HorusFAQ
Frequently asked questions
Answers about Horus — open-source incident investigation, read-only connectors, supported data sources, observability vs reconstruction, AI coding agents, and installation.
- Horus is an open-source, local-first incident investigation tool. It connects runtime evidence — logs, metrics, queue state, database snapshots — with source-code intelligence to produce deterministic investigation reports your team and AI agents can act on.
- No. Horus is read-only. Connectors gather evidence from Elasticsearch, Grafana, MongoDB, BullMQ, and other sources without modifying anything in your environment.
- Logs from Elasticsearch, Axiom, CloudWatch, Azure Monitor, and Google Cloud Logging; Sentry errors; Grafana and Prometheus metrics; MongoDB, PostgreSQL, SQL Server, Firestore, and Shopify state; Redis/BullMQ, Kafka, and Azure Service Bus queues; git changes; and Horus source intelligence (Python, TypeScript, JavaScript, Go, Java, and Rust code graphs). More connectors — including Kubernetes and distributed traces — are in progress.
- Dashboards show signals. Horus reconstructs what happened — correlating evidence, ranking hypotheses, building a timeline, and producing a structured report with suspected causes, gaps, and next actions.
- Yes. Horus reports give agents grounded project context — evidence-backed causes and gaps instead of guesses. Optional --ai adds an Anthropic narrative on top of the deterministic engine output.
- Yes. Every investigation is saved as local project memory. When a new investigation starts, Horus checks that memory and shows up to three related past incidents, matched on exact code identifiers and local embedding similarity of the hint. horus changes and horus what-changed also list past incidents in the code a change touches. Both are context, not verdicts; set HORUS_STARTUP_RECALL=off to turn startup recall off.
- Yes. Horus is open source and installable today via the curl installer or Homebrew. See the getting started guide or the GitHub repository.