preservation, skip approval gates, or exceed its declared blast radius.
The framework captures system state before mutating actions, preserving evidence for post-incident analysis, compliance, and learning — within the constraints of system health.
Notification, approval, escalation, and communication are first-class primitives with the same rigor as system actions. Not an afterthought — a design constraint.
Pre-authorized action catalogs (spec-stage, hub roadmap) will make approval fast for known scenarios. The system never provides mechanisms to skip approval under pressure.
Designed so agents earn autonomy over time through demonstrated reliability in specific scenarios and environments (spec-stage, hub roadmap). Trust is scoped per agent, scenario, and environment.
The framework sheds capabilities progressively as the environment degrades, rather than failing entirely. Recovery capability is always available at some level.
Every recovery follows a structured sequence. The framework orchestrates each phase — agents never interact directly with target systems. This is the full lifecycle defined by the contract specification; catalog matching and trust-level gating are spec-stage and not yet shipped in the open-source CLI.
Framework receives trigger from alert, health check, or manual invocation
Check pre-authorized action catalogs for matching scenario
Identify applicable agent based on trigger context and manifest declarations
Assemble context bundle — system topology, trust levels, organizational policies
Agent performs read-only investigation using provided context
Agent may submit a lightweight diagnostic plan for investigative mutations
Agent produces a Recovery Plan — linear steps with bounded decision points
Validate plan against manifest, organizational policies, and blast radius
If plan matches a catalog entry, approval is pre-satisfied for covered risk levels
Execute approval gates per risk classification and trust level
Orchestrate plan steps: snapshot → action → verify → notify
At declared checkpoints, agent may revise remaining plan based on current state
Produce forensic record and trigger post-recovery notifications
The framework operates as concentric layers. As the environment degrades, outer layers shed while core recovery remains available. A recovery tool that requires healthy infrastructure to operate is useless.
Advanced trust analytics, stakeholder communication rendering, observed impact monitoring, topology feedback loop
Human approval routing, escalation management, notification delivery, pre-authorized catalog matching, fallback approval
State preservation capture, plan validation against manifest, blast radius enforcement, forensic record assembly
Sequential plan execution, command dispatch, precondition evaluation, success criteria checks, local audit log, stepwise rollback. Zero external dependencies.
The Recovery Agent Contract Specification defines the interface between agents and framework with the precision of a protocol specification. Every requirement is phased, every interaction is structured, every decision is auditable.
Linear sequences with bounded decision points. A plan with 10 steps and one binary decision is comprehensible at 3 AM during a P1 outage. A 30-node graph is not.
When conditions change beyond what a binary decision point can handle, the agent produces a new plan. Simple plans, clean audit trail, novel situations handled naturally.
Organizations pre-authorize specific recovery approaches during calm conditions. A crisis activates the pre-approved response — fast for the safe phase, controlled for the risky phase.
CrisisMode is open source. Read the specification, run the interactive demo, build your first recovery agent.