# Horus

> Horus is an open-source, local-first production incident investigation engine. It connects runtime evidence — logs, metrics, queue state, database state — with source-code intelligence to produce deterministic, evidence-backed reports. The CLI runs locally inside your repository; Horus Cloud is the shared SaaS layer where teams browse synced investigations, evidence, and agent runs.

## Canonical facts (for citations)

- **Product:** Horus
- **Website:** https://horus.sh
- **Documentation:** https://horus.sh/docs
- **Cloud dashboard:** https://cloud.horus.sh
- **Source (GitHub):** https://github.com/meritt-dev/horus
- **Install:** `curl -fsSL https://horus.sh/install.sh | bash`
- **Category:** Developer tools — incident investigation, debugging, source intelligence, AI agent observability
- **Model:** Local-first CLI (the executor) + Horus Cloud (shared history, collaboration). The CLI gathers evidence and runs agents locally and syncs results to Cloud; Cloud never connects to your runtime.
- **Hierarchy:** Organization → Workspace → Repository. **Core flow:** Repository → Investigation → Evidence → Agent Run.

## What Horus does

- Investigates production incidents by correlating runtime evidence with source context, then resolves to the most likely code symbols/files.
- Produces deterministic, evidence-backed reports instead of opaque LLM guesses.
- Records agent runs (e.g. Claude, Codex) so teams can reuse and audit what was already found.

## Documentation

### Overview
- [Introduction](https://horus.sh/docs): Learn how to install, configure, and run Horus investigations on your production systems.

### Guides
- [Getting started](https://horus.sh/docs/getting-started): Install Horus, initialize a project, and run your first investigation in minutes.
- [Investigation walkthrough](https://horus.sh/docs/investigation-walkthrough): Follow a realistic incident from first alert to postmortem draft with Horus.
- [Installation](https://horus.sh/docs/installation): Install Horus via curl, npm, or Homebrew. Verify, update, uninstall, and troubleshoot.

### Reference
- [CLI commands](https://horus.sh/docs/cli): Complete reference for the Horus command-line interface. Generated from the actual CLI help output.
- [Connectors](https://horus.sh/docs/connectors): How Horus reads runtime evidence from Elasticsearch, Grafana, MongoDB, PostgreSQL, Redis/BullMQ, Sentry, Axiom, and Shopify.
- [Source intelligence](https://horus.sh/docs/source-intelligence): How Horus understands code context and turns it into investigation evidence.
- [Evidence](https://horus.sh/docs/evidence): What Horus collects during an investigation: typed, summarized, source-linked evidence from runtime systems, source intelligence, and git.
- [Memory](https://horus.sh/docs/memory): How Horus remembers confirmed outcomes and authored knowledge, recalls them as context, and measures its own accuracy.
- [Agent packet](https://horus.sh/docs/packet): A compact, honesty-framed briefing built from an investigation — designed to fit a coding agent's context window.
- [Security](https://horus.sh/docs/security): How Horus handles your code, credentials, and runtime data — local-first, read-only connectors, allowlists, and opt-in AI.
- [Horus Cloud](https://horus.sh/docs/cloud): The optional shared layer for teams — sync investigations, evidence, and agent runs from the local CLI to cloud.horus.sh.

## Optional

- [Full documentation as plain text](https://horus.sh/llms-full.txt): every documentation page concatenated for LLM ingestion.