Detective Agent

Custom Build. Scoped per engagement.

An investigation agent for bugs and incidents. You point it at a problem — a failing service, a confusing report, a “why did this happen?” — and it pulls from every data source you have to trace it to root cause. Slack threads, Google Docs, Confluence, logs, infra: it reads them the way a senior engineer would when piecing together what went wrong.

Triggered from Slack, it investigates in the background and reports its findings right back in-thread — timeline, evidence, and a hypothesis your team can act on.

---

What it does

• Triggered from Slack — mention it on a bug or incident thread and it takes the case
• Pulls from every source — Slack history, Google Docs, Confluence, logs, dashboards, and infra/observability data
• Correlates across them — connects a log spike to a deploy to a doc to the original discussion
• Reports back in-thread — a timeline, the evidence behind each step, and a root-cause hypothesis
• Cites everything — every claim links to the source, so your team can verify rather than trust blindly

Tools / stack

• Claude Managed Agents — agent runtime + session lifecycle
• Slack Events API — the trigger surface and where findings land
• MCP servers — typed connections to Google Drive, Confluence, your logging/observability stack
• Modal Sandboxes — isolated execution for any diagnostic commands it runs

Use cases

• First-responder triage on incident channels — context assembled before a human even joins
• “Why is this broken?” investigations that span code, infra, and tribal knowledge in docs
• Postmortem groundwork — the timeline and evidence drafted automatically

How this differs from the Background Agent

The Background Agent is connected to everything and acts — it ships fixes. The Detective Agent investigates and reports. Read-only by design, narrower scope, faster to stand up — a strong first deep-integration project before handing an agent write access.