Skip to Content
Use casesOn-call helper

An on-call helper you hand an alert to

Paste the alert, press go, and get an investigation. A standing deputy reads your monitoring and your code, finds the likely cause, and asks you before it changes anything. It keeps notes, so it gets better at your recurring incidents.

How it works

  • Trigger. You, by hand. Press Launch on the deputy page, or run a command in your terminal.
  • What the run does. It reads your alert notes, investigates with the tools in its manifest, and reports the likely cause.
  • Who is contacted. You, because you started the run. Questions appear on Home and in the run page, and in Slack when your admin has connected Slack.
  • What you see. The live transcript. You can message the run, or take it over. The Changes tab shows any diff.

Set it up

  1. Connect GitHub. See Connect GitHub. Connect your monitoring tools too, for example sentry-mcp or datadog-mcp. See Integrations.
  2. Create a manifest with the packages claude-code, github, and the monitoring packages you connected.
  3. Open Deputies, select New deputy, and fill in Name, Description, Manifest and Owner. Set Name to oncall so the command below matches. Make yourself the owner.
  4. In the deputy, select New mission. Name it investigate, paste the prompt below into Prompt, select Dry run, then Activate.
  5. Open Context & memory and write your runbooks and service owners in the Context tab.
  6. To run it, press Launch next to the mission. Paste the alert into the notes and start the run.

You can launch from the terminal as well. This command starts the mission and streams the run:

marshal deputies launch oncall --mission investigate --notes "Paste the alert text here" --follow

Send a follow-up to the live run with marshal deputies message <run-id> "Check the last deploy too".

What you should see: a new run under Recent runs with the notes in its prompt.

Example mission prompt

You are our on-call helper. The alert or question is in the extra
instructions for this run.

1. Read the alert. Identify the service and the time window.
2. Check monitoring for errors, logs and recent changes in that window.
3. Check the repository for recent merged pull requests that touch the
   service.
4. Report the likely cause, the evidence, and the next step you
   recommend.
5. Before you change anything, ask me with the choices Go ahead and
   Hold off, and wait for my answer.
6. Add what you learned about this kind of incident to your Memory.

Make it yours

  • Keep a runbook per service in Context. Let Memory collect what the deputy learns. Both have history and restore. See Memory.
  • Add a second mission, for example postmortem-draft, on the same deputy.
  • Give a team the deputy. Anyone on the team who can see it can launch it.
Approval before mergeBuilding blocks