[ WEYLAND-YUTANI // ALERT INTELLIGENCE CORE ]

MUTHUR

6000 · AI-POWERED KUBERNETES ALERT BRAIN

Receives enriched alert payloads from collector instances, evaluates them with Claude to produce root cause, evidence and recommended action, deduplicates, and routes notifications to Discord, Telegram, Slack, PagerDuty, webhooks or email.

$ helm install muthur ★ View on GitHub
muthur@home-cluster ~ /var/log
› alert ingested · cluster-prod/payments · severity=critical
› evaluating with claude … [tool-use · structured output]
› root cause: OOMKilled — memory limit 256Mi exceeded
› dedup window: miss · semantic cache: hit (0.96)
› routing → ops-telegram, critical-discord · delivered
muthur:~$
// 01 — DATA FLOW

One brain for every cluster.

COLLECTORS
muthur-collector
cluster-a
muthur-collector
cluster-b
muthur-collector
cluster-c
protobuf
→
muthur
home cluster
POST /ingest
→ Claude
→ dedup + routing
notify
→
RECEIVERS
Discord
Telegram
Slack
PagerDuty
Webhook
Email / SMTP
// 01.5 — THE AGENT

muthur-collector

A lightweight agent that runs in every cluster you monitor. It receives AlertManager webhooks, resolves the alert target via the Kubernetes API, enriches it with logs from Loki and metrics from Prometheus, redacts PII and credentials, then forwards a protobuf payload to muthur over mTLS.

Redacts email, phone, SSN, addresses, IPv4/IPv6, Bearer tokens, JWT, AWS keys, API keys, passwords, credit cards, IBAN and UUID before anything leaves the cluster. Redaction is a fail-closed boundary — oversized or unparseable log lines are dropped, never forwarded raw.

★ muthur-collector on GitHub ↗
AlertManager webhook
↓
resolve target · K8s API
↓
enrich · Loki logs + Prometheus metrics
↓
redact PII + credentials
↓
protobuf over mTLS → muthur
// 02 — CAPABILITIES

Less noise. Real answers.

ROOT CAUSE
Claude-powered analysis
Every alert comes back with a root cause, the supporting evidence, and a recommended action — structured tool-use output, not a fragile wall of text. The redacted logs and key metrics behind it travel with the alert, so it stays useful even when the LLM is down.
ANY MODEL
Claude or your own LLM
Anthropic Claude is the default and best-supported backend. It also runs on any OpenAI-compatible endpoint — self-hosted Ollama or vLLM included — so analysis can stay entirely inside your own infrastructure.
CORRELATION
Incident grouping
Alerts that fire together are grouped into one incident: one LLM call, one notification. Cuts the alert-storm fatigue that buries the page that actually matters.
TRUST CALIBRATION
Knows when it's guessing
Every analysis carries a confidence level and a stated-vs-inferred grounding signal, so on-call can tell a data-backed root cause from an educated guess at a glance.
COST BACKSTOP
A storm can't run up the bill
A hard rate and concurrency ceiling fronts the LLM. A pathological alert storm degrades to raw delivery instead of an unbounded API bill.
SECURITY
mTLS, no shared tokens
Collectors connect with mTLS against a vendor CA — no shared bearer token to leak. Secrets are file-mounted, PII and credentials are redacted at the collector before anything leaves the cluster, and critical alerts are never auto-silenced.
ROUTING
AlertManager-style
First-match rules by severity, cluster, alert name or namespace. Any number of Discord, Telegram, Slack, PagerDuty, webhook or email/SMTP receivers.
// 03 — SAMPLE OUTPUT

What lands in your channel.

⬤ INCIDENT · CRITICAL cluster-prod / payments
ROOT CAUSE
Pod payments-api-7d9 was OOMKilled — working set exceeded the 256Mi memory limit during a traffic spike.
EVIDENCE
· container restart count +3 in 4m · node memory pressure · last log line: "fatal: runtime out of memory"
RECOMMENDED ACTION
Raise memory limit to 512Mi and add a HPA on memory. Investigate the unbounded in-flight request buffer in v2.3.1.
confidence high · grounding stated
↗ Grafana Explore ▲ useful ▼ wrong
// 03.5 — HOW IT COMPARES

Where it sits.

The closest open-source tools solve a different slice of the problem. MUTHUR is the alert-routing brain; k8sgpt scans cluster state; HolmesGPT runs deep investigations.

MUTHUR
k8sgpt
HolmesGPT
Primary role
Alert router
+ AI brain
Cluster
scanner
Investigation
agent
Multi-cluster collectors → one brain
✓
–
–
AlertManager-style routing to Discord / Telegram / Slack / PagerDuty / email
✓
~
~
Dedup window + correlation into incidents
✓
–
~
Semantic cache for near-duplicate alerts
✓
–
~
PII + credential redaction before the LLM
✓
~
–
Deep agentic investigation (iterative tool calls)
~
–
✓
Proactive cluster scanning (no alert needed)
–
✓
✓
Bring your own / local LLM (Ollama)
✓
✓
✓
Degrades to raw delivery if the LLM is down
✓
–
–
License
MIT
Apache-2.0
MIT
✓ yes · ~ partial / via platform · – no. k8sgpt and HolmesGPT are excellent, complementary open-source projects — pair them with MUTHUR rather than instead of it. Capabilities evolve; check each project's docs for the latest.
// 04 — DEPLOY

Up and running.

INSTALL VIA HELM
# add the chart repo
helm repo add vojtechpastyrik \
  https://vojtechpastyrik.github.io/charts
helm repo update

# install into its own namespace
helm install muthur \
  vojtechpastyrik/muthur \
  --namespace muthur --create-namespace \
  -f my-values.yaml
LOCAL DEV
make proto

cp .env.example .env
# fill ANTHROPIC_API_KEY
# and MUTHUR_CONFIG_FILE

make dev
THEN — INSTALL THE COLLECTOR IN EACH MONITORED CLUSTER
helm install muthur-collector \
  vojtechpastyrik/muthur-collector \
  --namespace monitoring \
  --set config.clusterId=my-cluster \
  --set config.lokiUrl=http://loki.monitoring.svc:3100 \
  --set config.prometheusUrl=http://prometheus.monitoring.svc:9090
Prerequisites: Go 1.26+ · protoc · Helm 3 · an Anthropic API key (or a self-hosted model — no key needed). Collector needs Loki + Prometheus reachable in-cluster.
// 05 — CONFIGURATION

Tune it with env vars.

The essentials are below. Everything works on sane defaults out of the box.

ENV VAR
DEFAULT
PURPOSE
LLM_PROVIDER
anthropic
Analysis backend: anthropic (default) or openai-compatible (Ollama, vLLM, OpenAI, ...).
LLM_BASE_URL
(empty)
Endpoint for an OpenAI-compatible provider, e.g. http://ollama:11434/v1 for self-hosted Ollama.
REDIS_URL
(empty)
Redis/Dragonfly connection; empty falls back to an in-memory store.
CORRELATION_ENABLED
false
Group correlated alerts into a single incident.
LLM_MAX_CALLS_PER_MINUTE
60
Cost backstop: sustained ceiling on LLM calls (0 disables).
NOTIFY_EVIDENCE_ENABLED
true
Attach a redacted log tail + key metric facts to every notification.
Full reference — semantic cache, correlation window, incident TTL, feedback few-shot, schema mode and more — in the README & Helm values.