Detective Agent

Custom Build. Scoped per engagement.

An investigation agent for bugs and incidents. Point it at a problem (a failing service, a confusing report, a “why did this happen?”) and it pulls from every data source you have to trace it to root cause. Slack threads, Google Docs, Confluence, logs, infra: it reads them the way a senior engineer would when piecing together what went wrong.

Triggered from Slack, it investigates in the background and reports its findings back in-thread: a timeline, the evidence and a hypothesis your team can act on.

---

What it does

• Triggered from Slack: mention it on a bug or incident thread and it takes the case
• Pulls from every source: Slack history, Google Docs, Confluence, logs, dashboards and infra/observability data
• Correlates across them: connects a log spike to a deploy to a doc to the original discussion
• Reports back in-thread: a timeline, the evidence behind each step and a root-cause hypothesis
• Cites everything: every claim links to its source, so your team can verify instead of trusting blindly

Tools / stack

• Claude Managed Agents: agent runtime and session lifecycle
• Slack Events API: the trigger surface and where findings land
• MCP servers: typed connections to Google Drive, Confluence and your logging/observability stack
• Modal Sandboxes: isolated execution for any diagnostic commands it runs

Use cases

• First-responder triage on incident channels: context assembled before a human even joins
• “Why is this broken?” investigations that span code, infra and tribal knowledge in docs
• Postmortem groundwork: the timeline and evidence drafted automatically

How it differs from the Background Agent

The Background Agent is connected to everything and acts: it ships fixes. The Detective Agent investigates and reports. It’s read-only by design, narrower in scope and faster to stand up: a strong first deep-integration project before you hand an agent write access.