AURA SRE Agent Platform
Connect configurable agent teams to production tools to investigate incidents and carry out work within operator-defined boundaries.
- Source repo
- mezmo/aura
- Stars
- ★ 412
- Last updated
- 5d ago
- License
- Apache-2.0
- Primary language
- Rust
- FA score
- 71/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- An SRE team investigating a payment failure correlates logs, traces, metrics, and Kubernetes deployment history to find a recent regression and outline recovery checks.
- Not a fit if
- Teams that cannot send prompts or tool data to configured services
- Teams seeking a turnkey hosted SaaS with no deployment work
- Source review
- 71/100 · Some gaps
What does this agent do, and when should you use it?
AURA is an SRE agent platform with a Rust core, a CLI, a local runtime, a web server, and an embeddable library. Its TOML configuration defines models, specialist agents, prompts, tools, approval policies, and guardrails; aura init creates the initial configuration. The runtime connects to multiple model providers, MCP-compatible tool servers, and Qdrant or AWS Bedrock Knowledge Bases. Agents can coordinate dependency-aware tasks and interoperate with clients and other agents through an OpenAI-compatible API or A2A. AURA can run on infrastructure you operate, while data destinations depend on the model, tool, approval, storage, and tracing services you configure.
Run aura init to choose a model provider and initial model and write the initial configuration, then start the interactive agent with aura. Agents can read logs, metrics, traces, cloud resources, deployment state, tickets, and runbooks through MCP servers and built-in integrations. A configured agent team can coordinate an investigation—for example, correlating Mezmo telemetry, Prometheus latency, and Kubernetes deployment history—and produce a likely cause, rollback recommendation, recovery checks, and engineering follow-up. AURA can also serve through aura webserver, expose an OpenAI-compatible API to clients, or be embedded as a Rust library. Model, tool, and orchestration activity can be exported as OpenTelemetry traces, and sensitive tool calls can require human approval.
- An SRE team investigating a payment failure correlates logs, traces, metrics, and Kubernetes deployment history to find a recent regression and outline recovery checks.
- An on-call engineer gathers incident context from PagerDuty, Slack, or monitoring systems while requiring approval before configured tool calls run.
- A platform team queries AWS, Azure, GCP, or Kubernetes resource and runtime state to support operational troubleshooting.
- An operations team runs agent investigations as steps in durable Temporal workflows.
- A security or compliance team runs agents on its own infrastructure, including an isolated environment where model providers and MCP servers are locally reachable.
- A development team defines specialist agents in TOML and connects them to existing systems through the OpenAI-compatible API, A2A, or the Rust core library.
How do you install or deploy this agent?
The README provides an install script for Linux and macOS. It downloads published release artifacts and verifies their checksums. Initial setup asks you to choose a model provider and initial model. Required credentials depend on the selected provider and integrations; the README does not specify one universal set of required environment variables. Hosted models and remote tools require access to their respective services.
How do you use this agent?
After installation, initialize and start a local agent in a terminal:
curl -fsSL https://raw.githubusercontent.com/mezmo/aura/main/scripts/install.sh | bash
aura init
auraaura init asks for a model provider and initial model, then writes the initial configuration. Edit the TOML as needed to define agent teams, tools, and approval policies. To run AURA as a service, use:
aura webserverThe README also documents the mezmo/aura Docker image and the included Helm chart; configuration and credentials depend on the providers and integrations you enable.
What are this agent's strengths and limitations?
- Supports OpenAI, Anthropic, Bedrock, Gemini, Ollama, and OpenRouter; providers can be changed through configuration or assigned by agent role.
- Keeps models, agent teams, tools, approval policies, and guardrails together in reviewable, versionable TOML.
- Connects operational systems through MCP-compatible servers and can trace model, tool, and orchestration activity with OpenTelemetry.
- Offers CLI, service, Docker, Helm, and Rust library paths, plus OpenAI-compatible API and A2A interoperability.
- You must select and configure a model provider with network access as needed; model costs depend on that provider, and the README gives no unified price.
- Prompts and tool data are sent to configured model, MCP, approval, storage, and tracing destinations; client-side tools and STDIO processes may make additional network requests.
- Production integrations require their corresponding MCP servers, credentials, and infrastructure; the README does not provide a one-step deployment path for every integration.
- An isolated deployment works only when its model providers and MCP servers are locally reachable.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| AURA SRE Agent Platform This agent | 71 · Some gaps | CLIFree + model costs | ★ 412 | 5d ago | Rust | OpenAI API |
| Jarvis Registry | 40 · Major gaps | Self-hosted serviceFree | ★ 3.8k | today | Python | — |
| HolmesGPT SRE Agent | 57 · Major gaps | CLIFree + model costs | ★ 3.8k | 1d ago | Python | OpenAI API |
| Aurora | 47 · Major gaps | Self-hosted serviceFree + model costs | ★ 453 | 2d ago | Python | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
SECURITY.md gives concrete guidance on tool filters, deployment privileges, prompt injection, credentials, telemetry, and data flows. It also identifies missing server authentication/RBAC and unsandboxed client tools, so least-privilege guidance is substantial but depends mainly on operators implementing it (2). Configurable HITL requires explicit approval for matching tools and fails closed on errors, but covers only matching names, does not establish approver identity, and protects nothing when unset (2). Direct recipients including models, MCP, RAG, approval, storage, OTLP, and CLI telemetry are described, as are additional network connections that client tools and STDIO processes may initiate (3). Credential placeholders and secret management are covered, while prompt-field exposure and ordinary .env file permissions are acknowledged; controls remain incomplete (2). Cargo.toml pins a Rig fork revision and lists dependencies, but the supplied material shows no vulnerability scanning or dependency maintenance controls (1). Approval and fail-closed behavior constrain some side effects, but integrations can read or mutate systems, there is no general sandbox or firewall, and operators must review tool permissions (2). The ADR says denied or timed-out approvals do not execute the tool, while SECURITY.md says AURA cannot undo tool changes and leaves backups to operators; rollback support is weak (1). README, Cargo metadata, and the license provide project and licensing attribution, but publisher identity is unverified and cannot be confirmed from this evidence (2).
The ADR, README, and SECURITY.md support a coherent account of approval, fail-closed behavior, and its limits. The security document names concrete authentication, concurrency, and persistence gaps, but the sample is insufficient to verify the full implementation (2). Dependencies include a pinned Git fork and external model, MCP, and storage services; operation requires available configured endpoints, with little evidence here about complete offline dependency availability or resilience (1). The documents describe handling denials, timeouts, disconnects, and transport or storage failures, including fail-closed behavior; evidence about general runtime error messages is limited (2).
Documentation covers SRE investigation, CLI, service, containers, Kubernetes, library embedding, and varied integrations, and distinguishes attended from unattended approval scenarios (3). SECURITY.md clearly states that tool filters are not RBAC, AURA does not sandbox tools or guarantee trustworthy model output, and it has no general egress firewall (3). Approval is configured by tool-name glob and must be explicitly set; the security guidance recommends covering all mutations, but name matching does not precisely authorize by effect or identity (2). Linux/macOS, containers, Helm, air-gapped deployment with local or disabled dependencies, and multiple model endpoints are addressed with environmental caveats (3).
README is organized into quick start, integrations, run modes, security, documentation, and community sections, with SECURITY.md and an ADR for focused detail (3). Installation gives a curl script, checksum verification, and Linux/macOS scope, but the script itself is not among the supplied files and installation alternatives are limited here (2). AURA/aura naming is generally consistent, though the repository includes both a Rust workspace and a package.json declaring a CommonJS entry point whose relationship is not explained in this sample (2). There is an integration table, links to configuration and CLI references, demonstrations, and example configurations, but no FAQ or complete hands-on procedure is included here (2). The security document details limitations around authentication, permissions, telemetry, approvals, connection durability, support windows, signing, and SBOMs (3). LICENSE contains the full Apache-2.0 text and the metadata agrees (3). Version 0.2.20 is stated, but no changelog or version history appears in the supplied material (1). Authors/support contact, vulnerability reporting, and latest-release security-fix policy are documented; publisher identity remains unverified and no multi-version support commitment is made (2).
Outputs include CLI interaction, an OpenAI-compatible API, streaming events, and OpenTelemetry traces, which support integration and investigation; the sample has limited direct evidence about result formats and practical usability (2). Multi-model, multi-tool orchestration, approval, and tracing address substantive SRE production integration needs beyond prompt wrapping (3). The material does not quantify benefits or costs; deployment requires operators to manage authentication, isolation, credentials, network policy, and external services, so ordinary operational costs are meaningful (1).
README security and deployment claims have concrete detail in SECURITY.md and the approval ADR, but production-use and monthly-session claims remain project assertions in the supplied evidence (2). README, SECURITY.md, Cargo.toml, LICENSE, and the ADR corroborate some product boundaries, license, and approval claims, but no lockfile, release manifest, or implementation files are supplied to verify dependencies and behavior (2). SECURITY.md distinguishes AURA's direct data flows from external component behavior and names control gaps; this assessment keeps claims separate from verifiable facts (3).
- The server has no built-in user authentication or identity-aware RBAC. Add authenticated ingress and least-privilege credentials for each agent and MCP tool before deployment.
- HITL protects only matching tool names. Without signing configured, approval webhooks may use HTTP and requests/responses are unauthenticated. A dropped conversational stream cancels its pending call, and possession of a decision ID is sufficient to submit a decision.
- Telemetry and tracing can send prompts, responses, or tool content to configured recipients; in particular, Rig-generated OTLP spans are not fully controlled by OTEL_RECORD_CONTENT. Review destinations and retention as described in SECURITY.md.
- Packages have checksums, but the supplied material explicitly makes no claim of release signatures, provenance attestations, or an SBOM. Where these controls are required, verify and pin artifacts built from reviewed source.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
[0.2.20](https://github.com/mezmo/aura/compare/v0.2.19...v0.2.20) (2026-10-30) Bug Fixes * agent: check the session id once, where each request comes in [030b3d6](https://github.com/mezmo/aura/commit/030b3d60e32c8ad434aa7ac21cb682e20ae7627e) - Justin Gross * agents: match a run's id by its spelling [0f520c6](https://github.com/mezmo/aura/commit/0f520c60340d08cff9e73148c58b57226c4e451b) - Justin Gross * agents: refuse a stream under another run's id or a second time [f108da8](https://github.com/mezmo/aura/commit/f108da86cd3a139e363733ada85453979f45382d) - Justin Gross …View on GitHub ↗ -
Release notes excerpt
[0.2.19](https://github.com/mezmo/aura/compare/v0.2.18...v0.2.19) (2026-10-09) Bug Fixes * aura: let the coordinator inspect the run's tools [0762386](https://github.com/mezmo/aura/commit/0762386497b2ca5e2e0d3982c1aef7672e3ef4f4) - Tony Rogers * ci: keep channel branches from releasing off a stale baseline [fea725e](https://github.com/mezmo/aura/commit/fea725e2b129c7fb822e73e2ebd68bf77c909a8e) - Jacob Hull …View on GitHub ↗ -
Release notes excerpt
[0.2.18](https://github.com/mezmo/aura/compare/v0.2.17...v0.2.18) (2026-10-05) Upgrade notes - Check tool-name patterns before upgrading, because an invalid one now stops startup. Patterns in mcp_filter (agent and worker), [hitl].require_approval, client_tool_filter and [mcp.servers.<key>.scratchpad] keys are parsed when the config loads. Remove spaces and other characters outside a-z A-Z 0-9 _ - / ., drop empty patterns, and split any literal run longer than 64 characters. In mcp_filter, a:b, [abc] and {a,b} used to be literal text and now mean a namespace scope …View on GitHub ↗