Search papers, labs, and topics across Lattice.
ARGUS is an MCP-grounded root cause analysis assistant that integrates a commercial LLM with live Kubernetes observability data to streamline incident triage. By standardizing data access through MCP servers, ARGUS delivers structured diagnostic summaries directly within Slack, enhancing the workflow for on-call engineers. In a preliminary evaluation, ARGUS accurately identified the root cause in all tested scenarios, achieving a high success ratio, but faced skepticism regarding its recommended fixes, highlighting a critical diagnostic/prescriptive asymmetry.
ARGUS reliably identifies root causes in Kubernetes incidents but struggles to gain trust for its prescriptive recommendations, revealing a critical gap in automated incident response systems.
Kubernetes incident triage requires correlating signals from metrics, logs, container state, and messaging systems across multiple monitoring tools, a fragmented workflow that slows diagnosis and contributes to alert fatigue. Large language models (LLMs) have shown promise for automated root cause analysis (RCA), but existing systems rely on custom, system-specific data access layers that cannot be reused across organisations. We present ARGUS, an MCP-grounded RCA assistant that connects a commercial LLM to live Kubernetes observability data through standardised MCP servers covering Kubernetes state, Prometheus metrics, Loki logs, and NATS messaging, and delivers structured diagnostic summaries inside the Slack incident channel where on-call engineers already work. We conduct a preliminary evaluation of ARGUS using three complementary methods: controlled fault injection across ten Kubernetes incident scenarios, rubric-based scoring of the resulting RCA summaries on three dimensions, and semi-structured interviews with six on-call engineers at an industrial partner. ARGUS named the correct root cause in all ten scenarios with an aggregate MCP success ratio of 0.91. Practitioners trusted the diagnostic output but consistently expressed scepticism toward the recommended fixes. Our central finding is a diagnostic/prescriptive asymmetry: ARGUS reliably identifies what went wrong, but is perceived as less reliable or trustworthy at specifying what to do next. This pattern can be observed across all three evaluation methods, and has important implications for future autonomous agentic incident handling systems.
