Brain
An AI analyst that cites evidence and asks first
Ask about your logs, metrics, traces and devices in plain language. Brain answers with links to the evidence, builds agents with you, and turns changes into proposals a person confirms, on the model you choose.
- Bring your own model
- Writes need confirmation
- Auto-Fix never merges
How it works
From a question to a confirmed change
Brain is never more powerful than the person asking. It reads with your permissions, and it cannot approve anything.
- 01AskAsk in plain language, and @ mention a host, device or service to give Brain its context.
- 02ReadIts tools query logs, metrics, traces, problems and devices under your own permissions.
- 03ExplainAnswers cite the trace, the port and the change, with charts in the thread and links to each.
- 04ProposeA change comes back as a card with the exact target and the change. Confirm, edit or reject it.
- 05RouteDevice changes become NCM change requests and security responses become SOC proposals, each with its approvers.
- 06RecordEvery proposal and decision is written to a hash-chained ledger.
Workflows and agents
Build agents on a typed graph, with approvals the engine enforces
Wire triggers, AI agents with their models, tools, memory and MCP servers, approvals and actions on one canvas. Network configuration changes, Auto-Fix publishing and MCP servers allowed to write run only behind an approval: the engine refuses a graph that skips it.
- Describe a workflow in a sentence and Brain drafts the graph for you to review and turn on
- SOC triage, investigation and hunting agents ship as drafts you can read, edit and switch on
- Ready-made playbooks install as ordinary workflows, with your credentials bound
Auto-Fix
From a production error to a pull request you review
Auto-Fix traces an error to the code, manifest or deploy behind it, has Brain write and verify a patch in its own worktree, and opens a pull request only after an approver says yes. It never merges.
Where errors come from
Traces, logs, real user sessions, Kubernetes signals and failing CI jobs.
Checked before you see it
Path rules, a secret scan and your own test commands run on the staged change.
Your code host
GitHub, GitLab and Azure DevOps Services. Bitbucket is coming.
Confirmed in production
A fix counts once its merge deploys and the error stays away for an hour.
Governance
You decide what AI can touch
Admins choose the models, decide which tools every agent may use, cap what agents spend, and can switch every model call off at once. Brain has no tool that changes those settings, reads a saved secret or approves anything.
- One switch turns AI off everywhere: no model or embedding call is made
- Auto-apply for small, undoable changes stays off until an admin allows it and the person picks it
- Every Brain proposal and decision is on a hash-chained ledger an admin can verify
Better together
Brain works where the evidence already is
Problems, device changes and security alerts live in the same workspace, so an answer can cite all of them and a fix goes through the approvals each one already has.
- Problems and casesRelated alerts become one problem with a suspected cause and what changed, ready for Brain to explain.Learn more
- Configuration managementDevice changes Brain proposes become change requests that a second person approves.Learn more
- Threat detectionSOC triage, investigation and hunting agents run on the same engine, and every response waits for approval.Learn more
Bring your own model
Which model providers work, and what each reports
Every AI feature runs on a connection your admins add. Pick one preferred model, a different one per feature, and a fallback for when a provider is rate limited or down.
| Provider | Connect with | Model list | Context and limits | Prices for spend caps |
|---|---|---|---|---|
| Anthropic | API key | Live from the provider | Reported per model | Built-in price table |
| OpenAI | API key | Live, chat models only | Not reported | Set by an admin |
| OpenAI-compatible servers | Base URL, key optional | Live when the server lists them, or type the id | When the server reports them | Read from OpenRouter and Together, otherwise set by an admin |
| Anthropic-compatible gateways | Base URL and API key | Live from the gateway | When the gateway reports them | Built-in price table for Claude models |
OpenAI-compatible servers include Ollama, vLLM, LM Studio, LiteLLM, OpenRouter, Groq and Together. An endpoint you host must be reachable from your workspace: private addresses are blocked unless an operator allows them. A model with no price counts as unpriced, not as free.
What data does Brain send to the model provider?
Does Brain change anything without asking?
Can we use a model we host ourselves?
Can other AI assistants query Tracix over MCP?
Connect a model and ask your first question
Add an Anthropic, OpenAI or OpenAI-compatible credential, choose it in AI Settings, then open Brain from any page.