Point it at a repo. Get a root cause you can actually check.
The PrismaLens CLI investigates a firing alert the way an on-call engineer would — it reads the repo, runs read-only commands through your existing local tooling and auth context (kubectl, aws, gcloud, curl) instead of calling observability APIs directly, and returns hypotheses ranked most to least plausible, each linked to the evidence behind it.
$ cat alert.json | npx prismalens investigate --repo . prismalens and the shorter pl alias point at the same binary — pl investigate works too; run pl doctor first to check your setup.
A real recorded run — a firing latency alert piped in, root cause out (condensed):
Read-only AI investigation
Point it at a repo, pipe in a firing alert (or describe the problem with --query). PrismaLens investigates the same way an on-call engineer would and returns a report.
Ordered evidence, not guesses
Hypotheses ranked most to least plausible, each backed by evidence it actually gathered — what was ruled out, what was covered, and what to check next. No numeric confidence scores.
Bring your own model, no account
Works with Ollama, OpenAI, Groq, any OpenAI-compatible endpoint, or a Claude Code install. No PrismaLens account, no subscription — your keys, your provider.
An enforced sandbox, honestly reported
--sandbox runs the investigation behind an OS-level egress boundary when one is available, and every report states what was requested vs. what was actually applied.
Every run saved locally
Reports and full event streams persist to ~/.prismalens/runs/. Use --json to pipe results into your own scripts and dashboards.
`pl doctor` before you run anything
Preflights your setup — harness (the coding agent it drives locally) binary on PATH, a model credential set, a writable workspace — so failures surface before an investigation starts, not mid-run.
Why We Built This
At 2:47am, your payment API times out and you spend 90 minutes correlating dashboards, logs, and deploys before finding the cause. You had the right tools — the problem was correlation, not observability, and that takes time you don't have at 3am.
The PrismaLens CLI does that legwork for you, and hands back a trail of evidence you can actually check — not a black-box score.
A self-hosted server is in development
Today, PrismaLens ships as a CLI you run from your terminal. A self-hosted server — a web UI and webhook alert intake for triggering investigations from your existing monitoring stack — is on the roadmap, not yet released.
Ready to try it on a real alert?
Install the CLI, run pl doctor to check your setup, and investigate your first firing alert in a few minutes.
Get Started →