Horus

Understand what happened.

Open-source incident investigation. Horus connects Elasticsearch, Grafana, Axiom, Sentry, MongoDB, Postgres, BullMQ, and source intelligence into a deterministic report — grounded context your team and AI coding agents can act on. Installable today.

Get Started View on GitHub

curl (recommended)

$ curl -fsSL https://horus.sh/install.sh | bash

npm

$ npm install -g @merittdev/horus

Homebrew

$ brew install meritt-dev/tap/horus

Homebrew tap is live through meritt-dev/tap.

macOS • Linux • Open source

Getting started

Install today. Investigate in minutes.

Horus is open source and installable today. Horus source intelligence requires a local code-graph host (installed automatically by the curl installer). Runtime connectors are optional but improve evidence coverage.

Step 1
```
horus init
```
Check prerequisites, register the project, index the repo, and build the queue map.
Step 2
```
horus connect elasticsearch
```
Add runtime connectors (Elasticsearch, MongoDB, PostgreSQL, Grafana, Axiom, Redis, Sentry).
Step 3
```
horus investigate "checkout latency spike"
```
Run a deterministic investigation for an incident hint.
Step 4
```
horus replay <id>
```
Re-render a saved report. Use postmortem to draft Markdown.

Read the getting started guide Follow the walkthrough

Capabilities

From signals to explanation.

Horus reads from your existing systems and reconstructs the incident through evidence, correlation, and ranked hypotheses.

Evidence

Correlation

Hypotheses

Timeline

Report

The investigation report is the product.

Investigation Summary

#347 — Checkout latency spike

Illustrative report — section names match CLI output

Confidence

82%

Affected Service

checkout-service

Owner

payments-platform

Top suspected cause

Redis connection pool exhaustion

Ranked 0.82 / high — not a single definitive root cause

Timeline

14:01Deploy #784

14:03Redis latency increase

14:05Queue backlog growth

14:07Worker starvation

14:10Checkout latency spike

Supporting Evidence

Deploy #784 at 14:01
Redis connection pool saturation
Queue backlog growth
Request timeout increase
Worker concurrency change in diff
Source-code ownership: payments-platform

Hypotheses

Queue backlog growth preceded latency spike (supported)
Deploy #784 changed worker concurrency (partial)

Evidence gaps

Worker heartbeat unavailable
Queue latency metrics not connected

Next actions

Inspect worker concurrency changes in Deploy #784
Compare queue depth before and after the deploy window

Timeline

Reconstructed from evidence.

Horus orders events across systems into a single timeline.

14:01
Deploy #784
git
14:03
Redis latency increase
metrics
14:05
Queue backlog growth
bullmq
14:08
Worker starvation
queue
14:10
Checkout latency spike
logs
14:12
Investigation started
horus

Duration

Systems

Signals

Relationships

Causal relationships

Deploy #784→Queue backlog

Redis latency→Worker starvation

Worker starvation→Checkout spike

Every incident leaves evidence.

Terminal

An investigation, not a dashboard.

After setup and indexing, Horus returns a structured report with ranked causes, hypotheses, evidence, and next actions. Illustrative output below — section names match the real CLI.

See all CLI commands

Engine status

CORRELATING

horus — zsh

$ horus investigate \

--project atlas-payments \

--env production \

"checkout latency spike"

# Investigation inv-347

Hint: checkout latency spike

## Suspected causes (ranked)

1. [0.82 / high] Redis connection pool exhaustion [↑ queue]

evidence: ev-01, ev-04, ev-07

2. [0.61 / medium] Worker concurrency regression in deploy

## Hypotheses

[supported] [0.78] queue: backlog growth preceded latency spike

## Evidence gaps

- queue runtime state: worker heartbeat unavailable

## Evidence

- ev-01 [elasticsearch/error] Request timeout increase

- ev-04 [bullmq/queue] checkout-jobs backlog growth

- ev-07 [git/change] Worker concurrency change in diff

## Next actions

- Inspect worker concurrency changes in deploy #784

- Compare queue depth before and after the deploy window

Correlation

Signals are easy. Correlation is hard.

Every system sees a piece of the incident. Horus connects evidence across sources so the sequence of events becomes visible.

Upstream signals

Redis latency+12%

BullMQ retries+48%

Queue backlog+350%

Worker starvation+91%

Correlated outcome

Checkout timeout spike

Top cause score

0.82 / high

Evidence items

Evidence

Sources Horus investigates

Horus gathers runtime and source-code evidence before forming conclusions. Source intelligence parses TypeScript, JavaScript, and Python into one code graph. Connectors are read-only and project-scoped. Trace reconstruction is not shipped yet.

Learn about connectors

Elasticsearch

Grafana

Axiom

MongoDB

PostgreSQL

BullMQ

Sentry

Git changes

Source graph

Queue map

Ownership

More coming soon

How It Works

Evidence in. Explanation out.

Principles

Built for production engineering.

Read-only

Horus never writes to your production systems. It collects evidence and leaves everything untouched.

Deterministic first

Evidence before inference. The engine is deterministic; optional --ai adds an Anthropic narrative on top.

Local-first

Runs close to your infrastructure. Connectors read from your own clusters, not a hosted black box.

Project-scoped

Every investigation belongs to a specific project and environment. No global defaults, no accidental cross-talk.

Horus Cloud

Your team’s investigation knowledge, shared.

Horus Cloud is the shared layer where investigations, evidence, and agent runs sync from the CLI. The CLI runs locally inside your repository; Cloud never connects to your runtime.

Explore Horus Cloud

Knowledge Graph

Explore and Timeline lenses connect memory, investigations, evidence, and code in one interactive graph — and show how that knowledge evolves over time.

Evidence + Provenance

Every synced investigation traces each finding back to its evidence and original source, laid out as a citation graph from cause to outcome.

Per-tenant accuracy

Insights measure how accurate and calibrated Horus is for your workspace — tracked over time, not assumed.

Compounding memory

Each investigation adds to a project memory graph, so past debugging becomes a starting point instead of lost context.

Monitoring detects. Observability shows. Horus reconstructs.

Capabilities

Investigation capabilities

Installable today. More connectors and AI providers are in progress.

Browse the CLI reference

Elasticsearch logs
Grafana metrics
Axiom logs
Sentry errors
MongoDB state
BullMQ queue evidence
Source intelligence (TS/JS + Python code graph)
Timeline generation
Evidence correlation
Investigation replay
Postmortem drafts

Coming next

Kubernetes evidence
Distributed trace reconstruction
Slack evidence ingestion
Local AI provider execution

FAQ

Common questions

How Horus fits into your stack, what it touches, and what it produces.

Horus is an open-source, local-first incident investigation tool. It connects runtime evidence — logs, metrics, queue state, database snapshots — with source-code intelligence to produce deterministic investigation reports your team and AI agents can act on.
No. Horus is read-only. Connectors gather evidence from Elasticsearch, Grafana, MongoDB, BullMQ, and other sources without modifying anything in your environment.
Elasticsearch, Grafana, Axiom, Sentry, MongoDB, PostgreSQL, BullMQ, git changes, and Horus source intelligence (TypeScript, JavaScript, and Python code graphs). More connectors — including Kubernetes and distributed traces — are in progress.
Dashboards show signals. Horus reconstructs what happened — correlating evidence, ranking hypotheses, building a timeline, and producing a structured report with suspected causes, gaps, and next actions.
Yes. Horus reports give agents grounded project context — evidence-backed causes and gaps instead of guesses. Optional --ai adds an Anthropic narrative on top of the deterministic engine output.
Yes. Horus is open source and installable today via the curl installer or Homebrew. See the getting started guide or the GitHub repository.