OpenDeRisk CLI
OpenDeRisk
OpenDeRisk CLI starts an environment with separate agent roles for inspecting observations, writing analysis code and reporting.
- 982 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The application reads operational logs and uploaded data; the selected model provider may receive this context.
- With an empty token allowlist, the MCP gateway permits anonymous access to connected tools.
Install
Manual install
curl -fsSL https://raw.githubusercontent.com/derisk-ai/OpenDerisk/main/install.sh | bashThe README’s first recommended method installs OpenDeRisk. Inspect the installer first. Enter model settings in the local configuration and start the interface separately. Set a nonempty MCP token list and restrict access to approved data and tools.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The application reads operational logs and uploaded data; the selected model provider may receive this context.
- With an empty token allowlist, the MCP gateway permits anonymous access to connected tools.
This is third-party code. Review the repository files before installing.
What it does
OpenDeRisk CLI starts a self-hosted application incident-analysis service. You upload data and configure models through its web interface. Agents compare logs, metrics and code to propose a possible incident cause. The main example uses OpenRCA. The interface shows the work and the evidence behind its conclusion. The CLI prepares and starts the analysis environment. Users configure actual monitoring sources separately; example data does not describe their application’s state.
Who it is for. SREs with prepared incident logs and metrics who evaluate agent diagnosis using an approved data copy.
Good fit when
- An engineer relates incident evidence across logs and metrics.
- The OpenRCA example is reproduced in a separate test environment.
- An uploaded flame graph is examined with a model.
- The retained investigation trace is used to inspect report evidence.
Not a fit when
- You only need a small MCP connector to an existing monitoring system
- Logs cannot be sent to the selected model service
- You require unreviewed production remediation based on the proposed cause
Example request
Prepare a test OpenDeRisk deployment and show the data needed for one incident. Use sanitized log copies and do not run production remediation commands.Limitations
Configure models separately with your own API keys; the installed interface does not supply provider access. Logs and uploaded data can reach the selected model, so check permission to share them. The MCP gateway allows anonymous access when its token list is empty; configure tokens and test sign-in before exposing it externally. Verify a proposed incident cause against original observations even when agents have prepared analysis code and a report.
How to disable. Stop the server and related processes through the chosen deployment method. Save needed reports before removing the environment and checkout. Datasets and user configuration may remain separately; revoke model keys with their provider.
FAQ
How do I start from source?
After cloning and installing dependencies, run `uv run derisk quickstart` from the root. `uv run derisk quickstart -p 8888` selects another port. Model credentials are not included.
Where is the interface?
Open `http://localhost:7777` to configure models and upload data. A responsive page confirms service startup; check the incident conclusion against the original observations.
What is OpenRCA for?
It provides example observations for root-cause analysis. Place the chosen dataset under `pilot/datasets/`. Prepare your own observations for the workflow you select.
Can I start without a configuration file?
Yes. `quickstart` opens the interface for model setup. Use `-c configs/derisk-proxy-aliyun.toml` for an explicit profile and supply credentials in your own configuration.
What do the analysis roles do?
They divide operations-data investigation, analysis code and reporting. Multiple roles do not establish a cause by themselves; compare the conclusion with the original observations.
What do OpenRCA and a source build require?
Download OpenRCA separately; the extracted example takes about 26 GB. Source builds need Python 3.10 or later and uv with selected components. The code uses MIT; model usage is billed separately.
Discussion
No questions or reviews yet.
Related
CLI toolsThe official Coralogix CLI with 19 skills: an agent reads production logs, traces and metrics and triages incidents
A monitoring dashboard for OpenClaw agents: sessions, token and cost use, system load and scheduled jobs in one browser window
An agent runs GitHub Docker Compose projects in a disposable sandbox, verifies workflows and hardens them with a report
A local one-page dashboard for OpenClaw agents: gateway, model costs, cron, sessions and sub-agents, with no login and no cloud.
Self-hosted ops platform with an SRE AI agent and an MCP endpoint that lets an external AI client triage alerts and check hosts
The RootCX CLI and skill: an app written by an agent gets a database, SSO, roles, audit and deployment on one server.
README in short
Package version 0.7.0 installs the `derisk` command. The repository keeps the web interface, agent logic and tool integrations in separate components.